Systems and methods for packet sequencing

• US 20020032798A1
• Filed: 08/16/2001
• Published: 03/14/2002
• Est. Priority Date: 09/08/2000
• Status: Abandoned Application

• Current Assignee: Spontaneous Networks Incorporated
• Original Assignee: Spontaneous Networks Incorporated
• Inventors: Xu, Wei
• Application Number:
  US09/930,471
• Publication Number:
  US 20020032798A1
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Embodiments of the present invention relate to methods and systems of managing delivery of a network service. In an embodiment, a data packet including a service address and a payload is received. A plurality of network applications associated with the service address of the data packet are identified. The plurality of network applications associated with the service address include a first network application and a second network application, where the first network application is different than the network application. At least the payload of the data packet is sent to the first network application, and a first network application response packet is received from the first network application. A second network application packet is sent to the second network application, and the second network application packet is based at least in part on the first network application response packet.

Claims

1. A method of managing delivery of a network service, the method comprising:

receiving a data packet, the data packet including a service address and a payload;

identifying a plurality of network applications associated with the service address of the data packet, the plurality of network applications associated with the service address including a first network application and a second network application, the first network application being different than the second network application;

sending at least the payload of the data packet to the first network application;

receiving a first network application response packet from the first network application; and

sending a second network application packet to the second network application, the second network application packet based at least in part on the first network application response packet.

2. The method of claim 1, further comprising:

receiving a second network application response packet from the second network application; and

sending a service response packet to a source address of the data packet, the service response packet based at least in part on the second network application response packet.

3. The method of claim 2, wherein sending a service response packet to a source address of the data packet includes generating the service response packet as a data product.

4. The method of claim 1, wherein:

the first network application has a first network application address; and

sending at least the payload of the data packet to the first network application includes identifying the first network application address based at least in part on the service address.

5. The method of claim 4, wherein:

the first network application response packet includes a first network application response source address;

the second network application has a second network application address; and

sending a second network application packet to the second network application includes identifying the second network application address based at least in part on the first network application response source address.

6. The method of claim 5, wherein the first network application address is different from the first network application response source address.

7. The method of claim 5, wherein the first network application address is the same as the first network application response source address.

8. The method of claim 4, wherein:

the data packet includes a service port identifier; and

sending at least the payload of the data packet to the first network application includes identifying the first network application address based at least in part on the service port identifier.

9. The method of claim 4, wherein:

the data packet is received on a first network interface; and

sending at least the payload of the data packet to the first network application includes identifying the first network application address based at least in part on the data packet being received on the first network interface.

10. The method of claim 1, wherein:

receiving a data packet includes receiving a data packet via a first network interface;

sending at least the payload of the data packet to the first network application includes sending at least the payload of the data packet to the first network application via a second network interface, the second network interface being different from the first network interface; and

receiving a first network application response packet from the first network application includes receiving the first network application response packet from a third network interface, the third network interface being different from the second network interface and the first network interface; and

sending a second network application packet to the second network application includes sending the second network application packet to the second network application via a fourth network interface, the fourth network interface being different from the third network interface, the second network interface, and the first network interface.

11. The method of claim 10, further comprising:

receiving a second network application response packet from the second network application via the fourth network interface;

sending a first network application return packet to the first network application via the third network interface, the first network application return packet based at least in part on the second network application response packet;

receiving a first network application return response packet from the first network application via the second network interface; and

sending a service response packet via the first network interface, the service response packet based at least in part on the first network application return response packet.

12. The method of claim 1, wherein:

receiving a data packet includes receiving a data packet via a first network interface;

the first network application having a first network application address; and

sending at least the payload of the data packet to the first network application includes

identifying the first network application address based at least in part on the service address of the data packet and the first network interface, and

sending at least the payload of the data packet to the first network application via a second network interface, the second network interface being different than the first network interface.

13. The method of claim 12, wherein

the data packet includes a service port identifier;

identifying the first network application address is based at least in part on the service port identifier.

14. The method of claim 1, wherein:

sending at least the payload of the data packet to the first network application is based at least in part on a stateless identification of the first network application; and

sending a second network application packet to the second network application is based at least in part on a stateless identification of the second network application.

15. The method of claim 1, wherein:

sending at least the payload of the data packet to the first network application is based at least in part on a stateful identification of the first network application; and

sending a second network application packet to the second network application is based at least in part on a stateful identification of the second network application.

16. The method of claim 1, wherein the first network application is a first version of a network application and the second network application is a second version of the network application.

17. The method of claim 16, wherein the first version of the network application is from a first vendor, the second version of the network application is from a second vendor, and the first vendor is different from the second vendor.

18. The method of claim 16, wherein the network application is selected from the group consisting of an intrusion detection application, a virus detection application, a virtual private network application, a firewall application, a web switch, a network security application, a load balancing application, a proxy application, and a database application.

19. The method of claim 1, wherein:

the first network application is selected from the group consisting of an intrusion detection application, a virus detection application, a virtual private network application, a firewall application, a web switch, a network security application, a load balancing application, a proxy application, and a database application; and

the second network is a different network application selected from the group consisting of an intrusion detection application, a virus detection application, a virtual private network application, a firewall application, a web switch, a network security application, a load balancing application, a proxy application, and a database application.

20. A method of processing units of data, the method comprising:

receiving a first data unit at a first network interface, the first data unit including a service address;

identifying a plurality of application systems based at least in part on the service address, the plurality of application systems including a first application system and a second application system;

sending a second data unit to the first application system via a second network interface, the second data unit based at least in part on the first data unit, the second network interface being different from the first network interface;

receiving a third data unit from the first application system via a third network interface, the third network interface being different from the second network interface and the first network interface; and

sending a fourth data unit to the second application system via a fourth network interface, the fourth data unit based at least in part on the third data unit.

21. The method of claim 20, wherein:

the first application system has a first application system address;

sending a second data unit to the first application system via a second network interface includes identifying the first application system address based at least in part on the service address and the first network interface;

receiving a third data unit from the first application system via a third network interface includes receiving a third data unit having a first application system source address;

the second application system has a second application system address; and

sending a fourth data unit to the second application system via a fourth network interface includes identifying the second application system address based at least in part on the first application system source address and the third network interface.

22. The method of claim 21, wherein:

the data packet includes a data packet service port identifier;

identifying the first application system address is further based at least in part on the service port identifier of the data packet;

receiving a third data unit from the first application system via a third network interface includes receiving a third data unit having a third data unit port identifier; and

identifying the second application system address is further based at least in part on the third data unit port identifier.

23. The method of claim 20, further comprising:

receiving a fifth data unit from the second application system via the fourth network interface;

sending a six data unit to the first application system via the third network interface, the six data unit based at least in part on the fifth data unit;

receiving a seventh data unit from the first application system via the second network interface; and

sending an eighth data unit to a source address of the data packet via the first network interface, the eighth data unit based at least in part on the seventh data unit.

24. The method of claim 23, wherein

the first application system has a first application system address;

sending a second data unit to the first application system via a second network interface includes identifying the first application system address based at least in part on the service address and the first network interface;

receiving a third data unit from the first application system via a third network interface includes receiving a third data unit having a first application system source address;

the second application system has a second application system address;

sending a fourth data unit to the second application system via a fourth network interface includes identifying the second application system address based at least in part on the first application system source address and the third network interface;

receiving a fifth data unit from the second application system via the fourth network interface includes receiving a fifth data unit having a second application system source address; and

sending a sixth data unit to the first application system via the third network interface includes identifying the first application system based at least in part on the second application system source address and the third network interface.

25. The method of claim 24, wherein:

the data packet includes a data packet service port identifier;

identifying the first application system address is further based at least in part on the service port identifier of the data packet;

receiving a third data unit from the first application system via a third network interface includes receiving a third data unit having a third data unit port identifier;

identifying the second application system address is further based at least in part on the third data unit port identifier;

receiving a fifth data unit from the second application system via the fourth network interface includes receiving a fifth data unit having a fifth data unit port identifier; and

sending a sixth data unit to the first application system via the third network interface includes identifying the first application system based at least in part on the fifth data unit port identifier.

26. The method of claim 21, wherein identifying the first application system is based at least in part on a stateless identification of the first application system.

27. The method of claim 21, wherein identifying the first application system is based at least in part on a stateful identification of the first application system.

28. The method of claim 23, further comprising:

sending the data packet to the first network interface; and

receiving the eighth data unit via the first network interface.

29. The method of claim 23, wherein sending a sixth data unit to the first application system via the third network interface includes generating the sixth data unit as a data product.

30. A method to manage delivery of a network service, the method comprising:

receiving a data packet having a service address and a service port identifier;

identifying a plurality of network applications based at least in part on the service address, the plurality of network applications including at least a first network application and a second network application;

sequentially processing the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier; and

sending a data packet service response based at least in part on the data packet sequential processing.

31. The method of claim 30, wherein sequentially processing the data packet through at least the first network application and the second network application consists essentially of statelessly sequentially processing the data packet through at least the first network application and the second network application.

32. The method of claim 30, wherein:

receiving a data packet having a service address and a service port identifier includes receiving the data packet via a first network interface;

sequentially processing the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier includes sequentially processing the data packet through at least the first network application and the second network application via one or more additional network interfaces, the one or more additional network interfaces being different from the first network interface; and

sending a data packet service response based at least in part on the data packet sequential processing includes sending the data packet service response via the first network interface.

33. The method of claim 30, wherein sending a data packet service response based at least in part on the data packet sequential processing includes generating the data packet service response as a data product based at least in part on the data packet sequential processing.

35. The system of claim 34, wherein one or more of the packet sequencing entries of the plurality of packet sequencing entries include:

a received interface field to store a received interface identifier; and

a send interface field to store a send interface identifier.

36. The system of claim 34, wherein:

the data packet includes a first service port identifier, and

one or more packet sequencing entries of the plurality of packet sequencing entries include a service port field to store a service port identifier.

37. The system of claim 34, wherein:

the data packet includes a first service port identifier; and

one or more packet sequencing entries of the plurality of packet sequencing entries include

a received interface field to store a received interface identifier,

a service port field to store a service port identifier,

a send interface field to store a send interface identifier, and

a send address field to store a send address.

38. The system of claim 37, wherein the send address is a network address of a network application system of the plurality of network application systems.

39. The system of claim 37, wherein the send address is a media access controller address of a network application system of the plurality of network application systems.

40. The system of claim 37, wherein each packet sequencing entry of the plurality of packet sequencing entries includes a destination system type field to store a destination system type identifier.

41. The system of claim 34, wherein the first network application system is a first implementation of one network application system and the second network application system is a second implementation of the one network application system.

42. The system of claim 34, further comprising a plurality of network application systems, one or more of the plurality of network application systems coupled to one or more of the second network interface, the third network interface, and the fourth network interface.

43. The system of claim 42, wherein the plurality of network application systems include one or more of an intrusion detection application system, a virus detection application system, a virtual private network application system, a firewall application system, a web switch system, a network security application system, a proxy application system, a database application system, and a load balancing application system.

44. The system of claim 34, wherein:

the first network application system is selected from the group consisting of an intrusion detection application system, a virus detection application system, a firewall system, a web switch system, a network security application system, and a load balancing application system; and

the second network application system is a different network application system selected from the group consisting of an intrusion detection application system, a virus detection application system, a virtual private network application system, a firewall application system, a web switch system, a network security application system, a proxy application system, a database application system, and a load balancing application system.

45. The system of claim 34, wherein the data packet uses one or more protocols from one of a TCP/IP network protocol suite and a UDP/IP network protocol suite.

46. The system of claim 45, wherein the one or more protocols include an IPv4 network protocol.

47. The system of claim 45, wherein the one or more protocols include an IPv6 network protocol.

48. The system of claim 34, wherein the data packet uses one or more of a layer 2 protocol, a layer 3 protocol, and a layer 4 protocol.

49. The system of claim 48, wherein the layer 2 protocol is selected from the group consisting of ATM and frame relay.

50. The system of claim 48, wherein the layer 3 protocol is MPLS.

51. The system of claim 34, wherein the packet sequential processing information lacks information that supports stateful processing.

52. The system of claim 34, wherein the packet sequential processing information includes information that supports stateful processing.

53. The system of claim 34, wherein the packet sequential processing information consists essentially of information that supports stateless processing.

34. A system to manage delivery of a network service, the system comprising:

a first network interface to receive a data packet, the data packet including a service address;

packet sequencing logic to store packet sequential processing information, the packet sequential processing information including a service address field to store a service address, the packet sequential processing information including a plurality of packet sequencing entries, one or more of the packet sequencing entries of the plurality of packet sequencing entries including

a source address field to store a source address, and

a destination address to store a destination address; and

a second network interface to transmit at least the payload of the data packet to a first network application system of a plurality of network application systems associated with the service address, the second network interface being different from the first network interface;

a third network interface to receive a first network application response packet, the third network interface being different from the second network interface and the first network interface; and

a fourth network interface to send a second network application packet to a second network application system of the plurality of network application systems associated with the service address, the second network application packet based at least in part on the first network application response packet, the second network application system being different from the first network application system, the fourth network interface being different from the third network interface, the second network interface, and the first network interface.

54. A system to manage delivery of a network service, the system comprising:

means for receiving a data packet having a service address and a service port identifier;

means for identifying a plurality of network applications based at least in part on the service address, the plurality of network applications including at least a first network application and a second network application;

means for sequentially processing the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier; and

means for sending a data packet service response based at least in part on the data packet sequential processing.

55. The system of claim 54, wherein the means for sequentially processing the data packet through at least the first network application and the second network application includes means for statelessly sequentially processing the data packet through at least the first network application and the second network application.

56. The system of claim 54, wherein:

the means for receiving a data packet having a service address and a service port identifier includes means for receiving the data packet via a first network interface;

the means for sequentially processing the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier includes means for sequentially processing the data packet through at least the first network application and the second network application via one or more additional network interfaces, the one or more additional network interfaces being different from the first network interface; and

the means for sending a data packet service response based at least in part on the data packet sequential processing includes means for sending the data packet service response via the first network interface.

58. The method of claim 57, wherein the step for sequentially processing the data packet through at least the first network application and the second network application includes a step for statelessly sequentially processing the data packet through at least the first network application and the second network application.

59. The method of claim 57, wherein:

the step for receiving a data packet having a service ad-dress and a service port identifier includes a step for receiving the data packet via a first network interface;

the step for sequentially processing the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier includes a step for sequentially processing the data packet through at least the first network application and the second network application via one or more additional network interfaces, the one or more additional network interfaces being different from the first network interface; and

the step for sending a data packet service response based at least in part on the data packet sequential processing includes a step for sending the data packet service response via the first network interface.

57. A method to manage delivery of a network service, the method comprising:

a step for receiving a data packet having a service address and a service port identifier;

a step for identifying a plurality of network applications based at least in part on the service address, the plurality of network applications including at least a first network application and a second network application;

a step for sequentially processing the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier; and

a step for sending a data packet service response based at least in part on the data packet sequential processing.

60. A computer-readable medium storing a plurality of instructions to be executed by a processor to manage delivery of a network service, the plurality of instructions comprising instructions to:

receive a data packet having a service address and a service port identifier;

identify a plurality of network applications based at least in part on the service address, the plurality of network applications including at least a first network application and a second network application;

sequentially process the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier; and

send a data packet service response based at least in part on the data packet sequential processing.

61. The computer-readable medium of claim 60, wherein the instructions to sequentially process the data packet through at least the first network application and the second network application include instructions to statelessly sequentially process the data packet through at least the first network application and the second network application.

62. The computer-readable medium of claim 60, wherein:

the instructions to receive a data packet having a service address and a service port identifier include instructions to receive the data packet via a first network interface;

the instructions to sequentially process the data packet through at least the first network application and the second network application based at least in part on the service address and the service port identifier include instructions to sequentially process the data packet through at least the first network application and the second network application via one or more additional network interfaces, the one or more additional network interfaces being different from the first network interface; and

the instructions to send a data packet service response based at least in part on the data packet sequential processing include instructions to send the data packet service response via the first network interface.