Handling state information in a network element cluster

• US 7,146,421 B2
• Filed: 10/19/2001
• Issued: 12/05/2006
• Est. Priority Date: 03/19/2001
• Status: Expired due to Term

• Current Assignee: Forcepoint LLC
• Original Assignee: Stonesoft Oy (Rtx Corporation)
• Inventors: Syvanne, Tuomo
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): ISMAIL, SHAWKI SAIF
• Application Number:
  US10/032,881
• Publication Number:
  US 20020133594A1
• Time in Patent Office: 1,873 Days
• Field of Search: 709223-226, 709238-239, 709248-249, 370/395.32, 370/401
• US Class Current: 709/226
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1029 using data related to the state of servers by a load balancer
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method for handling dynamic state information used for handling data packets, which arrive at a network element node of a network element cluster, said network element cluster having at least two nodes and each node handling separate sets of data packets. In a node there is maintained 206 a first, node-specific data structure comprising entries representing state information needed for handling sets of data packets handled in said node. In said node there is also maintained 208 a second, common data structure comprising at least entries representing state information needed for handling sets of data packets handled in one other node of said network element cluster. The contents of said common data structure effectively differs from the contents of said node-specific data structure. Data packets are distributed 202, 204 to nodes of the cluster by means of distribution identifiers allocated 200 to nodes. Advantageously, information related to the distribution identifiers is included 212 in the entries of the data structures in order to identify to which node a set of data packets represented by a given entry belongs to at a given moment.

Claims

1. A method for handling dynamic state information used for handling data packets, which arrive at a network element node of a network element cluster, said network element cluster having at least two nodes and each node handling separate sets of data packets, said method comprising:

maintaining in a first node a first, node-specific data structure comprising entries representing state information needed for handling sets of data packets handled in said first node, said sets of data packets handled in said first node being different from sets of data packets handled in any other node of said network element cluster, and each set of data packets containing data packets related to each other,

maintaining in said first node in addition to said node-specific data structure a second, common data structure comprising at least entries representing state information for data packets handled in at least one other node of said network element, cluster, the contents of said common data structure effectively differing from the contents of said node-specific data structure and including copies of all state information entries maintained in a node-specific data structure of said at least one other node and needed for handling sets of data packets in said at least one other node, said entries being maintained according to information on how different sets of data packets are distributed among the nodes of the network element cluster,

dynamically changing distribution of at least one set of data packets from said at least one other node to said first node in the network element cluster, and providing said first node with respective changed distribution information,

in response to said changed distribution information, selecting the state information entries of at least one re-distributed set of data packets from said second common data structure and transferring them to said first node specific data structure of said first node;

allocating to each node belonging to said network element cluster certain node-specific distribution identifiers, each node having separate node-specific distribution identifiers allocated to it,

handling at least a plurality of data packets so that a data packet is handled in that node of said network element cluster, to which node a distribution identifier calculated using certain field(s) of said data packet is allocated, and

maintaining in a plurality of entries of said node-specific and common data structures distribution information relating to the distribution identifier, which corresponds to the set of data packets related to the respective entry.

2. A method according to claim 1, further comprising:

reallocating said distribution identifiers to the nodes of said network element cluster,

if said reallocation results in a new distribution identifier being allocated to a node, said new distribution identifier being a distribution identifier not allocated to said node at the time of the reallocation, identifying in the common data structure of said node the entries corresponding to said new distribution identifier, and adding said entries to the node-specific data structure of said node, and

if said reallocation results in an old distribution identifier not being allocated to a node anymore, said old distribution identifier being a distribution identifier allocated to said node at the time of the reallocation, identifying in the node-specific data structure of said node the entries corresponding to said old distribution identifier, and clearing said entries from the node-specific data structure of said node.

3. A method according to claim 1, further comprising:

adding a new entry to said node-specific data structure in a first node,

communicating said new entry at least to a second node of the network element cluster, and

adding an entry corresponding to said new entry to the common data structure of said second node.

4. A method according to claim 3, further comprising:

adding an entry corresponding to said new entry to the common data structure of said first node.

5. A method according to claim 1, further comprising maintaining in said common data structure of said node entries representing state information needed for handling sets of data packets handled in said node.

6. A method according to claim 1, wherein said state information comprises the source address field and/or the destination address field of an Internet Protocol header, and/or port header fields of a Transmission Control Protocol header and/or port header fields of a User Datagram Protocol header, and/or the identifier header field of an Internet Control Message Protocol header, and/or a Message Identifier field of an Internet Security Association and Key Management Protocol header, and/or an Initiator Cookie field of an Internet Security Association and Key Management Protocol header, and/or the Security Parameter Index field of a security header relating to the IPSec protocol suite, and/or a Session ID field relating to the Secure Sockets Layer protocol, and/or an HTTP Cookie field relating to the HyperText Transfer Protocol.

7. A method according to claim 1, wherein said state information comprises information identifying an authenticated entity.

8. A method according to claim 1, wherein said state information comprises information identifying a secured tunnel, within which data packets of the corresponding set are tunneled.

9. A method according to claim 1, wherein said distribution identifier is a hash value and a hash function is used for calculating a hash value using certain field(s) of a data packet.

10. A method according to claim 1, wherein said distribution information is said distribution identifier.

11. A method according to claim 1, wherein said distribution information is information needed for calculating said distribution identifier for the corresponding data packet.

12. A method according to claim 1, wherein said certain field(s) for calculating a distribution identifier comprise the source address field and/or the destination address field of an Internet Protocol header, and/or port header fields of a Transmission Control Protocol header and/or port header fields of a User Datagram Protocol header, and/or the identifier header field of an Internet Control Message Protocol header, and/or a Message Identifier field of an Internet Security Association and Key Management Protocol header, and/or an Initiator Cookie field of an Internet Security Association and Key Management Protocol header, and/or the Security Parameter Index field of a security header relating to the IPSec protocol suite, and/or a Session ID field relating to the Secure Sockets Layer protocol, and/or an HTTP Cookie field relating to the HyperText Transfer Protocol.

13. A network element node of a network element cluster having at least two nodes, said node comprising:

a first data storage,

means for maintaining in said first data storage a first, node-specific data structure comprising entries representing state information needed for handling sets of data packets handled in said node, said sets of data packets handled in said first node being different from sets of data packets handled in any other node of said network element cluster, and each set of data packets containing data packets related to each other in one or more of the following ways;

data packets of same packet data connection, data packets of same communication session comprising a plurality-of packet data connections, and data packets of a plurality of packet data connections of same secure tunnel,

a second data storage,

means for maintaining in said second data storage a second, common data structure comprising at least entries representing state information for data packets handled in one other node of said network element cluster, the contents of said common data structure effectively differing from the contents of said node-specific data structure and including copies of all state information entries maintained in a node-specific data structure of said at least one other node and needed for handling sets of data packets in said at least one other node, and said entries being maintained according to information on how different sets of data packets are distributed among the nodes of the network element cluster,

means for receiving changed distribution information dynamically changing distribution of at least one set of data packets from said at least one other node to said node in the network element cluster, and

means for selecting, based on said changed distribution information the state information entries of at least one re-distributed set of data packets from said second common data structure in said second data storage and transfers them to said first node-specific data structure in said first data storage of said node,

means for receiving a distribution identifiers, which are currently allocated to said node, said distribution identifiers being used for handling at least a plurality of data packets so that a data packet is handled in that node of said network element cluster, to which node a distribution identifier calculated using certain field(s) of said data packet is allocated,

a third data storage for storing said distribution identifiers, and

wherein said means for maintaining the node-specific and common data structures are adapted to maintain in a plurality of entries of said node-specific.

14. A network element node according to claim 13, wherein:

said means for maintaining the node-specific data structure are adapted to add a new entry to said node-specific data structure in said first storage means, and to communicate said new entry to said means for maintaining common data structure,

said means for maintaining the common data structure are adapted to communicate said new entry at least to one other node of the network element cluster, and in that

said means for maintaining the common data structure are further adapted to receive an entry from at least one other node of the network element cluster and to add an entry corresponding to said received entry to said common data structure in said second storage means.

15. A network element node according to claim 14, wherein:

said means for maintaining the common data structure are further adapted to add a new entry received from said means for maintaining the node-specific data structure to said common data structure in said second storage means.

16. A network element node according to claim 13, wherein:

said means for receiving distribution identifiers are adapted to receive reallocated distribution identifiers,

said means for maintaining the common data structure are adapted to detect a new distribution identifier being allocated to said node due to the reallocation, said new distribution identifier being a distribution identifier not allocated to said node at the time of receiving reallocated distribution identifiers, and to identify in the common data structure the entries corresponding to said new distribution identifier, and to communicate said entries to said means for maintaining the node-specific data structure for said entries to be added to the node-specific data structure, and

said means for maintaining the node-specific data structure are adapted to detect an old distribution identifier not being anymore allocated to said node due to the reallocation, said old distribution identifier being a distribution identifier allocated to said node at the time of the reallocation, and to identify in the node-specific data structure the entries corresponding to said old distribution identifier, and to clear said entries from the node-specific data structure.

17. A network element node according to claim 13, wherein said first data storage is a portion of kernel space memory.

18. A network element node according to claim 13, wherein said second data storage means is a portion of user space memory.

19. A network element node according to claim 13, wherein said first data storage is a portion of content addressable memory.

20. A network element node according to claim 13, wherein said first storage means is a part of a cryptographic card.

21. A network element cluster having at least two network element nodes, at least one of said nodes comprising:

a first data storage means,

means for maintaining in said first storage means a first, node-specific data structure comprising entries representing state information needed for handling sets of data packets handled in said node, said sets of data packets handled in said node being different from sets of data packets handled in any other node of said network element cluster, and each set of data packets containing data packets related to each other,

a second data storage means, and

means for maintaining in said second storage a second, common data structure comprising at least entries representing state information needed for handling sets of data packets handled in one other node of said network element cluster, the contents of said common data structure effectively differing from the contents of said node-specific data structure and including copies of all state information entries maintained in a node-specific data structure of said one other node and needed for handling sets of data packets in said one other node, said entries being maintained according to information on how different sets of data packets are distributed among the nodes of the network element cluster,

means for receiving changed distribution information dynamically changing distribution of at least one set of data packets from said one other node to said at least one node in the network element cluster, and

means for selecting based on said changed distribution information the state information entries of at least one re-distributed set of data packets from said second common data structure in said second data storage and transferring them to said first node-specific data structure in said first data storage means of said at least one node;

means for allocating to each node belonging to said network element cluster certain node-specific distribution identifiers, each node having separate node-specific distribution identifiers allocated to it, said distribution identifiers being used for handling at least a plurality of data packets so that a data packet is handled in that node of said network element cluster, to which node a distribution identifier calculated using certain field(s) of said data packet is allocated, and in that said at least one node further comprises;

means for receiving a distribution identifiers, which are currently allocated to said node, and

a third data storage for storing said distribution identifiers, and

wherein said means for maintaining the node-specific and common data structures are adapted to maintain in a plurality of entries of said node-specific and common data structures in said first and second data storage means distribution information relating to the distribution identifier, which corresponds to the set of data packets related to the respective entry.

22. A network element cluster according to claim 21, wherein:

said means for allocating distribution identifiers are adapted to reallocate distribution identifiers to the nodes of said network element cluster, and wherein in said at least one node

said means for receiving distribution identifiers are adapted to receive reallocated distribution identifiers, and

said means for maintaining the common data structure are adapted to detect a new distribution identifier being allocated to said node due to the reallocation, said new distribution identifier being a distribution identifier not allocated to said node at the time of receiving reallocated distribution identifiers, and to identify in the common data structure the entries corresponding to said new distribution identifier, and to communicate said entries to said means maintaining the node-specific data structure for said entries to be added to the node-specific data structure, and

said means for maintaining the node-specific data structure are adapted to detect an old distribution identifier not being anymore allocated to said node due to the reallocation, said old distribution identifier being a distribution identifier allocated to said node at the time of the reallocation, and to identify in the node-specific data structure the entries corresponding to said old distribution identifier, and to clear said entries from the node-specific data structure.

23. A computer-readable medium comprising computer-executable components which, when run on a computer, configure the computer to

operate as a network element node of a network element cluster having at least two nodes and each node handling separate sets of data packets,

maintain in said network element node a first, node-specific data structure comprising entries representing state information needed for handling sets of data packets handled in said network element node, said sets of data packets handled in said network element node being different from sets of data packets handled in any other node of said network element cluster, and each set of data packets containing data packets related to each other,

maintain in said network element node in addition to said node-specific data structure a second, common data structure comprising at least entries representing state information for data packets handled in at least one other node of said network element cluster, the contents of said common data structure effectively differing from the contents of said node-specific data structure and including copies of all state information entries maintained in a node-specific data structure of said at least one other node and needed for handling sets of data packets in said at least one other node, said entries being maintained according to information on how different sets of data packets are distributed among the nodes of the network element cluster,

receive changed distribution information dynamically changing distribution of at least one set of data packets from said at least one other node to said network element node in the network element cluster,

select based on said changed distribution information, the state information entries of at least one re-distributed set of data packets from said second common data structure and transfer them to said first node-specific data structure of said network element node,

receive distribution identifiers, which are currently allocated to said node, said distribution identifiers being used for handling at least a plurality of data packets so that a data packet is handled in that node of said network element cluster, to which node a distribution identifier calculated using certain field(s) of said data packet is allocated, and

maintain in a plurality of entries of said node-specific and common data structures in said first and second data storage distribution information relating to the distribution identifier, which corresponds to the set of data packets related to the respective entry.