System and Methods For Scalable Packet Inspection in Cloud Computing

• US 20170324847A1
• Filed: 05/04/2016
• Published: 11/09/2017
• Est. Priority Date: 05/04/2016
• Status: Active Grant

• Current Assignee: SecureWorks Corp. (Dell Technologies Inc.)
• Original Assignee: SecureWorks Corp. (Dell Technologies Inc.)
• Inventors: Good, Daniel, Bathina, Sai, Bilyy, Ihor, Kim, Seungyoung
• Granted Patent: US 9,973,600 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method for packet inspection in a computer network includes receiving a plurality of network streams from a plurality of client systems at a first load balancer; allocating the network streams across a proxy instances; and inspecting and filtering the network streams by the proxy instances. The method further includes forwarding the filtered network streams to a second load balancer; allocating the filtered network streams to a plurality of application instances; and processing and responding to the network streams at the application instances. The method still further includes inspecting and filtering the responses to the network streams by the proxy instances; and forwarding the response to the client systems.

Claims

1. A method for packet inspection in a computer network, comprising:

receiving a plurality of network streams from a plurality of client systems at a first load balancer;

allocating the network streams across a plurality of proxy instances;

inspecting and filtering the network streams by the proxy instances;

forwarding the filtered network streams to a second load balancer;

allocating the filtered network streams to a plurality of application instances; and

processing and responding to the network streams at the application instances;

inspecting and filtering the responses to the network streams by the proxy instances;

forwarding the response to the client systems.

2. The method of claim 1, further comprising:

originating by at least one of the application instances a second data stream to a external host;

receiving the second data stream at a Network Address Translation instance;

inspecting and filtering the second data stream by the Network Address Translation instance;

forwarding the filtered second data stream to the external host;

receiving a response from the external host at the Network Address Translation instance; and

inspecting, filtering, and forwarding the response to the at least one of the application instances.

3. The method of claim 1, further comprising:

receiving, at a master instance, a software or configuration change;

providing a notification from the master instance to the proxy instances that the software or configuration change is available; and

each proxy instance synchronizing the software or configuration change at the master instance with a local software or configuration.

4. The method of claim 1, further comprising:

sending an alert from a proxy instance to a master instance when the inspecting and filtering triggers an event;

acknowledging by the master instance that the alert has been received and recorded; and

deleting a record of the alert at the proxy instance in response to the acknowledgement.

5. The method of claim 1, further comprising

dynamically provisioning an additional proxy instance when a load across the proxy instances exceeds a threshold.

6. The method of claim 1, wherein inspecting and filtering includes comparing the signatures and discarding packets of a network stream when the packets match a signature.

7. A system for packet inspection in a computer network, comprising:

a first load balancer configured to receive a plurality of network streams from a plurality of client systems, and to allocate the network streams across a plurality of proxy instances;

the proxy instances configured to;

inspect and filter the network streams;

forward the filtered network streams to a second load balancer;

inspect and filter responses to the network streams; and

forward the filtered response to the client systems;

the second load balancer configured to allocate the filtered network streams to a plurality of application instances; and

the application instances configured to process and respond to the network streams.

8. The system of claim 7, wherein the proxy instances are configured to inspect the network stream at one or more of the network layer, the transport layer, the session layer, the presentation layer and the application layer.

9. The system of claim 7, further comprising:

a Network Address Translation instance configured to;

receive a second data stream originated by at least one of the application instances containing a request for an external host;

inspect and filter the second data stream;

forward the filtered second data stream to the external host;

receive a response from the external host;

inspecting, filtering, and forwarding the response to the originating application instance.

10. The system of claim 7, further comprising:

a master instance configured to;

receive a software or configuration change; and

provide a notification to the proxy instances that the software or configuration change is available;

wherein the proxy instances are further configured to;

synchronize the software or configuration change at the master instance with a local software or configuration.

11. The system of claim 7, wherein:

the proxy instances are configured to;

send an alert from a proxy instance to a master instance when the inspecting and filtering triggers an event; and

delete a record of the alert at the proxy instance in response to the acknowledgement by the master instance; and

wherein the master instance is further configured to;

store the alert; and

acknowledge the alert has been received and recorded.

12. The system of claim 7, wherein additional proxy instance are dynamically provisioned when a load across the proxy instances exceeds a threshold.

13. The system of claim 7, wherein inspecting and filtering includes comparing the signatures and discarding packets of a network stream when the packets match a signature.

14. A system for packet inspection in a computer network, comprising:

a first load balancer configured to allocate a plurality of network streams across a plurality of proxy instances;

a second load balancer configured to allocate the filtered network streams to a plurality of application instances;

the proxy instances configured to;

inspect and filter the network streams;

forward the filtered network streams to the second load balancer;

inspect and filter responses to the network streams; and

forward the filtered response to the client systems;

the application instances configured to;

process and respond to the network streams; and

originate a second data stream to obtain data from an external host;

a Network Address Translation instance configured to;

inspect and filter the second data stream;

forward the filtered second data stream to the external host;

receive a response from the external host; and

inspect, filter, and forward the response to the originating application instance.

15. The system of claim 14, wherein the proxy instances are configured to inspect the network stream at one or more of the network layer, the transport layer, the session layer, the presentation layer and the application layer.

16. The system of claim 14, further comprising:

a master instance configured to;

receive a software or configuration change; and

provide a notification to the proxy instances that the software or configuration change is available;

wherein the proxy instances are further configured to;

synchronize the software or configuration change at the master instance with a local software or configuration.

17. The system of claim 16, wherein the Network Address Translation instance is configured to perform the functions of the master instance.

18. The system of claim 14, wherein:

the proxy instances are configured to;

send an alert from a proxy instance to a master instance when the inspecting and filtering triggers an event; and

delete a record of the alert at the proxy instance in response to the acknowledgement by the master instance; and

wherein the master instance is further configured to;

store the alert; and

acknowledge the alert has been received and recorded.

19. The system of claim 14, wherein additional proxy instance are dynamically provisioned when a load across the proxy instances exceeds a threshold.

20. The system of claim 14, wherein inspecting and filtering includes comparing the signatures and discarding packets of a network stream when the packets match a signature.