Packet routing system and method

• US 8,260,918 B2
• Filed: 09/12/2006
• Issued: 09/04/2012
• Est. Priority Date: 09/13/2000
• Status: Expired due to Term

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Matthews, Abraham Rabindranath, Weir, Steven Patrick
• Primary Examiner(s): ZHANG, SHIRLEY X
• Application Number:
  US11/530,901
• Publication Number:
  US 20070121579A1
• Time in Patent Office: 2,184 Days
• Field of Search: 709223-225, 709/245, 709217-219, 709/238, 370/351, 370/389
• US Class Current: 709/225
• CPC Class Codes: H04L 12/42 Loop networks
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A flexible, scalable hardware and software platform that allows a service provider to easily provide internet services, virtual private network services, firewall services, etc., to a plurality of customers. One aspect provides a method and system for delivering security services. This includes connecting a plurality of processors in a ring configuration within a first processing system, establishing a secure connection between the processors in the ring configuration across an internet protocol (IP) connection to a second processing system to form a tunnel, and providing both router services and host services for a customer using the plurality of processors in the ring configuration and using the second processing system, a packet routing system and method is described that includes a processor identifier in each packet to route the packets to a physical processor, and a logical queue identifier to route the packets to the destination object within that processor.

Claims

1. A method comprising:

providing a service provider with a service processing switch including a plurality of blades each having a plurality of processor elements;

partitioning a plurality of virtual routers (VRs) of the service processing switch between a first subscriber and a second subscriber of the service provider by associating a first set of processor element identifiers (PEIDs) with a first set of processor elements of the plurality of processor elements supporting a first set of VRs of the plurality of VRs partitioned to the first subscriber and a second set of PEIDs with a second set of processor elements of the plurality of processor elements supporting a second set of VRs of the plurality of VRs partitioned to the second subscriber, wherein PEIDs are assigned to each of the plurality of processor elements based on a combination of a blade ID of a blade of the plurality of blades with which the processor element is associated and a processor element number of the processor element;

configuring the first set of VRs to provide a first set of managed network-based security services on behalf of the first subscriber by creating within the first set of VRs a first object group including a first subset of objects selected to be supportive of the first set of managed network-based security services;

configuring the second set of VRs to provide a second set of managed network-based security services on behalf of the second subscriber by creating within the second set of VRs a second object group including a second subset of objects selected to be supportive of the second set of managed network-based security services;

the service processing switch providing appropriate managed network-based security services for the first subscriber and the second subscriber by

steering a first subscriber packet destined for or originating from a site of the first subscriber to an appropriate processor element of the first set of processor elements supporting the first set of VRs and an appropriate object within the first object group based on a PEID value associated with the first subscriber packet and a logical queue identifier (LQID) value associated with the first subscriber packet, the PEID value associated with the first subscriber packet corresponding to a PEID assigned to the appropriate processor element of the first set of processor elements, and the LQID value associated with the first subscriber packet corresponding to an LQID assigned to the appropriate object within the first object group; and

steering a second subscriber packet destined for or originating from a site of the second subscriber to an appropriate processor element of the second set of processor elements supporting the second set of VRs and an appropriate object within the second object group based on a PEID value associated with the second subscriber packet and a logical queue identifier (LQID) value associated with the second subscriber packet, the PEID value associated with the second subscriber packet corresponding to a PEID assigned to the appropriate processor element of the second set of processor elements, and the LQID value associated with the second subscriber packet corresponding to an LQID assigned to the appropriate object within the second object group.

2. The method of claim 1, further comprising:

configuring the first set of VRs to provide a first set of router services on behalf of the first subscriber by creating within the first set of object groups one or more of a first routing object, a first packet filtering object and a first network address translation object; and

configuring the second set of VRs to provide a second set of router services on behalf of the second subscriber by creating within the second set of object groups one or more of a second routing object, a second packet filtering object and a second network address translation object.

3. The method of claim 2, further comprising providing the service processing switch within a point of presence (POP) of a service provider network.

4. The method of claim 3, wherein the first set of managed network-based security services include firewall inspection and access control functions.

5. The method of claim 3, wherein the first set of managed network-based security services include virtual private network (VPN) tunneling and encryption.

6. The method of claim 3, wherein the second set of managed network-based security services include firewall inspection and access control functions.

7. The method of claim 3, wherein the second set of managed network-based security services include virtual private network (VPN) tunneling and encryption.

8. The method of claim 1, wherein a service management system (SMS) of the service provider performs said configuring the first set of VRs and said configuring the second set of VRs.

9. The method of claim 8, wherein a first Customer Network Management (CNM) system is installed at an information services (IS) headquarters site of the first subscriber, and wherein a second CNM system is installed at an IS headquarters site of the second subscriber, the method further comprising:

providing an information technology (IT) manager of the first subscriber with the ability to (i) initiate service provisioning and augmentation of the first set of VRs and (ii) obtain detailed network and service performance information via the first CNM; and

providing an IT manager of the second subscriber with the ability to (i) initiate service provisioning and augmentation of the second set of VRs and (ii) obtain detailed network and service performance information via the second CNM.

10. An Internet Protocol (IP) service delivery architecture comprising:

a Service Management System (SMS) residing in a Network Operations Center (NOC) of a service provider;

an IP service processing switch, including a plurality of blades each having a plurality of processor elements, located within a service provider'"'"'s Point of Presence (POP) and communicatively coupled to the service provider via a backbone of the service provider, the IP service processing switch providing customized, managed network-based security services to each of a plurality of subscribers of the service provider by (i) allocating one or more virtual routers (VRs) of a plurality of VRs to each of the plurality of subscribers based on processor element identifiers (PEIDs) associated with a set of processor elements of the plurality of processor elements supporting the plurality of VRs, (ii) instantiating object groups within the one or more VRs allocated to each subscriber based on security service needs of the subscriber, (iii) assigning logical queue identifiers (LQIDs) to objects of the object groups; and

(iv) steering received packets to appropriate objects of the object groups based on PEID values and LQID values associated with the packets, the PEID values containing information indicative of a blade ID of a blade of the plurality of blades and a processor element number of a processor element of the set of processor elements associated with the blade;

a Customer Network Management (CNM) system communicatively coupled with the IP service processing switch and located at a site within each subscriber;

wherein the SMS enables centralized deployment, configuration and management of a managed network-based security service on behalf of the plurality of subscribers; and

wherein the CNMs provide the respective subscribers with the ability to (i) initiate service provisioning and augmentation of the customized, managed network-based security services and (ii) obtain detailed network and service performance information.

11. An Internet Protocol (IP) service processing switch comprising:

a plurality of blades each having a plurality of processor elements (PEs), each of the plurality of PEs running a plurality of virtual routers (VRs) configured to provide customized security services to a subscriber of a plurality of subscribers of a service provider by (i) creating object groups within the plurality of VRs in accordance with security service needs of respective subscribers and (ii) assigning logical queue identifiers (LQIDs) to objects of the object groups, the objects including one or more of a routing object, a packet filtering object a firewall object and a network address translation (NAT) object, each of the plurality of PEs being assigned a PE identifier (PEID), based on a PE number of the PE and a blade ID of a blade of the plurality of blades with which the PE is associated, that is unique within the IP service processing switch;

a packet-passing ring coupling the plurality of blades in communication; and

wherein upon a blade of the plurality of blades receiving a packet,

the blade inspects a PEID value associated with the packet and if the PEID value corresponds to a PE of the plurality of PEs on the blade, then the packet is steered to an object of the plurality of VRs running on the PE that corresponds to the LQID value, and

if the PEID value does not correspond to any of the PEs of the plurality of PEs on the blade, then the packet is forwarded to the next blade of the plurality of blades on the packet-passing ring.