Classifying packets

• US 9,172,629 B1
• Filed: 12/29/2005
• Issued: 10/27/2015
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Sundaram, Mohan, McRae, Andrew
• Primary Examiner(s): Banks Harold, Marsha D
• Assistant Examiner(s): WYLLIE, CHRISTOPHER T
• Application Number:
  US11/323,317
• Time in Patent Office: 3,589 Days
• Field of Search: 370/229, 370/230, 370/230.1, 370/231, 370/351, 370/389, 370/392, 709/232, 709/224, 726/23, 726/24
• US Class Current: 1/1
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00

Abstract

Classifying packets is disclosed. In some embodiments, a packet can be classified once for a plurality of nodes. The classification of a packet can be used at a receiving node to determine the receiving node policy for the packet. In some embodiments, the classification of a packet is specified by a classification index associated with the packet. In some embodiments, the receiving node policy for the packet can be determined by performing a lookup in a data structure associated with the receiving node based at least in part on the classification index of the packet. In some embodiments, the classification of the packet is sufficient to specify not only the receiving node policy but also a plurality of policies of a plurality of nodes.

Claims

1. A method for processing a packet, comprising:

determining if the packet is classified according to an attribute of a classification index, the classification index being a part of a set of one or more classification indices and said attribute includes a classification index valid bit; and

using, when the packet has been classified, the classification data of the packet to determine a node-specific policy of the receiving node applicable to the packet, wherein a plurality of node-specific policies associated with a plurality of nodes is specified using the classification data, the plurality of nodes including the receiving node, wherein at least two of the plurality of node-specific policies are different, and wherein the at least two node-specific policies are associated with respective at least two different nodes of the plurality of nodes.

2. The method as recited in claim 1, wherein the plurality of nodes comprises nodes in a unified services gateway.

3. The method as recited in claim 1, wherein the determining whether the packet is classified according to an attribute of a classification index comprises determining whether the classification index valid bit of the packet is set.

4. The method as recited in claim 1, wherein the classification data of the packet uniquely identifies a set of one or more rules in a network security policy that the packet satisfies.

5. The method as recited in claim 4, wherein each rule in the set of one or more rules is based at least in part on one or more of a source address, a destination address, a source port, a destination port, a source interface, a destination interface, a protocol, a list of source addresses, a list of destination addresses, a list of source ports, a list of destination ports, a list of source interfaces, a list of destination interfaces, a list of protocols, and one or more other rules.

6. The method as recited in claim 1, wherein the classification data of the packet comprises a classification index written into one or more of a header of the packet and a context of the packet, wherein as the packet travels between nodes of the plurality of nodes a single pass classification of the packet is enabled using the classification data of the packet.

7. The method as recited in claim 1, wherein the classification data of the packet comprises a classification index, wherein the node-specific policy of the receiving node is stored in a data structure associated with the receiving node, and the data structure is indexed by the set of classification indices in one dimension.

8. The method as recited in claim 7, wherein the data structure is indexed by a set of receiving node instance identifiers in a second dimension.

9. The method as recited in claim 1, wherein the classification data of the packet comprises a classification index and wherein the using the classification data of the packet to determine the node-specific policy of the receiving node comprises using the classification index to look up the node-specific policy of the receiving node in a data structure associated with the receiving node.

10. The method as recited in claim 1, further comprising processing the packet based at least in part on the node-specific policy of the receiving node.

11. The method as recited in claim 1, further comprising:

modifying one or more of a packet header of the packet and a context of the packet; and

invalidating the classification data of the packet.

12. A method as recited in claim 11, wherein the invalidating the classification data of the packet comprises clearing a classification index valid bit of the packet.

13. The method as recited in claim 1, wherein the classification data of the packet comprises a classification index, wherein the classification data of the packet uniquely identifies a set of one or more rules in a network security policy that the packet satisfies, and the classification index and the corresponding set of one or more rules are included as an entry in a global classification table.

14. The method as recited in claim 13, wherein the global classification table comprises a truth table.

15. The method as recited in claim 13, wherein the global classification table is a part of a set of one or more global classification tables.

16. The method as recited in claim 1, wherein the packet is part of a flow and wherein the node-specific policy of the receiving node is determined for the flow.

17. The method as recited in claim 1, wherein the plurality of nodes includes one or more of an IPSEC decryption node, an Access Control List (ACL) node, a filter node, a Denial-of Service (DoS) attack checking node, a content filter node, an intrusion detection node, an intrusion prevention node, an Anti-Virus (AV) node, a Network Address Translation (NAT) node, a Protocol Anomaly Detection (PAD) node, a signature matching node, a state machine node, and a Quality of Service (QoS) node.

18. A system for processing a packet, comprising:

a processor configured;

to determine whether the packet is classified, wherein the classified packet comprises a classification index valid bit for indicating whether the packet has been classified and classification data; and

to use the classification data of the packet to determine a node-specific policy of the receiving node; and

a memory coupled with the processor, the memory configured to provide the processor with instructions,

wherein a plurality of node-specific policies associated with a plurality of nodes is specified using the classification data, the plurality of nodes including the receiving node, wherein at least two of the plurality of node-specific policies are different, and wherein the at least two node-specific policies are associated with respective at least two different nodes of the plurality of nodes.

19. The system as recited in claim 18, wherein the classification data of the packet uniquely identifies a set of one or more rules in a network security policy that the packet satisfies.

20. A non-transitory computer readable storage medium storing computer instructions, that, when executed by a computer, cause the computer to perform a method for processing a packet, the method comprising:

determining whether the packet has been classified, wherein the classified packet comprises a classification index valid bit and classification data, wherein the classification index valid bit being set indicates that the packet is classified; and

using the classification data of the packet to determine a node-specific policy of the receiving node, wherein a plurality of node-specific policies associated with a plurality of nodes including the receiving node is specified using the classification data, wherein at least two of the plurality of node-specific policies are different, and wherein the at least two node-specific policies are associated with respective at least two different nodes of the plurality of nodes.