Applications processing in a network apparatus

• US 9,244,739 B2
• Filed: 12/29/2010
• Issued: 01/26/2016
• Est. Priority Date: 09/25/2000
• Status: Expired due to Fees

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Inventors: Korsunsky, Yevgeny, Akerman, Moisey
• Primary Examiner(s): Sison, June
• Assistant Examiner(s): COONEY, ADAM A
• Application Number:
  US12/980,768
• Publication Number:
  US 20110238839A1
• Time in Patent Office: 1,854 Days
• Field of Search: 709/226
• US Class Current: 1/1
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: G06F 9/5033 considering data affinity
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and system for distributing flows between a multiple processors. The flows can be received from an external source such as a network, by a front-end processor that recognizes the flow and the associated request, and identifies at least one internal applications processor to process the request/flow. The front-end processor utilizes a flow scheduling vector related to the identified applications processor(s), and the flow scheduling vector can be based on intrinsic data from the applications processor(s) that can include CPU utilization, memory utilization, packet loss, and queue length or buffer occupation. In some embodiments, applications processors can be understood to belong to a group, wherein applications processors within a group can be configured identically. A flow schedule vector can be computed for the different applications processor groups.

Claims

1. A system for applications processing in a network apparatus comprising:

a flow processing facility that is configured to process network data received from a subscriber according to an application, the flow processing facility including;

at least one memory defining an application suite by storing a plurality of applications for processing network data, the plurality of applications including at least two of;

a virus detection application, an intrusion detection application, a firewall application, a content filtering application, a privacy protection application, and a policy-based browsing application,

a plurality of flow processor modules, each having at least one processor,

at least one network processor module having at least one processor,

at least one control processor module having at least one processor, and

a plurality of network ports for connecting network devices for communicating network data, wherein

the at least one memory further stores instructions to cause the at least one processor of the at least one network processor module to;

i) recognize one or more data packets in the network data that require processing, the one or more data packets including subscriber information,

ii) select an application of the plurality of applications stored in the at least one memory for processing the one or more data packets based on contents of the one or more data packets,

iii) identify at least one flow processor module of the plurality of flow processor modules based on the selected application, and

iv) direct the one or more data packets to the identified at least one flow processor module for executing the selected application,

the at least one memory further stores instructions to cause the at least one processor of the identified at least one flow processor module to;

i) receive the one or more data packets from the at least one network processor module,

ii) execute the selected application so as to process the one or more data packets, resulting in processed data, and

iii) return the processed data to the at least one network processor module, and

the at least one memory further stores instructions to cause the at least one processor of the at least one control processor module to manage the plurality of applications stored in the at least one memory.

2. The system of claim 1, wherein the at least one memory further stores instructions to cause the at least one processor of the at least one control processor module to perform a step from a group consisting of, downloading an application to the at least one memory, and deleting an application from the at least one memory.

3. The system of claim 1, further comprising a management server module in communication with the at least one control processor module and having at least one processor.

4. The system of claim 3, wherein the at least one memory further stores instructions to cause the at least one processor of the management server module to instruct the at least one control processor module to perform a step from a group consisting of, downloading an application from the management server module to the at least one memory, and deleting an application from the at least one memory.

5. The system of claim 1, further comprising a local memory device coupled to the at least one control processor module.

6. The system of claim 1, further comprising a remote memory device coupled to the at least one control processor module.

7. The system of claim 1, wherein the at least one memory further stores instructions to cause the at least one processor of the at least one control processor module processor to transfer data between a management server module and the at least one flow processor module.

12. The system of claim 1, wherein the at least one memory further stores instructions to cause the at least one processor of the at least one network processor module to retrieve a subscriber profile based on the subscriber information, the subscriber profile being stored in the at least one memory.

13. The system of claim 1, wherein the at least one memory further stores instructions to cause the at least one processor of the at least one network processor module to transmit the processed data to the subscriber.

8. A method for applications processing in a network apparatus, comprising:

providing a flow processing facility that is configured to process network data received from a subscriber according to an application, the flow processing facility including;

at least one memory defining an application suite by storing a plurality of applications for processing network data, the plurality of applications including at least two of;

a virus detection application, an intrusion detection application, a firewall application, a content filtering application, a privacy protection application, and a policy-based browsing application,

a plurality of flow processor modules, each having at least one processor,

at least one network processor module having at least one processor, and

a plurality of network ports for connecting network devices for communicating network data;

receiving network data from a subscriber at the at least one network processor module;

recognizing, by the at least one processor of the at least one network processor module, one or more data packets in the network data that require processing, the one or more data packets including subscriber information;

selecting, by the at least one processor of the at least one network processor module, an application of the plurality of applications stored in the at least one memory for processing the one or more data packets based on contents of the one or more data packets;

identifying, by the at least one processor of the at least one network processor module, at least one flow processor module of the plurality of flow processor modules based on the selected application;

directing, by the at least one processor of the at least one network processor module, the one 1 or more data packets to the identified at least one flow processor module for executing the selected application;

receiving, by the at least one processor of the identified at least one flow processor module, the one or more data packets from the at least one network processor module;

executing, by the at least one processor of the identified at least one flow processor module, the selected application so as to process the one or more data packets, resulting in processed data; and

returning, by the at least one processor of the identified at least one flow processor module, the processed data to the at least one network processor module.

9. The method of claim 8, further including managing the plurality of applications stored in the at least one memory with a control processor module that is in communication with the at least one network processor module and the plurality of flow processor modules.

10. The method of claim 8, further comprising configuring the plurality of flow processor modules according to the selected application.

11. The method of claim 8, further comprising retrieving, by the at least one processor of the at least one network processor module, a subscriber profile based on the subscriber information, the subscriber profile being stored in the at least one memory.

14. The method of claim 8, further comprising transmitting, by the at least one processor of the at least one network processor module, the processed data to the subscriber.