System directing flow of packets by-passing policy-based application for processing by policy engine according to action specification in policy cache

• US 7,773,604 B2
• Filed: 06/25/2008
• Issued: 08/10/2010
• Est. Priority Date: 12/17/1998
• Status: Expired due to Term

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Inventors: Lin, YeeJang James
• Primary Examiner(s): LUU, LE HIEN
• Application Number:
  US12/145,751
• Publication Number:
  US 20080285446A1
• Time in Patent Office: 776 Days
• Field of Search: 709/224, 709/238, 709/228, 370/395.43, 370/360, 370/395.3, 370/389, 370/398, 370/229, 370/358, 370/397
• US Class Current: 370/395.43
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 69/12 Protocol engines

Abstract

A hardware-based policy engine that employs a policy cache to process packets of network traffic. The policy engine includes a stream classifier that associates each packet with at least one action processor based on data in the packet, and the action processor further acts on the packets based on the association determined by the stream classifier.

Claims

1. A computer readable storage medium having instructions stored thereon that when executed on a processor causes said processor to process a flow a packets over a computer network by:

binding the flow of packets by a policy-based application to a policy in a policy cache;

directing the flow of packets to a policy engine, the flow of packets by-passing the policy-based application; and

processing the flow of packets by the policy engine according to action specifications in the policy cache.

2. The computer readable storage medium of claim 1 further including instructions for calculating a hash value for a packet.

3. The computer readable storage medium of claim 2 further including instructions for selecting an action specification based on the hash value.