Resource scheduler within a network device

• US 8,150,977 B1
• Filed: 04/01/2011
• Issued: 04/03/2012
• Est. Priority Date: 12/29/2006
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Cheng, Yonghui, Sun, Yi
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US13/078,688
• Time in Patent Office: 368 Days
• Field of Search: 709227-229, 709/203, 709/250
• US Class Current: 709/227
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 47/2416 Real-time traffic
• CPC Class Codes: H04L 47/50 Queue scheduling
• CPC Class Codes: H04L 47/52 by attributing bandwidth to queues
• CPC Class Codes: H04L 49/9047 including multiple buffers, e.g. buffer pools
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests

Abstract

A network device is described in which a dedicated resource scheduler monitors memory consumption to provide for improved processing of communication sessions. The scheduler maintains a dependency list of communication sessions, and reserves memory for communication sessions as requests for memory are received. The amount of memory reserved is determined based on the amount of memory currently reserved for the communication sessions in the dependency list. The network device may control ongoing communication sessions by way of window manipulation. Communication sessions are processed in a first mode when available memory has not reached a predetermined amount, while communication sessions are processed in a second mode when available memory reaches a predetermined amount.

Claims

1. A security device for processing communication sessions comprising:

an internal memory;

an engine that performs file-based scanning on network traffic received via communication sessions using the internal memory; and

a resource scheduler module that prevents the communication sessions from timing out by allocating memory from the internal memory so that at least one of the communication sessions is guaranteed to be processed to completion.

2. The device of claim 1, wherein the resource scheduler module is configured such that:

when available memory has not reached a predetermined amount remaining, the resource scheduler module operates in a first mode to cause the engine to process the communication sessions in parallel; and

when available memory reaches a predetermined amount remaining, the resource scheduler module operates in a second mode to cause the engine to process the communication sessions sequentially in accordance with a dependency list of communication sessions maintained by the resource scheduler module, wherein the dependency list specifies an order in which to process the communications sessions and specifies an amount of memory currently reserved for each of the communication sessions.

3. The device of claim 2, further comprising:

an engine that processes the communication sessions in accordance with the dependency list; and

a proxy module that receives a request to reserve memory for processing a new communication session;

wherein the resource scheduler module determines whether an amount of memory required to process the new communication session is greater than a total amount of memory reserved for the communication sessions already listed within the dependency list, and

wherein when the amount of memory required to process the new communication session is greater than the total amount of memory reserved for the communication sessions already listed within the dependency list, the resource scheduler module reserves memory for the new communication session in an amount equal to a difference between the amount of memory required to process the new communication session and the total amount of memory currently reserved for the communication sessions already listed to guarantee that processing of the new communication session can be completed upon processing the communication sessions already listed within the dependency list.

4. The device of claim 3, wherein the proxy module is a Transmission Control Protocol (TCP) proxy module, and wherein the communication sessions are TCP sessions.

5. The device of claim 2, further comprising a connection management module that dynamically initiates closing of communication windows for the communication sessions other than the first communication session on the dependency list when the scheduler operates in the second mode.

6. The device of claim 1, wherein the internal memory comprises:

a heap of available memory;

a public buffer pool; and

a reserved buffer pool, wherein the public buffer pool and the reserved buffer pool are maintained as logical data structures on top of the heap and used for allocating packet buffers to store packets received via the communication sessions,

wherein the resource scheduler module operates in a first mode when neither the available memory within the heap nor available memory within the public buffer pool has reached a respective predetermined amount, and

wherein the resource scheduler module operates in a second mode when either the available memory within the heap or the available memory within the public buffer pool has reached a respective predetermined amount.

7. The security device of claim 1, wherein the security device comprises one of a firewall, switch, proxy server, load balancer, router, gateway, or hub.

8. A method comprising:

with a network security device, performing file-based scanning on network traffic received via communication sessions using an internal memory of the security device; and

preventing the communication sessions from timing out by allocating memory with a resource scheduler module of the security device from the internal memory so that at least one of the communication sessions is guaranteed to be processed to completion.

9. The method of claim 8, further comprising:

when available memory has not reached a predetermined amount remaining, processing the communication sessions in a first mode comprising processing the communication sessions in parallel; and

when available memory reaches a predetermined amount remaining, processing the communication sessions in a second mode comprising processing the communication sessions sequentially in accordance with a dependency list of communication sessions maintained by the resource scheduler module, wherein the dependency list specifies an order in which to process the communications sessions and specifies an amount of memory currently reserved for each of the communication sessions.

10. The method of claim 9, wherein processing the communication sessions in the second mode comprises dynamically initiating closing of communication windows for the communication sessions other than a first communication session on the dependency list.

11. The method of claim 9, further comprising:

when an amount of memory required to process a new communication session is less than or equal to the total amount of memory reserved for communication sessions already listed within the dependency list, reserving no additional memory for the new communication session.

12. The method of claim 11, wherein the amount of memory required to process the new communication session is determined based on protocol information associated with the new communication session.

13. A non-transitory computer-readable storage medium comprising instructions for causing a programmable processor to:

perform file-based scanning on network traffic received via communication sessions using an internal memory of a security device; and

prevent the communication sessions from timing out by allocating memory from the internal memory so that at least one of the communication sessions is guaranteed to be processed to completion.

14. The computer-readable storage medium of claim 13, further comprising instructions for causing the programmable processor to:

when available memory has not reached a predetermined amount remaining, process the communication sessions in a first mode comprising processing the communication sessions in parallel; and

when available memory reaches a predetermined amount remaining, process the communication sessions in a second mode comprising processing the communication sessions sequentially in accordance with a dependency list of communication sessions maintained by the resource scheduler module, wherein the dependency list specifies an order in which to process the communications sessions and specifies an amount of memory currently reserved for each of the communication sessions.

15. The computer-readable storage medium of claim 14, wherein the instructions to process the communication sessions in the second mode comprises instructions to dynamically initiate closing of communication windows for the communication sessions other than a first communication session on the dependency list.

16. The computer-readable storage medium of claim 14, further comprising instructions for causing the programmable processor to:

when an amount of memory required to process a new communication session is less than or equal to the total amount of memory reserved for communication sessions already listed within the dependency list, reserve no additional memory for the new communication session.

17. The computer-readable storage medium of claim 16, wherein the amount of memory required to process the new communication session is determined based on protocol information associated with the new communication session.