Methods, for providing data from network secure communications in a cluster computing environment

• US 7,340,530 B2
• Filed: 01/17/2001
• Issued: 03/04/2008
• Est. Priority Date: 01/17/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Overby, Linwood H. Jr., Herr, David Anthony, Godwin, James Russell
• Primary Examiner(s): Flynn; Nathan
• Assistant Examiner(s): PATEL, ASHOKKUMAR B
• Application Number:
  US09/764,252
• Publication Number:
  US 20020095603A1
• Time in Patent Office: 2,603 Days
• Field of Search: 710/4, 710/19, 710/20, 710/21, 710/26, 710/33, 710/34, 710/105, 710/106, 710/10, 709/238, 709/245, 709/246, 370/351, 370/357, 370/360, 370/380, 370/220, 370/216, 370/218, 370/223, 370/224, 370/240
• US Class Current: 709/232
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

Secure communications are provided over a network in a distributed workload environment having target hosts which are accessed through a distribution processor by a common network address. Secure communications are provided by routing both inbound and outbound communications with target hosts which are associated with a secure network communication through the distribution processor. Both inbound and outbound secure network communications are processed at the distribution processor so as to provide network security processing of communications from the target host and network security processing of communications to the target host.

Claims

1. A method for providing secure communications over a network in a distributed workload environment having target hosts which are accessed through a distribution processor by a common network address, the method comprising the steps of:

receiving at the distribution processor, network communications directed to the common network address;

determining whether the network communications are secure network communications;

processing secure network communications by;

routing both inbound and outbound communications with target hosts which are associated with an end-to-end secure network communication through the distribution processor;

processing both inbound and outbound end-to-end secure network communications at the distribution processor so as to provide endpoint network security processing of communications from the target host to the distribution processor and endpoint network security processing of communications from the distribution processor to the target host such that the distribution processor serves as an endpoint for the end-to-end secure network communication; and

distributing the received secure network communications that are directed to the common network address among selected ones of the target hosts so as to distribute workload associated with the network communications among the target hosts including encapsulating communications between the distribution processor and the selected ones of the plurality of target hosts which are associated with end-to-end secure network communications so as to distinguish communications between the distribution processor and the selected ones of the plurality of target hosts which are associated with secure network communications from other communications; and

processing non-secure communications by distributing the received network communications that are directed to the common network address among the target hosts so as to distribute workload associated with the network communications among the target hosts.

2. A method according to claim 1, further comprising the steps of:

determining if the received network communications are end-to-end secure network communications which are to be distributed to ones of the target hosts;

wherein encapsulating communications between the distribution processor and selected ones of plurality of target hosts which are associated with end-to-end secure network communications comprises processing the received network communications so as to provide encapsulated generic communications to the ones of the plurality of target hosts if the received network communications are end-to-end secure network communications which are distributed to ones of the target hosts and to not provide encapsulated generic communications to the ones of the plurality of target hosts if the received network communications are not end-to-end secure network communications.

3. A method according to claim 2, wherein processing both inbound and outbound end-to-end secure network communications further comprises the steps of:

receiving at the distribution processor communications from the ones of the target hosts which are associated with end-to-end secure network communications; and

processing the received communications from the ones of the target hosts so as to provide endpoint network security for the communications from the ones of the target host.

4. A method according to claim 1, wherein encapsulating communications between the distribution processor and selected ones of the plurality of target hosts which are associated with end-to-end secure network communications comprises encapsulating the communications in a generic routing format.

5. A method according to claim 4, wherein the generic communications are encapsulated in a generic routing format having sufficient information in a header of the generic routing format so as to authenticate the source of the communication between the distribution processor and ones of the plurality of target hosts.

6. A method according to claim 1, wherein the communications received from the target hosts at the distribution processor and the encapsulated communications to ones of the plurality of target hosts from the distribution processor are communicated over trusted communication links.

7. A method according to claim 4, further comprising establishing common IP filters for communications at the distribution processor and the plurality or target hosts.

8. A method according to claim 7, wherein the common IP filters bypass IP filtering for inbound communications encapsulated in the generic routing format.

9. The method according to claim 1, wherein distributing the received network communications that are directed to the common IP address among selected ones of the target hosts comprises:

selecting among the target hosts for distribution of the network communications in response to a predefined selection pattern to distribute workload associated with the network communications among the target hosts.

10. The method according to claim 9, wherein selecting among the target hosts for distribution of the network communications in response to a predefined selection pattern to distribute workload associated with the network communications among the target hosts comprises:

selecting among the target hosts associated with the common network address based on a round-robin pattern.

11. The method according to claim 1, wherein distributing the received network communications that are directed to the common network address among selected ones of the target hosts comprises:

selecting among the target hosts for distribution of the network communications in response to a dynamic criteria that changes over time to distribute workload associated with the network communications among the target hosts.

12. The method according to claim 1, further comprising:

receiving at a target host, an encapsulated communication;

comparing a physical link corresponding to said distributor to a source of encapsulation; and

ignoring the encapsulated communication if said physical link does not match to said source of encapsulation.

13. The method according to claim 1, wherein distributing the received network communications that are directed to the common network address among selected ones of the target hosts distribution processor comprises distributing the received network communications using a sysplex distributor.

14. The method according to claim 1, wherein the end-to-end secure network communication comprises a communication using the IPSEC communication protocol.