System, method and computer program product for monitoring and controlling network connections from a supervisory operating system

• US 20080256236A1
• Filed: 06/22/2007
• Published: 10/16/2008
• Est. Priority Date: 08/23/2002
• Status: Active Grant

• Current Assignee: Intellectual Ventures II LLC (Intellectual Ventures LLC)
• Original Assignee: Finite State Machine Labs Inc.
• Inventors: Yodaiken, Victor J.
• Granted Patent: US 8,805,994 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements
• CPC Class Codes: H04L 41/5019 Ensuring fulfilment of SLA
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

A system, method and computer program product that is designed to support high-availability, rapid fault recovery, out of band condition signaling and/or other quality of service assurances and security in a networked environment. In one aspect, a method of the invention includes the step of providing a processing system with a dual-kernel or multi-kernel software operating system. The operating system includes a supervisory operating system and a secondary operating system that provides network functions to user applications. The method also includes the step of providing a Network Control Software (NCS) in the supervisory operating system. The NCS is configured to transparently monitor and control network operations in the secondary operating system.

Claims

1. In a processing system comprising a network device for connecting the processing system to a communications medium, a supervisory operating system, and a secondary operating system, a method comprising:

receiving a packet that was received by the network device; and

invoking an event handler after receiving the packet, wherein the event handler is a task of the supervisory operating system and wherein the event handler performs a method comprising;

examining at least one field of the packet; and

determining whether or not to pass the packet to an application of the secondary operating system, wherein

the determination is based at least in part on the content of the at least one field.

2. The method of claim 1, wherein the determining step comprises determining whether the packet contains a predetermined message, and if the packet contains the predetermined message the event handler sends a second predetermined message to the application that originated the packet and does not pass the packet to the application of the secondary operating system.

5. The method of claim 1, wherein the determining step comprises determining whether the packet is a packet that is used to initiate a connection, and the method further comprises:

in response to a determination that the packet is a packet that is used to initiate a connection, determining whether a warning indicator is set; and

discarding the packet if the warning indicator is set, wherein the warning indicator indicates that (a) the processing system may be experiencing a denial of service attack and/or (b) the number of packets waiting in a queue is equal to or greater than a threshold value.

6. The method of claim 5, further comprising, in response to a determination that (a) the packet is a packet that is used to initiate a connection and (b) no relevant warning indicator is set, setting the warning indicator if the value of a counter is greater than or equal to a predetermined value.

7. The method of claim 6, further comprising determining whether the packet is an ACK packet and, in response to a determination that the packet is an ACK packet, decrementing the counter.

8. The method of claim 1, wherein the determining step comprises:

determining whether the packet is destined for a port that has been identified as being a critical port; and

if the packet is not destined for a port that been identified as being a critical port, determining whether a congestion warning indicator is set, wherein

the method further comprises passing the packet to the application of the secondary operating system if, and only if, the congestion warning flag is not set or the packet is destined for a port that has been identified as being a critical port.

9. The method of claim 1, wherein the determining step comprises:

determining whether the packet was transmitted to the processing system from a second processing system that is a member of a predefined group of processing systems; and

if it is determined that the packet was transmitted to the processing system from a second processing system that is a member of the predefined group of processing systems, then examining at least one field of the packet to determine whether the packet includes a predetermined message, wherein

the method further comprises transmitting from the first processing system to the second processing system a predetermined message in response to determining that (a) the packet was transmitted to the processing system from a second processing system that is a member of the predefined group of processing systems and (b) the packet includes the predetermined message.

3. (canceled)

4. (canceled)

10. A data processing system, comprising:

a network device configured to connect the processing system to a communications medium and configured to receive packets transmitted using the communications medium;

a supervisory operating system;

a secondary operating system;

an application configured to run as a task of the secondary operating system; and

a network control system configured to run as a task of the supervisory operating system and configured to;

(a) examine at least one field of a packet received by the network device; and

(b) determine whether or not to pass the packet to the application running as a task of the secondary operating system, wherein the determination is based at least in part on the content of the at least one field.

11. The system of claim 10, wherein the network control system is configured to determine whether the packet contains a predetermined message.

12. The system of claim 11, wherein the network control system is configured to send a second predetermined message to the application that originated the packet and discard the packet if the packet contains the predetermined message.

13. The system of claim 10, wherein the network control system is configured to:

determine whether the packet is a packet that is used to initiate a connection;

determine whether a warning indicator is set in response to determining that the packet is a packet that is used to initiate a connection; and

discard the packet if the warning indicator is set, wherein

the warning indicator indicates that (a) the processing system may be experiencing a denial of service attack and/or (b) the number of packets waiting in a queue is equal to or greater than a threshold value.

14. The system of claim 13, wherein the network control system is further configured to set the warning indicator if the value of a counter is greater than or equal to a predetermined value and if the packet is determined to be a packet that is used to initiate a connection.

15. The system of claim 14, wherein the network control system is configured to determine whether the packet is an ACK packet and decrement the counter in response to determining that the packet is an ACK packet.

16. The system of claim 10, wherein the network control system is configured to:

determine whether the packet is destined for a port that has been identified as being a critical port;

determine whether a congestion warning indicator is set if the packet is not destined for a port that been identified as being a critical port; and

pass the packet to the application if, and only if, the congestion warning flag is not set or the packet is destined for a port that has been identified as being a critical port.

17. The system of claim 10, wherein the network control system is configured to:

determine whether the packet was transmitted to the data processing system from a second data processing system that is a member of a predefined group of data processing systems;

examine at least one field of the packet to determine whether the packet includes a predetermined message if it is determined that the packet was transmitted to the processing system from a second processing system that is a member of the predefined group of processing systems; and

transmit to the second processing system a predetermined message in response to determining that (a) the packet was transmitted to the processing system from a second processing system that is a member of the predefined group of processing systems and (b) the packet includes the predetermined message.

18. The system of claim 10, wherein the application is a virtual network driver.

19. In a processing system comprising a network device for connecting the processing system to a communications medium, a supervisory operating system, a secondary operating system, and computer code stored on a computer readable medium, the computer code comprising:

first computer code configured to implement an application and configured to execute as a task of the secondary operating system; and

second computer code configured to execute as a task of the supervisory operating system and configured to;

examine at least one field of a packet received by the network device; and

determine whether or not to pass the packet to the application, wherein

the determination is based at least in part on the content of the at least one field.

20. The computer code of claim 19, wherein the second computer code is configured to determine whether the packet contains a predetermined message.

21. The computer code of claim 20, wherein the second computer code is configured to send a second predetermined message to the application that originated the packet and discard the packet if the packet contains the predetermined message.

22. The computer code of claim 19, wherein the second computer code is configured to:

determine whether the packet is a packet that is used to initiate a connection,

determine whether a warning indicator is set in response to determining that the packet is a packet that is used to initiate a connection; and

discard the packet if the warning indicator is set, wherein

the warning indicator indicates that (a) the processing system may be experiencing a denial of service attack and/or (b) the number of packets waiting in a queue is equal to or greater than a threshold value.

23. The computer code of claim 22, wherein the second computer code is further configured to set the warning indicator if the value of a counter is greater than or equal to a predetermined value and if the packet is determined to be a packet that is used to initiate a connection.

24. The computer code of claim 23, wherein the second computer code is configured to determine whether the packet is an ACK packet and decrement the counter in response to determining that the packet is an ACK packet.

25. The computer code of claim 19, wherein the second computer code is configured to:

determine whether the packet is destined for a port that has been identified as being a critical port;

determine whether a congestion warning indicator is set if the packet is not destined for a port that been identified as being a critical port; and

pass the packet to the application if, and only if, the congestion warning flag is not set or the packet is destined for a port that has been identified as being a critical port.

26. The computer code of claim 19, wherein the second computer code is configured to:

determine whether the packet was transmitted to the data processing system from a second data processing system that is a member of a predefined group of data processing systems;

examine at least one field of the packet to determine whether the packet includes a predetermined message if it is determined that the packet was transmitted to the processing system from a second processing system that is a member of the predefined group of processing systems; and

transmit to the second processing system a predetermined message in response to determining that (a) the packet was transmitted to the processing system from a second processing system that is a member of the predefined group of processing systems and (b) the packet includes the predetermined message.

27. The system of claim 19, wherein the application is a virtual network driver.