Systems and Methods of Stateless Processing in a Fault-Tolerant Microservice Environment

• US 20190312900A1
• Filed: 02/25/2019
• Published: 10/10/2019
• Est. Priority Date: 07/29/2016
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: ShieldX Networks, Inc. (Fortinet Inc.)
• Inventors: Ahuja, Ratinder Paul Singh, Nedbal, Manuel
• Granted Patent: US 10,630,710 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A system, method, and non-transitory computer-readable relating to network security are disclosed. In particular, embodiments described generally relate to systems and methods of stateless processing in a fault-tolerant microservice environment. In one example, a method is disclosed, which includes transmitting, by a first microservice, packet data and a context associated therewith; receiving the packet data and the context by a second microservice, the second microservice to: use the context to determine what security processing to perform, perform the security processing over the packet data, and transmit resulting data and the context to a third microservice; and receiving the resulting data and the context by the third microservice, the third microservice to: use the context to determine what security processing to perform, and perform the security processing over the resulting data.

Claims

1. A method comprising:

transmitting packet data and a context associated therewith by a first microservice;

receiving, by a second microservice, the packet data and the context, the second microservice to;

send a request for a service state to one of a plurality of redundant message services, use the context and the requested service state to determine what security processing to perform, perform the security processing over the packet data, and transmit resulting data and the context to a third microservice; and

receiving, by the third microservice, the resulting data and the context, the third microservice to;

use the context to determine what security processing to perform, and to perform the security processing over the resulting data;

wherein the second microservice does not maintain a copy of the service state, such that, in case of its failure, a different microservice accesses and uses the service state.

2. The method of claim 1, wherein the second microservice and the third microservice use the context to perform the security processing.

3. The method of claim 1, wherein the first, second, and third microservices are part of a security service comprising a hierarchy of microservices, including, at the lowest level, an interface microservice to generate the context.

4. The method of claim 1, wherein the second microservice is a transmission control protocol/internet protocol (TCP/IP) microservice, and the third microservice is a deep packet inspection (DPI) microservice.

5. The method of claim 1, wherein the second microservice to use a service state and a context state to perform security processing.

6. The method of claim 5, wherein the second microservice to retrieve the service state and the context state from a state service.

7. The method of claim 5, wherein the second microservice use the context to perform the security processing and avoid retrieving the service state and the context state from a state service.

8. A system comprising:

a memory;

a processor to use the memory and to execute instructions to implement a first security microservice, the first security microservice to perform a process comprising;

transmitting, by a first microservice, packet data and a context associated therewith;

receiving the packet data and the context by a second microservice, the second microservice to;

use the context to determine what security processing is requested of the second microservice, to perform the requested security processing over the packet data, and to transmit resulting data and the context to a third microservice; and

receiving the resulting data and the context by the third microservice, the third microservice to;

use the context to determine what security processing is requested of the third microservice, and to perform the requested security processing over the resulting data,

wherein the second microservice does not maintain a copy of the service state, such that, in case of its failure, a different microservice accesses and uses the service state; and

wherein the first, second, and third microservices are part of a security service comprising a hierarchy of microservices, including, at the lowest level, an interface microservice to generate the context.

9. The system of claim 8, wherein the second microservice to extract data from the packet data, and perform the requested security processing over the data extracted from the packet data, and wherein the third microservice to extract data from the resulting data, and perform the requested security processing over the data extracted from the resulting data.

10. The system of claim 9, wherein the second microservice and the third microservice to extract higher-level data from the received data.

11. The system of claim 8, wherein the second microservice to use a service state and a context state to perform security processing.

12. The system of claim 11, wherein the second microservice to retrieve the service state and the context state from a state service.

13. The system of claim 8, wherein the second microservice to use the context to perform the security processing and avoid retrieving a service state and a context state from a state service.

14. The system of claim 11, wherein second microservice to use the context to perform the security processing and avoid retrieving the service state and the context state from a state service.

15. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method comprising:

transmitting, by a first microservice, packet data and a context associated therewith;

receiving the packet data and the context by a second microservice, the second microservice to;

use the context to determine what security processing is requested of the second microservice, perform the requested security processing over the packet data, and transmit resulting data and the context to a third microservice; and

receiving the resulting data and the context by the third microservice, the third microservice to;

use the context to determine what security processing is requested of the third microservice, and perform the requested security processing over the resulting data,

wherein the second microservice does not maintain a copy of the service state, such that, in case of its failure, a different microservice accesses and uses the service state; and

wherein the method is performed by a security service comprising a hierarchy of microservices, including, at the lowest level, an interface microservice to generate the context.

16. The non-transitory computer-readable medium of claim 15, wherein the second microservice to extract data from the packet data, and perform security processing over the data extracted from the packet data, and wherein the third microservice to extract data from the resulting data, and perform security processing over the data extracted from the resulting data.

17. The non-transitory computer-readable medium of claim 16, wherein the second microservice and the third microservice to extract higher-level data from the received data.

18. The non-transitory computer-readable medium of claim 15, wherein the second microservice to use a service state and a context state to perform security processing.

19. The non-transitory computer-readable medium of claim 15, wherein second microservice to retrieve a service state and a context state from a state service.

20. The non-transitory computer-readable medium of claim 15, wherein the second microservice to use the context to perform the security processing and avoid retrieving a service state and a context state from a state service.