Methods, systems and computer program products for providing failure recovery of network secure communications in a cluster computing environment

• US 7,146,432 B2
• Filed: 01/17/2001
• Issued: 12/05/2006
• Est. Priority Date: 01/17/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Antes, Mark L., Overby, Linwood H. Jr., Herr, David Anthony, Wierbowski, David J., Godwin, James Russell
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): SALL, EL HADJI MALICK
• Application Number:
  US09/764,790
• Publication Number:
  US 20030018813A1
• Time in Patent Office: 2,148 Days
• Field of Search: 709/220, 709/224, 709/225, 709/219, 709/223, 709/226, 709/228, 709/232, 709/235, 709/229, 709/239, 709/240, 709/242, 709/26, 370/216, 370/218, 370/220, 370/223, 370/224, 713/200, 713/201
• US Class Current: 709/239
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1017 based on a round robin mechanism
• CPC Class Codes: H04L 67/1034 Reaction to server failures by a load balancer
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Methods, systems and computer program products provide for recovering from the failure of a primary distribution processor which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the primary distribution processor by a common network address. Information sufficient to restart communications through the primary distribution processor utilizing network security is provided to a backup distribution processor. Failure of the primary distribution processor is detected and the communications utilizing network security restarted at the backup distribution processor utilizing the provided information. Both inbound and outbound communications with target hosts utilizing the common network address and which are associated with a secure network communication are then routed through the backup distribution processor. Both inbound and outbound processing of secure network communications utilizing the common network address is performed at the backup distribution processor so as to provide network security processing of communications from the target host and network security processing of communications to the target host.

Claims

1. A method of recovering from a failure of a primary distribution processor which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the primary distribution processor by a common network address, the method comprising the steps of:

providing to a backup distribution processor information sufficient to restart communications through the primary distribution processor utilizing network security;

detecting the failure of the primary distribution processor;

restarting the communications utilizing network security at the backup distribution processor utilizing the provided information;

routing both inbound and outbound communications with target hosts utilizing the common network address and which are associated with a secure network communication through the backup distribution processor; and

processing the inbound and outbound secure network communications at the backup distribution processor so as to provide network security processing of the inbound and outbound communications.

2. A method according to claim 1, further comprising the step of maintaining information sufficient to restart communications through the backup distribution processor accessible to at least one distribution processor other than the backup distribution processor.

3. A method according to claim 1, wherein the step of providing information sufficient to restart communications comprises the steps of transmitting network security information from which network security relationships associated with the communications through the primary distribution processor utilizing network security can be re-established at the backup distribution processor from the primary distribution processor to the backup distribution processor prior to failure of the primary distribution processor.

4. A method according to claim 1, wherein the step of providing information sufficient to restart communications comprises the step of storing in a common storage accessible to the backup distribution processor, network security information from which network security relationships associated with the communications through the primary distribution processor can be re-established at the backup distribution processor.

5. A method according to claim 4, wherein the step of restarting the communications utilizing network security at the backup distribution processor utilizing the provided information, comprises the following steps carried out by the backup distribution processor:

obtaining the network security information from the common storage;

establishing the security relationships associated with the communications through the primary distribution processor at the backup distribution processor; and

notifying target hosts associated with the communications that the backup distribution processor has taken ownership of the communications.

6. A method according to claim 5, further comprising the step of clearing the network security information from the common storage subsequent to the backup distribution processor obtaining the network security information from the common storage.

7. A method according to claim 5, further comprising the step of storing in the common storage, network security information from which network security relationships associated with the communications through the backup distribution processor can be re-established at another distribution processor.

8. A method according to claim 5, further comprising the step of identifying as non-distributed communications, communications to the backup distribution processor utilizing network security which were previously distributed communications routed through the primary distribution processor.

9. A method according to claim 5, wherein the network security comprises Internet Protocol Security (IPSec).

10. A method according to claim 9, wherein the network security information stored in the common storage includes at least one of Phase 1 Security Association (SA) information, Phase 2 SA information and information relating the Phase 1 SA information to the Phase 2 SA information.

11. A system for recovering from a failure of a primary distribution processor which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the primary distribution processor by a common network address, comprising:

means for providing to a backup distribution processor information sufficient to restart communications through the primary distribution processor utilizing network security;

means for detecting the failure of the primary distribution processor;

means for restarting the communications utilizing network security at the backup distribution processor utilizing the provided information;

means for routing both inbound and outbound communications with target hosts utilizing the common network address and which are associated with a secure network communication through the backup distribution processor; and

means for processing the inbound and outbound secure network communications at the backup distribution processor so as to provide network security processing of the inbound and outbound communications.

12. A computer program product for recovering from a failure of a primary distribution processor which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the primary distribution processor by a common network address, comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code which provides to a backup distribution processor information sufficient to restart communications through the primary distribution processor utilizing network security;

computer readable program code which detects the failure of the primary distribution processor;

computer readable program code which restarts the communications utilizing network security at the backup distribution processor utilizing the provided information;

computer readable program code which routes both inbound and outbound communications with target hosts utilizing the common network address and which are associated with a secure network communication through the backup distribution processor; and

computer readable program code which processes the inbound and outbound secure network communications at the backup distribution processor so as to provide network security processing of the inbound and outbound communications.