SOURCE-BASED DATA FLOW PROCESSING NETWORK APPARATUS

• US 20110238783A1
• Filed: 12/29/2010
• Published: 09/29/2011
• Est. Priority Date: 09/25/2000
• Status: Abandoned Application

• Current Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Original Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Inventors: Akerman, Moisey, Korsunsky, Yevgeny
• Application Number:
  US12/980,822
• Publication Number:
  US 20110238783A1
• Time in Patent Office: Days
• US Class Current: 709/217
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: G06F 9/5033 considering data affinity
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and system for distributing flows between a multiple processors. The flows can be received from an external source such as a network, by a front-end processor that recognizes the flow and the associated request, and identifies at least one internal applications processor to process the request/flow. The front-end processor utilizes a flow scheduling vector related to the identified applications processor(s), and the flow scheduling vector can be based on intrinsic data from the applications processor(s) that can include CPU utilization, memory utilization, packet loss, and queue length or buffer occupation. In some embodiments, applications processors can be understood to belong to a group, wherein applications processors within a group can be configured identically. A flow schedule vector can be computed for the different applications processor groups.

Claims

1. A network apparatus for applying a source-based policy, comprising,

at least one network processor module having at least one processor, at least one interface to receive and forward a stream of data packets in a network, and instructions to cause the at least one processor to identify a source of the stream of data packets having data, retrieve an application profile based on the identified source, and direct the stream of data packets to at least one flow processor module for executing an application by applying a policy to the data based on the application profile;

the at least one flow processor module having at least one processor and at least one memory for storing the application for execution by the at least one flow processor module processor, the at least one flow processor module including instructions to receive the stream of data packets from the at least one network processor module, to process the data in the stream of data packets thereby providing one or more data packets with processed data, and to return the one or more data packets with processed data to the at least one network processor module for forwarding to a destination in the network; and

at least one control processor module in communication with the at least one flow processor module and the at least one network processor module, and having at least one control processor module processor, and instructions for causing the at least one control processor module processor to manage the applications in the flow processor module memories.

2. The network apparatus of claim 1, wherein the control processor module instructions for causing the at least one control processor module processor to manage the applications in the flow processor module memories further comprise instructions to cause the at least one control processor module to perform a step from the group consisting of, downloading applications to the flow processor module memories, and deleting applications from the flow processor module memories.

3. The network apparatus of claim 1, further comprising a management server module in communication with the at least one control processor module and having at least one management server module processor.

4. The network apparatus of claim 3, wherein the management server module further comprises instructions for causing the at least one management server module processor to cause the at least one control processor module to perform a step from the group consisting of, downloading applications from the management server module to the flow processor module memories, and deleting applications from the flow processor module memories.

5. The network apparatus of claim 1, further comprising a local memory device coupled to the at least one of control processor module.

6. The network apparatus of claim 1, further comprising a remote memory device coupled to the at least one of control processor module.

7. The network apparatus of claim 1, wherein the at least one control processor module further comprises instructions to cause the at least one control processor module processor to transfer data between a management server module and the at least one flow processor module.

8. The network apparatus of claim 1, further comprising at least one storage device coupled to the at least one of flow processor module.

9. The network apparatus of claim 1, wherein instructions to cause the at least one processor to identify a source of the stream of data packets includes instructions to cause the at least one processor to detect a subscriber profile in the stream of data packets and to identify the source of the stream based on the subscriber profile.

10. A method of source-based data flow processing, comprising:

providing a flow processing facility in a network;

configuring the flow processing facility to detect a source of data packets containing data in a stream of data packets received by the flow processing facility by recognizing with a network processor module of the flow processing facility one or more data packets in a data flow that include profile information, for processing by an application executing on the flow processing facility by applying a policy to the data;

directing the one or more data packets in a flow associated with the detected source from the network processor module to at least one application processor module for processing with the application by applying the policy to the data thereby providing one or more data packets with processed data; and

returning the one or more data packets with processed data to the network processor module for forwarding to a destination in the network.

11. The method of claim 10, further including managing the application executing on the at least one application processor with a control processor module that is in communication with the network processor module and the at least one application processor module.

12. The method of claim 10, wherein executing the application on the at least one application processor module further comprises selecting the at least one application based on the subscriber profile information.

13. The method of claim 12, further comprising configuring the at least one application processor module for the at least one selected application.

14. The method of claim 12, further comprising selecting at least one application processor module based on the at least one identified application.

15. The method of claim 10, further comprising selecting at least one application processor module based on application processor module loading.

16. The method of claim 10, further comprising selecting at least one application processor module based on applying the policy to the data.

17. The method of claim 10, wherein directing the one or more data packets further comprises identifying a source of the stream of data packets and retrieving an application subscriber profile based on the data source.

18. The method of claim 17, further including retrieving an application profile based on the detected source of the data packets and applying the policy based on the application profile.

19. The method of claim 17, further including adjusting the policy based on the detected source of the data packets.

20. The method of claim 17, wherein directing the one or more data packets in a flow associated with the detected source is based on the detected source.