Resource scheduler within a network device

• US 7,546,371 B1
• Filed: 01/09/2007
• Issued: 06/09/2009
• Est. Priority Date: 12/29/2006
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Sun, Yi, Cheng, Yonghui
• Primary Examiner(s): Maung; Zarni
• Application Number:
  US11/621,368
• Time in Patent Office: 882 Days
• Field of Search: 709/227, 709213-217, 709/229
• US Class Current: 709/227
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 47/2416 Real-time traffic
• CPC Class Codes: H04L 47/50 Queue scheduling
• CPC Class Codes: H04L 47/52 by attributing bandwidth to queues
• CPC Class Codes: H04L 49/9047 including multiple buffers, e.g. buffer pools
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests

Abstract

A network device is described in which a dedicated resource scheduler monitors memory consumption to provide for improved processing of communication sessions. The scheduler maintains a dependency list of communication sessions, and reserves memory for communication sessions as requests for memory are received. The amount of memory reserved is determined based on the amount of memory currently reserved for the communication sessions in the dependency list. The network device may control ongoing communication sessions by way of window manipulation. Communication sessions are processed in a first mode when available memory has not reached a predetermined amount, while communication sessions are processed in a second mode when available memory reaches a predetermined amount.

Claims

1. A method for processing communication sessions within a security device, the method comprising:

maintaining a dependency list of communication sessions, wherein the dependency list specifies an order in which to process the communications sessions, and wherein for each communication session the dependency list specifies an amount of memory currently reserved for the communication session;

receiving a request to reserve memory for processing a new communication session;

determining whether an amount of memory required to process the new communication session is greater than a total amount of memory reserved for the communication sessions already listed within the dependency list;

when the amount of memory required to process the new communication session is greater than the total amount of memory reserved for the communication sessions already listed within the dependency list, reserving memory for the new communication session in an amount equal to a difference between the amount of memory required to process the new communication session and the total amount of memory currently reserved for the communication sessions already listed to guarantee that processing of the new communication session can be completed upon processing the communication sessions already listed within the dependency list; and

processing the communication sessions with the security device in accordance with the dependency list.

2. The method of claim 1, wherein processing the communication sessions comprises scanning files received via the communication sessions to detect viruses.

3. The method of claim 1, further comprising:

when available memory has not reached a predetermined amount remaining, processing the communication sessions in a first mode comprising processing the communication sessions in parallel; and

when available memory reaches a predetermined amount remaining, processing the communication sessions in a second mode comprising processing the communication sessions sequentially in accordance with the dependency list.

4. The method of claim 3, wherein processing the communication sessions in the second mode comprises dynamically initiating closing of communication windows for the communication sessions other than the first communication session on the dependency list.

5. The method of claim 1, further comprising:

when the amount of memory required to process the new communication session is less than or equal to the total amount of memory reserved for the communication sessions already listed within the dependency list, reserving no additional memory for the new communication session.

6. The method of claim 1, wherein the amount of memory required to process the new communication session is determined based on protocol information associated with the new communication session.

7. The method of claim 1, wherein when the request indicates that no memory is required to process the new communication session, reserving memory for the new communication session comprises reserving a predetermined maximum amount of memory for the new communication session.

8. The method of claim 1, further comprising:

maintaining a heap of available memory; and

maintaining a public buffer pool and a reserved buffer pool as logical data structures on top of the heap that are used for allocating packet buffers to store packets received via the communication sessions;

processing the communication sessions in a first mode when neither the available memory within the heap nor available memory within the public buffer pool has reached a respective predetermined amount; and

processing the communication sessions in a second mode when either the available memory within the heap or the available memory within the public buffer pool has reached a respective predetermined amount.

9. The method of claim 8,

wherein processing the communication sessions in the first mode comprises:

allocating a packet buffer from the public buffer pool to store the received packets, and

wherein processing the communication sessions in the second mode comprises;

allocating a packet buffer from the public buffer pool to store received packets when neither the available memory within the heap nor the available memory within the public buffer pool has reached a second respective predetermined amount, and

allocating a packet buffer from the reserved buffer pool to store received packets when either the available memory within the heap or the available memory within the public buffer pool has reached the second respective predetermined amount.

10. The method of claim 1, further comprising adding the new communication session to the dependency list.

11. The method of claim 1, wherein the communication sessions are Transmission Control Protocol (TCP) sessions.

12. A network security device comprising:

a scheduler that maintains a dependency list of communication sessions, wherein the dependency list specifies an order in which to process the communications sessions, and wherein for each communication session the dependency list specifies an amount of memory currently reserved for the communication session;

a proxy module that receives a request to reserve memory for processing a new communication session;

wherein the scheduler determines whether an amount of memory required to process the new communication session is greater than a total amount of memory reserved for the communication sessions already listed within the dependency list;

wherein when the amount of memory required to process the new communication session is greater than the total amount of memory reserved for the communication sessions already listed within the dependency list, the scheduler reserves memory for the new communication session in an amount equal to a difference between the amount of memory required to process the new communication session and the total amount of memory currently reserved for the communication sessions already listed to guarantee that processing of the new communication session can be completed upon processing the communication sessions already listed within the dependency list; and

an anti-virus engine that processes the communication sessions in accordance with the dependency list.

13. The network security device of claim 12, wherein the anti-virus engine scans files received via the communication sessions to detect viruses.

14. The network security device of claim 12,

wherein when available memory has not reached a predetermined amount remaining, the scheduler operates in a first mode to cause the anti-virus engine to process the communication sessions in parallel;

and

wherein when available memory reaches a predetermined amount remaining, the scheduler operates in a second mode to cause the anti-virus engine to process the communication sessions sequentially in accordance with the dependency list.

15. The network security device of claim 14, further comprising a connection management module that dynamically initiates closing of communication windows for the communication sessions other than the first communication session on the dependency list when the scheduler operates in the second mode.

16. The network security device of claim 12,

wherein the scheduler reserves no additional memory for the new communication session when the amount of memory required to process the new communication session is less than or equal to the total amount of memory reserved for the communication sessions already listed within the dependency list.

17. The network security device of claim 12, further comprising:

a heap of available memory; and

a public buffer pool and a reserved buffer pool maintained as logical data structures on top of the heap and used for allocating packet buffers to store packets received via the communication sessions,

wherein the scheduler operates in a first mode when neither the available memory within the heap nor available memory within the public buffer pool has reached a respective predetermined amount, and

wherein the scheduler operates in a second mode when either the available memory within the heap or the available memory within the public buffer pool has reached a respective predetermined amount.

18. The network security device of claim 12, wherein the proxy module is a Transmission Control Protocol (TCP) proxy module, and wherein the communication sessions are TCP sessions.

19. The network security device of claim 12, wherein the network security device comprises an anti-virus device that resides within an enterprise network between a firewall and a plurality of internal computing nodes.

20. A computer-readable storage medium comprising instructions for causing a programmable processor to:

maintain a dependency list of communication sessions, wherein the dependency list specifies an order in which to process the communications sessions, and wherein for each communication session the dependency list specifies an amount of memory currently reserved for the communication session;

receive a request to reserve memory for processing a new communication session;

determine whether an amount of memory required to process the new communication session is greater than a total amount of memory reserved for the communication sessions already listed within the dependency list;

when the amount of memory required to process the new communication session is greater than the total amount of memory reserved for the communication sessions already listed within the dependency list, reserve memory for the new communication session in an amount equal to a difference between the amount of memory required to process the new communication session and the total amount of memory currently reserved for the communication sessions already listed; and

process the communication sessions with the security device in accordance with the dependency list.