NETWORK SECURITY LOAD BALANCING

• US 20130305038A1
• Filed: 05/14/2012
• Published: 11/14/2013
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Volusion, LLC
• Original Assignee: Volusion Incorporated (Volusion, LLC)
• Inventors: SPROLES, Kevin, Turner, William
• Granted Patent: US 9,264,409 B2
• Time in Patent Office: Days
• US Class Current: 713/152
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

A website hosting system includes a request routing node and a plurality of security termination nodes coupled to the request routing node. Each security termination node is configured to secure connections between servers hosting websites and customers of the websites in accordance with a predetermined quality of service level. The request routing node balances incoming requests for secure websites among the security termination nodes based on an application-specific parameter (e.g., quantity of items in a product catalog, location, etc.).

Claims

1. A website hosting system, comprising:

a request routing node; and

a plurality of security termination nodes coupled to the request routing node, each security termination node configured to secure connections between servers hosting websites and customers of the websites in accordance with a predetermined quality of service level;

wherein the request routing node balances incoming requests for secure websites among the security termination nodes based on an application-specific parameter.

2. The system of claim 1 wherein the application-specific parameter comprises a rate or volume of traffic.

3. The system of claim 1 wherein the application-specific parameter is a quality of service level.

4. The system of claim 1 wherein the application-specific parameter is an indicator of geographical location.

5. The system of claim 1 wherein the application-specific parameter is a quantity of items in a catalog offered for sale by the application.

6. The system of claim 1 wherein the application-specific parameter comprises a previously specified service tier assigned to a user of the system.

7. The system of claim 1 wherein the application-specific parameter comprises a time zone.

8. The system of claim 1 wherein at least one security termination node implements a Secure Socket Layer (SSL) protocol.

9. The system of claim 1 further comprising a plurality of websites hosted by the system, each website having assigned a unique Internet Protocol (IP) address.

10. The system of claim 1 wherein the quality of service comprises at least one of:

processing speed, throughput, and number of processing nodes.

11. A method comprising:

receiving a request for a secure connection from a browser;

determining which of a plurality of security termination nodes to assign the request for the secure connection based on an application-specific parameter; and

transmitting the request to the determined security termination node.

12. The method of claim 11 wherein the application-specific parameter is indicative of rate of network traffic or volume of network traffic, and wherein determining which of the plurality of security termination nodes further comprises determining whether the rate or volume of traffic exceeds a threshold.

13. The method of claim 11 wherein determining which of the plurality of security termination nodes further comprises determining the application-specific parameter is a quality of service level.

14. The method of claim 11 wherein determining which of the plurality of security termination nodes further comprises determining the application-specific parameter is an indicator of geographical location.

15. The method of claim 11 wherein determining which of the plurality of security termination nodes further comprises determining the application-specific parameter is a quantity of items in a catalog offered for sale by an application.

16. The method of claim 11 wherein determining which of the plurality of security termination nodes further comprises determining a previously specified service tier assigned to a user of a network security load balancing system.

17. The method of claim 11 wherein the determined security termination node implements Secure Socket Layer (SSL) verification.

18. A non-transitory computer-readable medium storing instructions that, when executed by a processor, causes the processor to:

receive a request for a secure connection;

determine which of a plurality of security termination nodes to assign the request based on an application-specific parameter; and

transmit the request to the determined security termination node.

19. The non-transitory computer-readable medium of claim 18 wherein the application-specific parameter is indicative of rate of network traffic or volume of network traffic, and wherein the instructions cause the processor to determine which of the plurality of security termination nodes to assign the request by determining whether the rate or volume of traffic exceeds a threshold.

20. The non-transitory computer-readable medium of claim 18 wherein the instructions further cause the processor to determine the application-specific parameter is a quality of service level.

21. The non-transitory computer-readable medium of claim 18 wherein the instructions further cause the processor to determine the application-specific parameter is a geographical location.

22. The non-transitory computer-readable medium of claim 18 wherein the instructions further cause the processor to determine the application-specific parameter is a quantity of items in a catalog offered for sale by an application.

23. The non-transitory computer-readable medium of claim 18 wherein the instructions further cause the processor to determine the application-specific parameter is a previously specified service tier assigned to a user of the system.

24. The non-transitory computer-readable medium of claim 18 wherein the instructions further cause the processor to trigger the determined security termination node to implement Secure Socket Layer (SSL) verification.

25. A web-site hosting system, comprising:

a request router;

a plurality of secure termination nodes coupled to the request router, each secure termination node creates secure connections between browsers and web servers based on certificates based on a predetermined level of service, wherein the request router balances incoming requests for security certificate verification among the security termination nodes based on an application-specific parameter;

a load balancer coupled to the plurality of secure termination nodes; and

a plurality of application servers coupled to the load balancer, wherein the load balancer balances web page access requests among the application servers;

wherein the web-hosting system is configured to host a plurality of websites, each website having its own unique Internet Protocol (IP) address.

26. The system of claim 25 wherein the application-specific parameter comprises a rate or volume of traffic.

27. The system of claim 25 wherein the application-specific parameter is an indicator of geographical location.

28. The system of claim 25 wherein the application-specific parameter is a quantity of items in a catalog offered for sale by the application.

29. The system of claim 25 wherein the application-specific parameter comprises a previously specified service tier assigned to a user of the system.

30. The system of claim 25 wherein at least one secure termination node implements SSL verification.

31. The system of claim 25 wherein the secure termination node is a Secure Socket Layer (SSL) termination node.