Content service aggregation device for a data center

• US 7,363,353 B2
• Filed: 07/08/2002
• Issued: 04/22/2008
• Est. Priority Date: 07/06/2001
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Spurrier, Gregory G, Ganesan, Elango, Lee, Yen, Panwar, Ramesh, Freed, Michael, Phillips, John, Bryers, Mark, Nguyen, Chau Anh Ngoc, Zhou, Yuhong Andy, Ramanoorthi, Sankar, Zaidi, Nazar
• Primary Examiner(s): Vaughn; William
• Assistant Examiner(s): BAYARD, DJENANE M
• Application Number:
  US10/191,746
• Publication Number:
  US 20030069973A1
• Time in Patent Office: 2,115 Days
• Field of Search: 709/226, 709/246, 709/238, 709/232, 709/218, 709/201, 709/203, 370/474, 370/389, 370/235
• US Class Current: 709/218
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

An architecture for controlling a multiprocessing system to provide at least one network service to subscriber data packets transmitted in the system using a plurality of compute elements, comprising a management compute element including service set-up information for at least one service and at least one processing compute element applying said at least one network service to said data packets and communicating service set-up information with the management compute element in order to perform service specific operations on data packets. In a further embodiment, a method of controlling a processing system including a plurality of processors is disclosed. The method comprises the steps of operating at least one of said processors as a control authority providing service provisioning information for a subscriber; and operating a set of processors as a service specific compute element responsive to the control authority, receiving provisioning information from the subscriber and performing service specific instructions on data packets to provide IP content services.

Claims

1. A network appliance to provide a plurality of different network services to a plurality of subscribers of a network data center, the network appliance comprising:

a plurality of removable compute elements; and

a switching fabric to forward data packets among the removable compute elements,

wherein the plurality of removable compute elements include;

a flow control element to receive a data packet having at least a source address, a destination address and a separate subscriber identifier;

a removable compute element that executes a conversation handler that applies a policy configuration associated with a first subscriber of the data center to identify a first set of at least two network services to be applied to the data packet when the subscriber identifier of the data packet indicates that the data packet is associated with the first subscriber and that applies a policy configuration associated with a second subscriber of the data center to identify a second set of at least two network service to be applied to the data packet when the subscriber identifier of the data packet indicates that the data packet is associated with the second subscriber;

a first set of at least two removable compute elements to perform the first set of network services, wherein the first set of removable compute elements are arranged in a first processing pipeline and

a second set of at least two removable compute elements to perform the second set of network services, wherein the second set of removable compute elements are arranged in a second processing pipeline,

wherein the flow control element uses the subscriber identifier contained within the data packet to identify the data packet as being associated with one of the subscribers of the data center, and

wherein the flow control element directs the data packet to a first one of the removable compute elements of the first set of removable compute elements when the data packet is associated with a first one of the subscribers of the data center and directs the data packet to a first one of the second set of removable compute elements when the data packet is associated with a second subscriber of the data center.

2. The network appliance of claim 1, wherein after performing a first one of the network services, the first removable compute element in the first set of removable compute elements dynamically forwards the data packet to a second removable compute element in the first set of removable compute elements for performance of a second network service in accordance with the arrangement of the first processing pipeline.

3. The network appliance of claim 2, wherein the removable compute elements perform the network services and forward the data packet through the removable compute elements in accordance with a pre-defined order of the processing pipeline.

4. The network appliance of claim 1, wherein the first set of removable compute elements is contained within a single removable blade.

5. The network appliance of claim 1, wherein at least one of the removable compute elements comprises a plurality of microprocessors.

6. The network appliance of claim 1, wherein at least one of the removable compute elements includes an application-specific integrated circuit.

7. The network appliance of claim 1, wherein the first removable compute element in the first set of removable compute elements is optimized to perform a first network service in the first set of network services.

8. The network appliance of claim 1, wherein the flow control element dynamically directs the data packet to a removable compute element in the first set of removable compute elements based on a processing load of the first removable compute element in the first set of removable compute elements.

9. The network appliance of claim 1, wherein the first set of network services includes a firewall service.

10. The network appliance of claim 1, wherein the first set of network services includes art Internet Protocol Security (IPSec) service.

11. The network appliance of claim 1, wherein the first set of network services includes a Quality of Service (QoS) service.

12. The network appliance of claim 1,

wherein the plurality of removable compute elements includes a control authority to load packet processing software on the removable compute elements to configure the compute elements into the first processing pipeline and the second processing pipeline.

13. The network appliance of claim 12, wherein the control authority configures the flow control element by instructing the flow control clement how to direct data packets to the removable compute elements based on subscriber identifiers within the data packets.

14. The network appliance of claim 1, wherein the network appliance provides network services for the subscribers for different geographically distributed facilities of the network data center.

15. The network appliance of claim 1,

wherein the flow control element analyzes data packets to detect different packet flows within the data packets, and creates entries in a flow table for the flows of the data packets;

and

wherein the flow control element uses the entries in the flow table to direct the data packets to different ones of the removable compute elements.

16. The network appliance of claim 1,

wherein a the conversation handler that determines whether a flow table includes an entry for a flow of data packets to which the data packet belongs;

wherein the conversation handler creates an entry in the flow table for the flow of data packets to which the, data packet belongs when the flow table does not include an entry for the flow to which the data packet belongs; and

wherein the flow control element uses the created entry to direct subsequent data packets to the first or second set of removable compute elements in the same flow as the data packet.

17. The network appliance of claim 1,

wherein, upon receiving the data packet, the flow control element identifies a set of network services to be applied to the data packet based on the subscriber identifier contained within the data packet and creates a dynamic pipeline by identifying one or more of the removable processing elements that are currently configured to provide the identified network services,

wherein die flow control element adds a route-tag to the data packet, and

wherein die route-tag causes the data packet to be routed among the identified removable processing elements in the dynamic pipeline, such that the identified removable processing elements apply the identified set of network service, to the data packet.

18. A method for providing a plurality of different network services to a plurality of subscribers of a network data center, the method comprising:

receiving a data packet with a flow control element, wherein the flow control element is a member of a plurality of removable compute elements in a network appliance, and wherein the data packet includes at least a source address, a destination address and a separate subscriber identifier;

determining, with a control authority, whether a flow table includes an entry for a flow of data packets to which the data packet belongs, wherein a set of the compute elements provide the control authority;

identifying, with the control authority, the data packet as being associated with one of the subscribers of the data center based on the subscriber identifier contained within the data packet;

applying, with the control authority, when the flow table does not include an entry for the flow of data packets to which the data packet belongs and when the data packet is associated with a first one of the subscribers, a policy configuration associated with the first one of the subscribers in order to identify a first set of at least two network services to be applied to data packets in the flow of data packets;

creating, with the control authority, when the flow table does not include an entry for the flow of data packets to which the data packet belongs, an entry in the flow table for the flow of data packets, wherein the entry indicates how to direct data packets in the flow of data packets among the removable compute elements such that removable compute elements in a first set of removable compute elements apply each network service in the first set of network services to data packets in the flow of data packets,

applying, with the control authority, when the flow table does not include an entry for the flow of data packets to which the data packet belongs and when the data packet is associated with a second of the subscribers, a policy configuration associated with the second one of the subscribers in order to identity a second set of at least two network services to be applied to data packets in the flow of data packets;

creating with the control authority, when the flow table does not include an entry for the flow of data packets to which the data packet belongs and when the data packet is associated with a second one of the subscribers, an entry in the flow table for the flow of data packets, wherein the entry indicates how to direct data packets in the flow of data packets among the removable compute elements such that removable compute elements in a second set of removable compute elements apply each network service in the second set of network services to data packets in the flow of data packets,

wherein the first set of removable compute elements apply the first set of network services as a first processing pipeline;

wherein the second set of removable compute elements apply the second set of network services as a second process pipeline;

identifying, with the flow control element, the data packet as belonging to the flow of data packets;

directing, with the flow control element, the data packet to a first removable compute element of the first set of removable compute elements via a switching fabric when the data packet belongs to the flow of data packets and when the entry for the flow of data packets in the flow table indicates that the data packet is to be directed to the first removable compute element of the first set of the removable compute elements;

performing, with removable compute elements in the first set of removable compute elements, the first set of network services when the removable compute elements in the first set of removable compute elements receive the data packet;

directing, with the flow control element, the data packet to a first removable compute element of the second set of removable compute elements via the switching fabric when the data packet belongs to the flow of data packets and when the entry for the flow of data packets in the flow table indicates that the data packet is to be directed to the first removable compute element of the second set of the removable compute elements; and

performing, with removable compute elements in the second set of removable compute elements, network services in the second set of network services when the removable compute elements in the second set of removable compute elements receive the data packet.

19. The method of claim 18, wherein a removable compute element in the plurality of removable compute elements comprises a plurality of microprocessors.

20. The method of claim 18, wherein a removable compute element in the plurality of removable compute elements comprises an application-specific integrated circuit.

21. The method of claim 18, wherein a removable compute element in the first set If removable compute elements is optimized to perform a first network service in the first set of at least two network services.

22. The method of claim 18, wherein performing the first set of network services comprises forwarding the data packet from the first removable compute element in the first set of removable compute elements to a second removable compute element in the first set of removable compute elements dynamically.

23. The method of claim 18, wherein performing the first set of network services comprises forwarding the data packet from the first removable compute element in the first set of removable compute elements to a second removable compute elements in the first set of removable compute elements in accordance with a pre-defined order.

24. The method of claim 18, wherein the first set of removable compute elements is housed in a removable blade.

25. The method of claim 18, wherein the first set of network services is not identical to the second set of network services.

26. The method of claim 18, wherein directing the data packet comprises dynamically directing the data packet to the first removable compute element in the first set of removable compute elements based on a processing load of the first removable compute element in the first set of removable compute elements.

27. The method of claim 18, wherein performing the first set of at least two network services comprises performing a firewall service.

28. The method of claim 18, wherein performing the first set of at least two network sevices comprises performing an Internet Protocol Security (IPSec) service.

29. The method of claim 18, wherein performing the first set of at least two network services comprises performing a Quality of Service (QoS) service.

30. The method of claim 18, wherein the method further comprises automatically loading, with the control authority, packet processing software on removable compute elements in the first set of the removable compute elements, wherein the packet processing software causes the removable compute elements in the first set of removable compute elements to perform the first set of network services.

31. A network appliance to provide a plurality of different network services to a plurality of subscribers of a network data center, the network appliance comprising:

a plurality of removable compute elements; and

a switching fabric to forward data packets among the removable compute elements,

wherein the plurality of removable compute elements include;

a first set of at least two removable compute elements to perform a first set of at least two network services, wherein the first set of removable compute elements are arranged in a first processing pipeline,

a second set of at least two removable compute elements to perform a second set of at least two network services, wherein the second set of removable compute elements are arranged in a second processing pipeline, and

a flow control element to receive a data packet having at least a source address, a destination address and a separate subscriber identifier,

wherein the flow control element identifies the data packet as being associated with one of the subscribers of the data &

enter by identifying a set of network services to be applied to the data packet based on the subscriber identifier contained within the data packet,

wherein the flow control element creates a dynamic pipeline by identifying one or more of the removable processing elements that are currently configured to provide the identified network services,

wherein the flow control element adds a route-tag to the data packet,

wherein the route-tag causes the data packet to be routed among the identified removable processing elements in the dynamic pipeline, such that the identified removable processing elements apply the identified set of network services to the data packet, and

wherein the flow control element directs the data packet to a first one of the removable compute elements of the first set of removable compute elements when the data packet is associated with a first one of the subscribers of the data center and directs the data packet to a first one of the second set of removable compute elements when the data packet is associated with a second subscriber of the data center.