Methods, systems and computer program products for transferring security processing between processors in a cluster computing environment

• US 6,941,366 B2
• Filed: 01/17/2001
• Issued: 09/06/2005
• Est. Priority Date: 01/17/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Antes, Mark L., Godwin, James Russell, Herr, David Anthony, Overby, Jr., Linwood H., Wierbowski, David J.
• Primary Examiner(s): LIN, WEN TAI
• Application Number:
  US09/764,500
• Publication Number:
  US 20020095496A1
• Time in Patent Office: 1,693 Days
• Field of Search: 709223-224, 709225-227, 714 4- 6, 714/11, 370/401, 370/248
• US Class Current: 709/224
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 69/166 IP fragmentation; TCP segmentation

Abstract

Methods, systems and computer program products provide for transferring network security based communications from a first distribution processor, which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the first distribution processor by a common network address, to a second distribution processor. Information sufficient to restart the transferred network security based communications at the second distribution processor is provided. Takeover of the common address by the second distribution processor is detected and existing network security based communications to the first distribution processor are terminated. The transferred communications are restarted at the second distribution processor utilizing the provided information. Both inbound and outbound network security based communications with target hosts utilizing the common network address are routed through the second distribution processor. Network security processing for both the inbound and the outbound network security based communications utilizing the common network address is performed at the second distribution processor.

Claims

1. A method of transferring network security based communications from a first distribution processor, which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the first distribution processor by a common network address, to a second distribution processor, the method comprising:

providing information sufficient to restart the transferred network security based communications at the second distribution processor;

detecting takeover of the common address by the second distribution processor;

terminating existing network security based communications to the first distribution processor;

restarting the transferred network security based communications at the second distribution processor utilizing the provided information;

routing both inbound and outbound network security based communications with target hosts utilizing the common network address through the second distribution processor; and

network security processing both the inbound and the outbound network security based communications utilizing the common network address at the second distribution processor.

2. A method according to claim 1, further comprising the step of identifying transferred network security based communications local to the first distribution processor utilizing the common network address as distributed communications so as to cause communications utilizing the common network address and network security to be routed through the second distribution processor.

3. A method according to claim 1, wherein the step of providing information sufficient to restart communications comprises the step of transmitting, from the first distribution processor to the second distribution processor prior to termination of the existing secure communications to the first distribution processor, network security information from which network security relationships associated with the transferred network security based communications through the first distribution processor can be re-established at the second distribution processor.

4. A method according to claim 1, wherein the step of providing information sufficient to restart communications comprises the step of storing in a common storage accessible to the second distribution processor, network security information from which network security relationships associated with the transferred network security based communications through the first distribution processor can be re-established at the second distribution processor.

5. A method according to claim 4, wherein the step of restarting the transferred network security based communications at the second distribution processor utilizing the provided information, comprises the following steps carried out by the second distribution processor:

obtaining the network security information from the common storage;

establishing the security relationships associated with the transferred network security based communications through the first distribution processor at the second distribution processor; and

notifying target hosts associated with the transferred network security based communications that the second distribution processor has taken ownership of the transferred network security based communications.

6. A method according to claim 5, further comprising the step of clearing the network security information from the common storage subsequent to the second distribution processor obtaining the network security information from the common storage.

7. A method according to claim 5, further comprising the step of placing in the common storage, network security information from which network security relationships associated with network security based communications through the second distribution processor can be re-established at another distribution processor.

8. A method according to claim 5, further comprising the step of identifying as non-distributed communications, ones of the transferred network security based communications local to the second distribution processor which were previously distributed communications routed through the first distribution processor.

9. A method according to claim 5, wherein the network security comprises Internet Protocol Security (IPSec).

10. A method according to claim 9, wherein the information stored in the common storage comprises at least one of Phase 1 Security Association (SA) information, Phase 2 SA information and information relating the Phase 1 SA information to the Phase 2 SA information.

11. A system for transferring network security based communications from a first distribution processor, which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the first distribution processor by a common network address, to a second distribution processor, comprising:

means for providing information sufficient to restart the transferred network security based communications at the second distribution processor;

means for detecting takeover of the common address by the second distribution processor;

means for terminating existing network security based communications to the first distribution processor;

means for restarting the transferred network security based communications at the second distribution processor utilizing the provided information;

means for routing both inbound and outbound network security based communications with target hosts utilizing the common network address through the second distribution processor; and

means for network security processing both the inbound and the outbound network security based communications utilizing the common network address at the second distribution processor.

12. A computer program product for transferring network security based communications from a first distribution processor, which provides secure communications over a network in a distributed workload environment having target hosts which are accessed through the first distribution processor by a common network address, to a second distribution processor, comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code which provides information sufficient to restart the transferred network security based communications at the second distribution processor;

computer readable program code which detects takeover of the common address by the second distribution processor;

computer readable program code which terminates existing network security based communications to the first distribution processor;

computer readable program code which restarts the transferred network security based communications at the second distribution processor utilizing the provided information;

computer readable program code which routes both inbound and outbound network security based communications with target hosts utilizing the common network address through the second distribution processor; and

computer readable program code which network security processes both the inbound and the outbound network security based communications utilizing the common network address at the second distribution processor.