HIGHLY SCALABLE APPLICATION NETWORK APPLIANCES WITH VIRTUALIZED SERVICES

• US 20090064288A1
• Filed: 04/11/2008
• Published: 03/05/2009
• Est. Priority Date: 08/28/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Rohati Systems, Inc. (Cisco Systems, Inc.)
• Inventors: Patra, Abhijit, Prabhu, Kirti, Thakar, Anant, Bagepalli, Nagaraj, Gandhi, Prashant
• Granted Patent: US 8,621,573 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: Y10T 70/5827 Axially movable clutch

Abstract

An application network appliance with virtualized services is described herein. According to one embodiment, a packet of a network transaction is received from a client for accessing an application server of a datacenter, where the network element operates as an application services gateway of the datacenter. A context associated with the application server is identified based on the packet, including information that identifies application services to be performed on the packet and resources to be allocated for performing the application services. A context includes information representing a logical instance of physical resources of the network element shared by multiple contexts. One or more application services are performed on the packet using the resources identified by the context. Other methods and apparatuses are also described.

Claims

1. A method performed by a network element, the method comprising:

receiving at a network element a packet of a network transaction from a client over a first network for accessing an application server of a datacenter over a second network, the network element operating as an application services gateway of the datacenter;

identifying a context associated with the application server based on based on the packet, including information that identifies one or more application services to be performed on the packet and resources to be allocated for performing the application services, wherein each context includes information representing a logical instance of one or more physical resources of the network element shared by multiple contexts; and

performing the one or more application services on the packet using the resources identified by the context.

2. The method of claim 1, wherein the context is determined based on a destination IP address and/or a layer-4 port number specified within the packet.

3. The method of claim 1, wherein the context is associated with a business unit of an enterprise associated with the datacenter and/or a particular application server of the datacenter.

4. The method of claim 1, wherein each context is associated with one or more policy domains and each policy domain comprises one or more policies specify how the applications services to be performed on the packet.

5. The method of claim 4, further comprising authenticating a user associated with the packet using an authentication policy identified by the policy domains.

6. The method of claim 5, further comprising authorizing the user associated with the packet using an authorization policy identified by the policy domains.

7. The method of claim 6, wherein the authorization is performed using one or more user attributes with respect to the application server to determine whether the user is eligible to access the application server.

8. The method of claim 4, wherein each policy domain comprises one or more application proxies, and wherein each application proxy identifies types of one or more application services to be performed on the network transaction.

9. The method of claim 8, wherein the network element comprises a plurality of service modules configurable to perform application services, wherein an application proxy identifies which of the service modules to perform the application services, wherein an application proxy further identifies hardware resources allocated to the identified service modules.

10. A machine-readable medium having instructions stored therein, which when executed by a machine, cause the machine to perform a method, the method comprising:

receiving at a network element a packet of a network transaction from a client over a first network for accessing an application server of a datacenter over a second network, the network element operating as an application services gateway of the datacenter;

identifying a context associated with the application server based on the packet, including information that identifies one or more application services to be performed on the packet and resources to be allocated for performing the application services, wherein each context includes information representing a logical instance of one or more physical resources of the network element shared by multiple contexts; and

performing the one or more application services on the packet using the resources identified by the context.

11. The machine-readable medium of claim 10, wherein the context is determined based on a destination IP address and/or a layer-4 port number specified within the packet.

12. The machine-readable medium of claim 10, wherein the context is associated with a business unit of an enterprise associated with the datacenter and a context is associated with a particular application server of the datacenter.

13. The machine-readable medium of claim 10, wherein each context is associated with one or more policy domains and each policy domain comprises one or more policies specify how the applications services to be performed on the packet.

14. The machine-readable medium of claim 13, wherein the method further comprises authenticating a user associated with the packet using an authentication policy identified by the policy domains.

15. The machine-readable medium of claim 14, wherein the method further comprises authorizing the user associated with the packet using an authorization policy identified by the policy domains.

16. The machine-readable medium of claim 15, wherein the authorization is performed using one or more user attributes with respect to the application server to determine whether the user is eligible to access the application server.

17. The machine-readable medium of claim 15, wherein each policy domain comprises one or more application proxies, and wherein each application proxy identifies types of one or more application services to be performed on the network transaction.

18. The machine-readable medium of claim 17, wherein the network element comprises a plurality of service modules configurable to perform application services, wherein an application proxy identifies which of the service modules to perform the application services, wherein an application proxy further identifies hardware resources allocated to the identified service modules.