Content service aggregation system

• US 8,370,528 B2
• Filed: 07/26/2010
• Issued: 02/05/2013
• Est. Priority Date: 07/06/2001
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Bryers, Mark, Ganesan, Elango, Gruner, Frederick, Hass, David, Hathaway, Robert, Panwar, Ramesh, Ramirez, Ricardo, Rashid, Abbas, Vilas, Mark, Lee, Yen, Phillips, John, Zhou, Yuhong Andy, Spurrier, Gregory G., Ramanoorthi, Sankar, Freed, Michael
• Primary Examiner(s): Dalencourt, Yves
• Application Number:
  US12/843,710
• Publication Number:
  US 20110019550A1
• Time in Patent Office: 925 Days
• Field of Search: 709/235, 709/249, 709/218, 709/220, 709/221, 709/222, 709/245, 370/235
• US Class Current: 709/249
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network content service apparatus includes a set of compute elements adapted to perform a set of network services; and a switching fabric coupling compute elements in said set of compute elements. The set of network services includes firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking. Code operable on the compute elements enables the network services, and the compute elements are provided on blades which further include at least one input/output port.

Claims

1. A network device comprising:

a plurality of blades, each blade comprising a physical card having a plurality of compute elements interconnected by a hardware switching fabric to communicate packet data between the compute elements, wherein the set of compute elements of each of the blades performs a set of network services on the packet data, and wherein the set of compute elements in each of the blades is arranged in a processing pipeline to provide the set of network services;

a flow control element to receive a plurality of packet flows from a network and distribute each of the plurality of packet flows to a corresponding one of the processing pipelines provided by the blades,

wherein the flow control element distributes packets of the same packet flow to the same processing pipeline of the blades,

wherein the flow control element identifies each of the packet flows as being associated with a subscriber and determines a subset of the network services that are required to be applied to packet flows associated with the identified subscriber, and

wherein, for each of the packet flows, the flow control element selects one of the processing pipelines based on the subset of network services identified for the subscriber.

2. The network device of claim 1, further comprising a forwarding table stored within the network device that defines the processing pipelines as a plurality of different routes through the compute elements of the network device, the routes defining different sets of one or more of the network services and specifying an order for applying the network services.

3. The network device of claim 2, wherein, in response to receiving a data packet of one of the packet flows, the flow control element selects one of the routes based on the subset of network services identified as associated with the subscriber and attaches a route tag to the packet to identify the selected route.

4. The network device of claim 3, wherein the route tag causes the data packet to be forwarded within the network device to a first one of the compute elements in the selected processing pipeline and causes output from one of the compute elements in the processing pipeline to be forwarded to a next compute element in the processing pipeline along the selected route through the compute elements for performing the subset of the services associated with the identified subscriber.

5. The network device of claim 1, wherein the set of network services performed by the compute elements includes one or more of firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking.

6. The network device of claim 1, wherein each of said compute elements is optimized to perform one of said set of services.

7. The network device of claim 1, wherein each of said compute elements performs all said services in said set.

8. The network device of claim 1, wherein the compute elements perform the network services on packet data associated with subscribers of a data center.

9. The network device of claim 1, further comprising one or more flow tables, wherein the flow control element distributes directly to the processing pipelines packet data for those packet flows having existing entries within the one or more flow tables, and wherein, for new packet flows, the flow control element applies policies for the subscribers to set up the processing pipelines to apply the network services to the packet data for the subscribers.