Packet routing with payload analysis, encapsulation and service module vectoring

• US 7,948,977 B2
• Filed: 05/05/2006
• Issued: 05/24/2011
• Est. Priority Date: 05/05/2006
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Bennett, James D.
• Primary Examiner(s): Phan; Man
• Assistant Examiner(s): Mansoury; Nourali
• Application Number:
  US11/429,477
• Publication Number:
  US 20070258449A1
• Time in Patent Office: 1,845 Days
• Field of Search: 370/389, 370/400, 370/352, 370/355, 370/395.52
• US Class Current: 370/389
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An Internet infrastructure with network devices and end point devices containing service module manager and service modules, that supports packet analysis, encapsulation and vectoring, and interleaving applications. The network device that supports packet content analysis on arriving packet, consists of a plurality of packet switched interface circuitries, user interface circuitry, local storage comprising the service module manager software and a plurality of local service modules, and processing circuitry communicatively coupled to each of the packet switched interfaces, local storage and user interface circuit. The processing circuitry executes service module manager and thus analyzes the packet content and applies one or more selected local service module processing using the packet. The processing circuitry thus takes one or more actions on the packet. A packet switching exchange that supports packet content analysis, encapsulation and vectoring on arriving packet, consisting a plurality of interconnecting switches, a plurality of line cards, general primary processing card. A client device that supports packet content analysis on arriving packet containing a plurality of network interfaces, user interface circuitry, local storage and processing circuitry communicatively coupled to each of the network interfaces, local storage and user interface circuitry.

Claims

1. A packet switching exchange that receives a plurality of packets, each of the plurality of packets having header content and payload content, the packet switching exchange comprising:

a plurality of switches;

primary processing circuitry communicatively coupled to the plurality of switches;

one or more line cards, communicatively coupled to the plurality of switches, each of the one or more line cards comprising a network interface and processing circuitry configured to compare the header content of a received packet with a trigger template to determine if the received packet is to be delivered to the primary processing circuitry, and based on a result of the comparison of the header content, deliver the received packet to the primary processing circuitry along with a request for the primary processing circuitry to perform a comparison using a supplemental template;

the primary processing circuitry configured to compare the payload content of a received packet with the supplemental template to determine if the received packet is to be delivered to a service module, and, based on a result of the comparison of the payload content, deliver the received packet to the service module for processing; and

the processing circuitry further configured to deliver supplemental information to the primary processing circuitry based on a result of the comparison of the header content, the supplemental information identifying the service module to which the received packet is to be delivered, and a service to be provided.

2. The packet switching exchange of claim 1, wherein the packet switching exchange is a router.

3. The packet switching exchange of claim 1, wherein the packet switching exchange is an access point.

4. The packet switching exchange of claim 1, further comprising the service module.

5. The packet switching exchange of claim 1, wherein the service module is a remote service module.

22. The packet switching exchange of claim 1, wherein the primary processing circuitry is further configured to vector the received packet out of a communications pathway for processing by the service module.

6. A network node in a packet switched network that participates in a communication pathway between a first end-point device and a second endpoint device, the communication pathway supporting delivery of a packet, the network node comprising:

first communication interface circuitry communicatively coupled to the first end-point device via a first portion of the communication pathway;

second communication interface circuitry communicatively coupled to the second endpoint device via a second portion of the communication pathway;

processing circuitry communicatively coupled to both the first communication interface circuitry and the second communication interface circuitry;

storage, communicatively coupled to the processing circuitry, comprising a plurality of templates;

the processing circuitry to compare the packet to the plurality of templates, and based on the comparison, both selectively vector the packet out of the communication pathway to at least one of a plurality of service modules for application of service, and deliver a copy of the packet into the communication pathway; and

the processing circuitry further to deliver a request to the at least one of the plurality of service modules to apply a specific type of processing to the packet selectively vectored out of the communication pathway.

7. The network node of claim 6, wherein the selective vectoring of the packet out of the communication pathway comprises applying local service functionality to the packet.

8. The network node of claim 6, wherein the selective vectoring of the packet out of the communication pathway comprises delivering the packet to a remote server.

9. The network node of claim 6, wherein the network node comprising an access point.

10. The network node of claim 6, wherein the plurality of templates comprising a payload template.

11. The network node of claim 6, wherein the processing circuitry executes trigger logic to determine whether to vector the packet out of the communication pathway.

12. The network node of claim 6, wherein the plurality of service modules comprising a local service module.

13. The network node of claim 6, wherein the plurality of service modules comprising a remote service module.

14. A packet switching infrastructure that communicates a plurality of packets, each of the plurality of packets having payload content, the packet switching infrastructure comprising:

a packet switched pathway that communicates the plurality of packets;

a plurality of service functions;

a plurality of predefined templates comprising at least one header template and at least one payload template;

processing circuitry that delivers the plurality of packets along at least a portion of the packet switched pathway;

the processing circuitry configured to perform an initial comparison of at least one of the plurality of packets with the at least one header template to determine whether additional processing is to be performed on the at least one of the plurality of packets;

the processing circuitry further configured to perform a second comparison of the at least one of the plurality of packets with the at least one payload template to determine a selected function of the plurality of service functions is to be performed on the at least one of the plurality of packets; and

the processing circuitry, based at least in part on the second comparison, selects one of a plurality of service modules to perform the selected function on the at least one of the plurality of packets.

15. The packet switching infrastructure of claim 14, wherein the processing circuitry comprising switching node circuitry.

16. The packet switching infrastructure of claim 14, wherein the processing circuitry comprising end point device circuitry.

17. The packet switching infrastructure of claim 14, wherein the processing circuitry comprising access point circuitry.

18. The packet switching infrastructure of claim 14, wherein the plurality of service functions comprising a service function at a different premises than that of the processing circuitry.

19. The packet switching infrastructure of claim 14, wherein the plurality of service functions comprising a service function performed by the processing circuitry.

20. The packet switching infrastructure of claim 14, wherein the plurality of service functions comprising a service function performed by remote processing circuitry.

23. The packet switching infrastructure of claim 14, wherein the processing circuitry is configured to vector the at least one of the plurality of packets out of a communication pathway for application of the selected one of the plurality of service functions.

21. A method performed by a network node in a packet switched communication pathway, the packet switched communication pathway for routing a plurality of packets, the method comprising:

performing a first comparison comparing at least a first one of the plurality of packets against at least a first one of a plurality of predefined templates;

performing a second comparison comparing the at least a first one of the plurality of packets against at least a second one of the plurality of predefined templates;

encapsulating the at least a first one of the plurality of packets in a request to a service module to apply a specific type of processing to the packet;

routing the request encapsulating the at least a first one of the plurality of packets to a remote service function outside the communication pathway in response to the second comparison; and

routing of the at least a first of the plurality of packets into the communication pathway.