System and method for delivering security services

• US 7,444,398 B1
• Filed: 09/13/2000
• Issued: 10/28/2008
• Est. Priority Date: 09/13/2000
• Status: Expired due to Term

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Matthews, Abraham R.
• Primary Examiner(s): Flynn, Nathan J.
• Assistant Examiner(s): Shin, Kyung H
• Application Number:
  US09/661,637
• Time in Patent Office: 2,967 Days
• Field of Search: 713/152, 709/224, 709/223, 709/226, 709/229, 370/404, 370/395.21
• US Class Current: 709/224
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A flexible, scalable hardware and software platform that allows a service provider to easily provide internet services, virtual private network services, firewall services, etc., to a plurality of customers. One aspect provides a method and system for delivering security services. This includes connecting a plurality of processors in a ring configuration within a first processing system, establishing a secure connection between the processors in the ring configuration across an internet protocol (IP) connection to a second processing system to form a tunnel, and providing both router services and host services for a customer using the plurality of processors in the ring configuration and using the second processing system.

Claims

1. A method comprising:

providing a first service processing switch at a first point-of-presence (POP) associated with a first site of a first subscriber of a service provider and a first site of a second subscriber of the service provider;

providing a second service processing switch at a second POP associated with a second site of the first subscriber and a second site of the second subscriber, wherein the first service processing switch and the second service processing switch are communicatively coupled via a network;

logically connecting a plurality of processors of the first service processing switch into a packet-passing ring configuration;

logically connecting a plurality of processors of the second service processing switch into a packet-passing ring configuration;

establishing a first set of virtual routers on the plurality of processors of the first service processing switch;

establishing a second set of virtual routers on the plurality of processors of the second service processing switch;

providing the first subscriber with a first set of customized application layer services and the second subscriber with a second set of customized application layer services and providing subscriber resource isolation by

partitioning the first set of virtual routers and the second set of virtual routers between the first subscriber and the second subscriber including (i) allocating and configuring a first partition, comprising a first subset of the first set of virtual routers and a first subset of the second set of virtual routers, to the first subscriber and (ii) allocating and configuring a second partition, comprising a second subset of the first set of virtual routers and a second subset of the second set of virtual routers, to the second subscriber,

providing the first subscriber with a first virtual private network (VPN) communicatively coupling the first site of the first subscriber with the second site of the first subscriber by establishing a first secure tunnel through the network between virtual routers of the first partition, and

providing the second subscriber with a second virtual private network (VPN) communicatively coupling the first site of the second subscriber with the second site of the second subscriber by establishing a second secure tunnel through the network between virtual routers of the second partition; and

providing changeable provisioning of processing capacity between the first subscriber and the second subscriber by programmatically dynamically reallocating resources of the first service processing switch or the second service processing switch between the first partition and the second partition based on comparative processing demands of the first set of customized application layer services and the second set of customized application layer services.

2. The method of claim 1, wherein the first set of customized application layer services comprises firewall protection.

3. The method of claim 2, wherein the first set of customized application layer services comprises web site hosting.

4. The method of claim 2, wherein the first set of customized application layer services comprises e-mail services.

5. The method of claim 1, wherein the first secure tunnel and the second secure tunnel are established by sharing a single secure tunnel between the first service processing switch and the second service processing switch.

6. The method of claim 1, wherein in said providing changeable provisioning of processing capacity between the first subscriber and the second subscriber is controlled by a services management system of the service provider.

7. The method of claim 1, wherein the plurality of processors of the first service processing switch are associated with one or more control blades, one or more access blades, and one or more processing blades.

8. The method of claim 1, wherein packets exchanged between the first service processing switch and the second processing switch contain processor identifiers (PEIDs) that identify a processor of the plurality of processors of the first service processing switch or a processor of the plurality of processors of the second service processing switch to which the packets are destined.

9. The method of claim 8, wherein the packets contain logical queue identifiers (LQIDs) that identify a software entity to which the packets are destined within the identified processor.