Content service aggregation system

• US 9,083,628 B2
• Filed: 02/04/2013
• Issued: 07/14/2015
• Est. Priority Date: 07/06/2001
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Bryers, Mark, Ganesan, Elango, Gruner, Frederick, Hass, David, Hathaway, Robert, Panwar, Ramesh, Ramirez, Ricardo, Rashid, Abbas, Vilas, Mark, Zaidi, Nazar, Lee, Yen, Nguyen, Chau Anh Ngoc, Phillips, John, Zhou, Yuhong, Spurrier, Gregory G., Ramanoorthi, Sankar, Freed, Michael
• Primary Examiner(s): Dalencourt, Yves
• Application Number:
  US13/758,878
• Publication Number:
  US 20130155861A1
• Time in Patent Office: 890 Days
• Field of Search: 709/218, 709/220, 709/221, 709/222, 709/235, 709/245, 709/249, 370/235
• US Class Current: 1/1
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network content service apparatus includes a set of compute elements adapted to perform a set of network services; and a switching fabric coupling compute elements in said set of compute elements. The set of network services includes firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking. Code operable on the compute elements enables the network services, and the compute elements are provided on blades which further include at least one input/output port.

Claims

1. A method comprising:

receiving, with a flow control element of a data center, a plurality of packet flows from a network, wherein the data center includes a plurality of compute elements interconnected by a hardware switching fabric to communicate packet data between the compute elements, and wherein the set of compute elements is arranged in a plurality of processing pipelines to provide a set of network services;

identifying, with the flow control element, each of the packet flows as being associated with a subscriber and determining a subset of one or more of the network services that are required to be applied to each of the packet flows based on the identified subscriber;

selecting, with the flow control element and for each of the packet flows, one of the processing pipelines based on the subset of network services for the subscriber associated with the packet flow; and

distributing, with the flow control element, each of the plurality of packet flows to the compute elements in accordance with the processing pipeline selected for the packet flow to provide the subset of network services determined for the subscriber associated with the packet flow.

2. The method of claim 1, further comprising storing a forwarding table within the flow control element that defines the processing pipelines as a plurality of different routes through the compute elements, the routes defining different sets of one or more of the network services and specifying an order for applying the network services.

3. The method of claim 2, further comprising:

in response to receiving a packet of one of the packet flows, selecting, with the flow control element, one of the routes based on the subset of network services determined as associated with the subscriber identified for the packet flow; and

attaching a route tag to the packet to identify the selected route.

4. The method of claim 3,

forwarding the packet to a first one of the compute elements in the selected processing pipeline based on the route tag;

and

forwarding, in accordance with the route tag, output from the first one of the compute elements in the selected processing pipeline to a next compute element in the selected processing pipeline along the selected route through the compute elements for performing the subset of the services associated with the identified subscriber.

5. The method of claim 1, wherein the set of network services performed by the compute elements includes one or more of firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking.

6. The method of claim 1, wherein each of said compute elements is optimized to perform one of said set of services.

7. The method of claim 1, wherein each of said compute elements performs all said services in said set.

8. The method of claim 1, further comprising:

storing one or more flow tables that defines the processing pipelines as a plurality of different routes through the compute elements, the routes defining different sets of one or more of the network services and specifying an order for applying the network services;

distributing, the flow control element, to the processing pipelines packet data for those packet flows having existing entries within the one or more flow tables, and

for new packet flows, applying policies associated with the subscribers to set up the processing pipelines to apply the network services to the packet data for the subscribers.

9. The method of claim 1, wherein distributing comprises distributing, the flow control element, packets of the same packet flow to the same processing pipeline of the compute elements.

10. The method of claim 1, wherein the compute elements comprise computing blades, general-purpose computers or servers.

11. A non-transitory computer-readable storage medium comprising instructions to cause one or more programmable processors of a flow control element of a data center to:

receive, with the flow control element of the data center, a plurality of packet flows from a network, wherein the data center includes a plurality of compute elements interconnected by a hardware switching fabric to communicate packet data between the compute elements, and wherein the set of compute elements is arranged in a plurality of processing pipelines to provide the set of network services;

identify, with the flow control element, each of the packet flows as being associated with a subscriber and determining a subset of one or more of the network services that are required to be applied to each of the packet flows based on the identified subscriber;

select, with the flow control element, one of the processing pipelines for each of the packet flows based on the subset of network services identified for the subscriber; and

distribute, with the flow control element, each of the plurality of packet flows to the compute elements in accordance with the processing pipeline selected for the packet flow to provide the subset of network services determined for the subscriber identified for the packet flow.

12. The non-transitory computer-readable storage medium of claim 11, further comprising instructions that cause the one or more processors to store a forwarding table within the flow control element that defines the processing pipelines as a plurality of different routes through the compute elements, the routes defining different sets of one or more of the network services and specifying an order for applying the network services.

13. The non-transitory computer-readable storage medium of claim 12, further comprising instructions that cause the one or more processors to:

in response to receiving a packet of one of the packet flows, select, with the flow control element, one of the routes based on the subset of network services determined as associated with the subscriber identified for the packet flow; and

attach a route tag to the packet to identify the selected route.

14. The non-transitory computer-readable storage medium of claim 13, further comprising instructions that cause the one or more processors to:

forward the packet to a first one of the compute elements in the selected processing pipeline based on the route tag; and

forward, in accordance with the route tag, output of the first one of the compute elements in the processing pipeline to a next compute element in the processing pipeline along the selected route through the compute elements for performing the subset of the services associated with the identified subscriber.

15. The non-transitory computer-readable storage medium of claim 11, wherein the set of network services performed by the compute elements includes one or more of firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking.

16. The non-transitory computer-readable storage medium of claim 11, wherein each of said compute elements is optimized to perform one of said set of services.

17. The non-transitory computer-readable storage medium of claim 11, wherein each of said compute elements performs all said services in said set.

18. The non-transitory computer-readable storage medium of claim 11, further comprising instructions that cause the one or more processors to:

store one or more flow tables that defines the processing pipelines as a plurality of different routes through the compute elements, the routes defining different sets of one or more of the network services and specifying an order for applying the network services;

distribute, the flow control element, to the processing pipelines packet data for those packet flows having existing entries within the one or more flow tables, and

for new packet flows, apply policies associated with the subscribers to set up the processing pipelines to apply the network services to the packet data for the subscribers.

19. The non-transitory computer-readable storage medium of claim 11, further comprising instructions that cause the one or more processors to distributing, the flow control element, packets of the same packet flow to the same processing pipeline of the compute elements.