Computerized system and method for handling network traffic

• US 20070168547A1
• Filed: 01/13/2006
• Published: 07/19/2007
• Est. Priority Date: 01/13/2006
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Krywaniuk, Andrew
• Granted Patent: US 8,234,361 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A computerized system and method for processing network content associated with multiple virtual domains. The processing may include anti-malware scanning and/or content filtering. The content associated with multiple domains may be processed in the same daemon process. In response to connection requests from virtual domains, the service process creates separate sockets to communicate with each virtual domain. A global configuration management module is used to provide configuration parameters for each session to the service process. A logging manager processes both the global logs and the logs from each virtual domain. Alternatively, the service process may initiate other service processes to handle incoming connections from one or more virtual domains, in order to better utilize resources in a multiple-CPU environment. Different service processes may be used to handle various aspects of content processes, for example one process may handle anti-malware scanning, while another process may handle content filtering.

Claims

1. A computer-implemented method for handling network traffic associated with a plurality of virtual domains, the method comprising:

a. defining a plurality of interfaces, each of the interfaces corresponding to a virtual domain of the plurality of virtual domains;

b. initiating a service process for handling network traffic based on a predetermined policy;

c. in response to a connection request involving a network entity associated with a virtual domain, opening a communication channel between the service process and a kernel;

d. using the opened communication channel to transfer at least a portion of network traffic associated with the virtual domain between service process and the kernel; and

e. handling the transferred network traffic in the service process based on the policy.

2. The computer-implemented method of claim 1, further comprising:

in response to a second connection request involving a second network entity associated with a second virtual domain, opening a second communication channel between the service process and a second interface corresponding to the second virtual domain;

using the second opened communication channel to transfer second network traffic between service process and the kernel; and

handling the transferred second network traffic in the service process based on the policy.

3. The computer-implemented method of claim 1, wherein first communication channel is a socket.

4. The computer-implemented method of claim 1, wherein the plurality of interfaces comprise at least one physical interface and at least one logical interface.

5. The computer-implemented method of claim 1, wherein the policy comprises at least one from a group consisting of anti-malware scanning, content filtering, Virtual Private Network (VPN) processing, network monitoring and network logging.

6. The computer-implemented method of claim 1, wherein the handling comprises assembling content of packets in the transferred network traffic.

7. The computer-implemented method of claim 1, wherein the network traffic is transferred in accordance with a message exchange protocol.

8. The computer-implemented method of claim 1, wherein the handling comprises retrieving configurations settings corresponding to the virtual domain.

9. The computer-implemented method of claim 8, wherein the configuration settings are retrieved by a configuration server using at least one attribute of the opened communication channel to lookup the configuration settings from a configuration database.

10. The computer-implemented method of claim 9, wherein the communication channel comprises a socket and wherein the attribute comprises a socket identifier.

11. The computer-implemented method of claim 1, further comprising using the service process to process data associated with other virtual domains of the plurality of virtual domains.

12. The computer-implemented method of claim 1, further comprising initiating a second service process in response to a second connection request involving a second network entity in a second virtual domain, wherein the second service process handles second network traffic associated with the second virtual domain.

13. The computer-implemented method of claim 12, wherein the service process is executed on a first CPU and the second service process is executed on a second CPU.

14. The computer-implemented method of claim 12, wherein the second service process is initiated by the service process.

15. The computer-implemented method of claim 12, further comprising sending at least one message from the service process to the second service process.

16. The computer-implemented method of claim 15, wherein the at least one message comprises information on a third connection request received.

17. The computer-implemented method of claim 1, further comprising providing a central configuration store for providing configuration information to the service process.

18. The computer-implemented method of claim 1, wherein the handling comprises logging at least a portion of the network content to a log store using a logging manager.

19. The computer-implemented method of claim 18, wherein the network content is logged using a plurality of log files, and wherein the log manager opens and closes log file descriptors associated with the plurality of log files, such that least recently used log file descriptor is closed first.

20. The computer-implemented method of claim 1, further comprising storing virtual domain state information in the service process.

21. The computer-implemented method of claim 1, further comprising storing virtual domain state information for the plurality of virtual domains in a virtual domain state data structure.

22. The computer-implemented method of claim 21, further comprising associating a variable with the service process, the variable pointing to an instance of the virtual domain state data structure, the instance comprising information on state of the virtual domain.

23. The computer-implemented method of claim 1, further comprising providing a separate policy for each virtual domain.

24. The computer-implemented method of claim 1, at least one of the plurality of virtual domains is associated with an out-of-band network traffic.

25. A computerized system for handling network traffic associated with a plurality of virtual domains, the system comprising:

a. a plurality of interfaces, each of the interfaces corresponding to a virtual domain of the plurality of virtual domains; and

b. a CPU executing a kernel and a service process for handling network traffic based on a predetermined policy;

wherein, in response to a connection request involving a network entity associated with a virtual domain, the CPU;

i. opens a communication channel between the service process and the kernel;

ii. uses the opened communication channel to transfer network traffic associated with the virtual domain between service process and the kernel; and

iii. handles the transferred network traffic in the service process based on the policy.

26. A computerized system for handling network traffic associated with a plurality of virtual domains, the system comprising:

a. a plurality of interfaces, each of the interfaces corresponding to a virtual domain of the plurality of virtual domains;

b. a processing unit executing a kernel and a service process for handling network traffic based on a predetermined policy;

c. a configuration server for providing configuration information to the service process in response to a configuration request from the service process; and

d. a log server for logging information in response to a logging request from the service process;

27. The computerized system of claim 26, further comprising configuration database operatively coupled to the configuration server for storing configuration information associated with at least one of the plurality of virtual domains.

28. The computerized system of claim 26, further comprising log store for storing log files.

29. The computerized system of claim 26, wherein each of the plurality of virtual domains comprises a plurality of separately routed network entities.

30. The computerized system of claim 26, wherein each of the plurality of virtual domains comprises a plurality of separately managed network entities.

31. The computerized system of claim 26, wherein the handling of network traffic comprises at least one from a group consisting of anti-malware scanning, content filtering, Virtual Private Network (VPN) processing, network monitoring and network logging.

32. The computerized system of claim 26, further comprising a communication channel between the service process and the kernel for transferring at least a portion of the network traffic associated with one of the plurality of virtual domains.

33. The computerized system of claim 32, further comprising a second communication channel between the service process and the kernel for transferring at least a portion of the network traffic associated with second virtual domain of the plurality of virtual domains.

34. The computerized system of claim 26, wherein the processing unit executes a second service process for handling network traffic based on the predetermined policy.

35. The computerized system of claim 26, wherein the handling comprises assembling content of packets in the transferred network traffic.

36. The computerized system of claim 26, further comprising second processing unit for executing second service process for handling network traffic based on the predetermined policy.

37. The computerized system of claim 26, wherein the log server maintains a table of open log file descriptors and wherein the log server is operable to close at least one of the open log file descriptors, such that least recently used log file descriptor is closed first.

38. The computerized system of claim 26, further comprising a virtual domain state data structure operable to store virtual domain state information for the plurality of virtual domains.

39. The computer-implemented method of claim 38, wherein the service process is associated with a variable, the variable pointing to an instance of the virtual domain state data structure, the instance comprising information on state of the virtual domain.

40. The computerized system of claim 26, wherein at least one of the plurality of virtual domains is associated with an out-of-band network traffic and wherein the service process handles network traffic associated with the at least one of the plurality of virtual domains based on a separate policy.

41. A computer-readable medium embodying one or more sequences of instructions, which when executed by one or more processors, causes the one or more processors to perform a method comprising:

a. defining a plurality of interfaces, each of the interfaces corresponding to a virtual domain of the plurality of virtual domains;

b. initiating a service process for handling network traffic based on a predetermined policy;

c. in response to a connection request involving a network entity associated with a virtual domain, opening a communication channel between the service process and a kernel;

d. using the opened communication channel to transfer network traffic associated with the virtual domain between service process and the kernel; and

e. handling the transferred network content in the service process based on the policy.