System using stream specification and action specification stored in policy cache to process the flow of data packets by appropriate action processor

• US 7,006,502 B2
• Filed: 02/07/2003
• Issued: 02/28/2006
• Est. Priority Date: 12/17/1998
• Status: Expired due to Term

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Inventors: Lin, YeeJang James
• Primary Examiner(s): Luu, Le Hien
• Application Number:
  US10/360,671
• Publication Number:
  US 20030135603A1
• Time in Patent Office: 1,117 Days
• Field of Search: 709/224, 709/238, 709/228, 709/223, 370/395.43, 370/360, 370/395.3, 370/389, 370/398, 370/229, 370/358, 370/397
• US Class Current: 370/395.43
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 69/12 Protocol engines

Abstract

A hardware-based policy engine that employs a policy cache to process packets of network traffic. The policy engine includes a stream classifier that associates each packet with at least one action processor based on data in the packet, and the action processor further acts on the packets based on the association determined by the stream classifier.

Claims

1. A method for processing a flow of packets of a stream over a computer network, the method comprising the steps of:

providing initial packets from the flow of packets of the stream to a flow classifier for analysis of the initial packets to aid in determining an action specification;

determining said action specification for the flow of packets of the stream;

providing the action specification to a policy cache, said action specification detailing the specific further processing of the packets of the stream;

directing the flow of packets of the stream to a stream classifier;

selecting a stream specification from the policy cache for the flow of packets of the stream; and

activating an action processor according to the stream specification to process the flow of packets of the stream.

2. The method of claim 1, wherein a plurality of action processors are activated to process the flow of packets of the stream.

3. The method of claim 1, wherein the flow classifier tracks the flow'"'"'s state.

4. The method of claim 1, wherein all packets of the stream, except for the initial packets, pass only through a policy engine without passing through the flow classifier.

5. A system for processing a flow of packets over a computer network, the system comprising:

a policy engine that receives an action specification, said action specification detailing the specific further processing of the flow of packets from a policy-based application, the policy engine having

a stream classifier that matches the flow to a stream classification, and

a plurality of action processors, each one of the plurality of action processors being associated with an action specification; and

a policy cache that stores action specifications and stream classifications,

the stream classifier processes the flow of packets by checking each packet, selecting one action specification from the policy cache,

one of the plurality of action processors applies the selected action specification to the packet.

6. The system of claim 5, wherein the stream classifier computes a hash value from a field in the packet and uses the hash value to select one action specification.

7. The system of claim 5, wherein the policy cache has a plurality of stream classifications and each stream classification being associated with multiple action specifications.

8. The system of claim 5, wherein the policy engine stores the action specifications into the policy cache.

9. The system of claim 5, wherein the policy engine provides a few packets of the flow to a flow classifier.