System and method for network management of local area networks having non-blocking network switches configured for switching data packets between subnetworks based on management policies

• US 6,718,379 B1
• Filed: 06/09/2000
• Issued: 04/06/2004
• Est. Priority Date: 06/09/2000
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: Advanced Micro Devices, Inc.
• Inventors: Viswanath, Somnath, Tzeng, Shr-Jie, Kanuri, Mrudula, Krishna, Gopal S., Chow, Peter Ka-Fai
• Primary Examiner(s): Maung, Zarni
• Assistant Examiner(s): Tran, Philip B.
• Application Number:
  US09/590,685
• Time in Patent Office: 1,397 Days
• Field of Search: 709/223, 709/224, 709/217, 709/238, 709/220, 709/249
• US Class Current: 709/223
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A centralized policy server sends policy messages, that describe network management policy, to network switches. Each policy message includes a packet attribute that enables a network switch to uniquely identify a received data packet, and either a priority level or network switch action that describes the switching operation to be performed by the network switch. The network switches are configured for implementing the network management policy by storing switching actions for prescribed data packets, and templates that specify frame data parameters for identifying the prescribed data packets. Each network switch, configured for performing layer 2 and layer 3 switching in an Ethernet (IEEE 802.3) network without blocking of incoming data packets, includes in each network switch port a packet classifier module configured for classifying a received data packet based on a template generated based on the policy messages. In particular, the network switch stores a plurality of user-programmable templates, each configured for identifying a corresponding class of data packet.

Claims

1. A method comprising:

outputting from a policy server a policy message specifying a prescribed network management policy;

receiving the policy message by a network switch system configured for switching data packets in a local area network;

first generating, in the network switch system, a switching action that specifies a prescribed switching operation to be performed by the network switch system for a corresponding prescribed data packet based on the received policy message;

second generating, in the network switch system, at least one template configured for identifying the prescribed data packet from data packets received from the local area network; and

selectively switching the data packets received from the local area network, by the network switch system, based on the received policy message.

2. The method of claim 1, wherein the outputting step includes specifying a packet attribute for identifying the prescribed data packet, and at least one of a priority level and a network switch action that describes the prescribed switching operation to be performed by the network switch system.

3. The method of claim 2, wherein the first generating step includes generating the switching action based on the at least one of a priority level and a network switch action, and storing the switching action as an entry in a switching table in the network switch system.

4. The method of claim 3, wherein the first generating step includes specifying a priority for switching the corresponding prescribed data packet by the network switch system based on the priority level.

5. The method of claim 4, wherein the selectively switching step includes selectively outputting the prescribed data packet, received by the network switch system, on an output switch port based on the corresponding priority level relative to the data packets received from the local area network.

6. The method of claim 4, wherein the selectively switching step includes selectively dropping the prescribed data packet, received by the network switch system, based on the corresponding priority level relative to the data packets received from the local area network.

7. The method of claim 3, wherein the selectively switching step includes selectively outputting the prescribed data packet, received by the network switch system, on an output switch port based on the network switch action specifying that access to the output switch port for the prescribed data packet is granted.

8. The method of claim 3, wherein the selectively switching step includes selectively dropping the prescribed data packet, received by the network switch system, based on the network switch action specifying that access to the output switch port for the prescribed data packet is denied.

9. The method of claim 1, wherein the outputting step includes sending the policy message to the network switch system via an out of band link.

10. The method of claim 1, wherein the outputting step includes sending the policy message to the network switch system via the local area network.

11. The method of claim 1, wherein:

the outputting step includes specifying a packet attribute for identifying the prescribed data packet; and

the second generating step includes generating and storing the at least one template, based on the packet attribute, in a selected network switch port of the network switch system based on a determined source for the prescribed data packet.

12. The method of claim 11, wherein the step of generating and storing the at least one template includes storing a plurality of min terms for the at least one template, each min term specifying a prescribed data pattern for a corresponding portion of the prescribed data packet.

13. The method of claim 11, wherein:

the step of generating and storing the at least one template includes generating and storing a packet signature that represents a hashing of prescribed data patterns from the respective portions of the prescribed data packet according to a prescribed hash function; and

the step of selectively switching includes determining whether the packet signature of a received data packet matches the stored packet signature, and selectively switching the received data packet according to the switching action based on a match between the packet signature of the received data packet and the stored packet signature.

14. A network switching system comprising:

a policy server configured for storing prescribed network management policies for network stations, the policy server configured for outputting a policy message specifying a selected one of the prescribed network management policies; and

a network switch system comprising;

(1) switching logic having a switching table configured for storing a switching action that specifies a prescribed switching operation to be performed for a corresponding prescribed data packet based on the received policy message, and

(2) a plurality of network switch ports, each having a packet classification module configured for classifying each data packet received on the corresponding network switch port, the network switch system storing in the packet classification module of a selected one of the network switch ports a template for identifying the prescribed data packet, the switching logic executing the switching action in response to the packet classification module of the one network switch port identifying a received data packet as the prescribed data packet.

15. The system of claim 14, wherein the switching action specifies a priority for switching the corresponding prescribed data packet based on the received policy message.

16. The system of claim 14, wherein the switching action specifies selective access to a the output switch port for the prescribed data packet based on the received policy message.

17. The system of claim 14, wherein each packet classification module includes a hash generator configured for generating a packet signature that represents a hashing of selected portions of said each data packet received on the corresponding network switch port based on the received policy message, said each packet classification module configured for classifying said each data packet received on the corresponding network switch port based on a comparison with a prescribed signature generated based on the received policy message.

18. The system of claim 14, wherein each packet classification module includes:

a min term memory configured for storing min term values, each min term value stored based on a location of a corresponding selected byte of the incoming data packet for comparison, an expression portion. specifying a corresponding comparison operation, and a template identifier field that specifies templates that use the corresponding min term based on the received policy message; and

a min term generator configured for simultaneously comparing a received byte of said each data packet received on the corresponding network switch port with a min term that corresponds to the received byte, the packet classification module classifying said each data packet received on the corresponding network switch port based on an identified one of the templates having min terms that match the respective selected byte of said each data packet received on the corresponding network switch port.

19. The system of claim 14, wherein the network switch system includes a processor configured for generating the switching action and the template based on the received policy message.