Network security smart load balancing

• US 9,137,204 B2
• Filed: 02/02/2006
• Issued: 09/15/2015
• Est. Priority Date: 02/02/2006
• Status: Active Grant

• Current Assignee: Check Point Software Technologies Limited
• Original Assignee: Check Point Software Technologies Limited
• Inventors: Schory, Omer, Raz, Ofer, Gonda, Oded
• Primary Examiner(s): Le, David
• Application Number:
  US11/345,341
• Publication Number:
  US 20070180226A1
• Time in Patent Office: 3,512 Days
• Field of Search: 713150-153
• US Class Current: 1/1
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls

Abstract

A system and method for protecting data communications in a system including a load-balancer connected to a cluster of security network components, e.g. firewall node. The load-balancer transfers one or more of the data streams respectively to the security components. The security network components transmit control information to the load-balancer and the control information includes an instruction regarding balancing load of the data streams between said security network components; The load-balancer balances load based on the control information. Preferably, network address translation is performed by the load-balancer based on the control information or network address translation is performed by the security network component and the control information includes information regarding an expected connection based on the network address translation. Preferably, when the data communications includes an encrypted session, an encrypted connection of the encrypted session is identified based on the control information and the balancing of the load maintains stickiness of said encrypted connection.

Claims

1. A method for protecting data communications, the method comprising the steps of:

(a) providing at least one load-balancer operatively connecting a cluster of security network components, said at least one load-balancer transferring a plurality of data streams respectively to said security components, said at least one load balancer being separate from said security network components;

(b) transmitting control information from at least one of said security network components to said at least one load-balancer, wherein said control information includes an instruction regarding balancing load of said data streams between said security network components; and

(c) balancing load, by said at least one load-balancer, based on said control information, only by transferring said plurality of data streams respectively to said security network components.

2. The method according to claim 1, further comprising the step of:

(d) performing network address translation by said at least one load-balancer, wherein said network address translation is based on said control information.

3. The method according to claim 1, further comprising the step of:

(d) performing network address translation by said at least one security network component, wherein said control information includes information regarding an expected connection based on said network address translation.

4. The method according to claim 1, further comprising the step of:

(d) performing encryption by said at least one security network component, wherein said control information includes information regarding an expected connection based on said encryption.

5. The method according to claim 1, wherein the data communications include at least one encrypted session, further comprising the step of:

(d) identifying an encrypted connection of said at least one encrypted session based on said control information, wherein said balancing load maintains stickiness of said encrypted connection.

6. The method according to claim 1, wherein said control information specifies one of the security network components to receive a new connection.

7. The method, according to claim 1, further comprising the steps of

(d) receiving at least one packet by said at least one security network component of said cluster through said at least one load-balancer, wherein said packet is of a connection of a communications session;

and

(e) reading by said at least one security network component at least one datum from said packet;

wherein said control information is based on said at least one datum and specifies at least one expected connection.

8. The method according to claim 7, wherein upon said reading, further comprising the steps of:

(f) encrypting said communications session by said at least one security network component; and

(g) identifying, by said at least one load-balancer, at least one of said data streams of said encrypted communications session based on said control information.

9. The method according to claim 7, wherein said at least one expected connection includes at least one expected packet of said session.

10. The method according to claim 7, wherein said at least one datum is in a payload of said packet.

11. The method according to claim 7, further comprising the steps of:

(f) upon receiving an expected packet of said at least one expected connection, forwarding said expected packet based on said control information.

12. The method, according to claim 11, wherein said forwarding is from said load balancer to selectively either said security network component or to a network operatively connected to said load balancer thereby bypassing said security network component.

13. The method according to claim 1, wherein said control information specifies an expected client-to-server connection and an expected server-to-client connection, wherein at least one condition is fulfilled selected from the group of:

(i) at least one source parameter of said client-to-server connection differs from at least one destination parameter of said server-to-client connection; and

(ii) at least one destination parameter of said client-to-server connection differs from at least one source parameter of said server-to-client connection.

14. The method according to claim 1, wherein said packet is of a multicast connection and said control information directs said at least one load-balancer to direct all multicast packets of said multicast connection to one of the network components.

15. The method according to claim 1, wherein upon said load-balancer reaching a maximum capacity, further comprising the steps of:

(d) dropping at least one connection of said session; and

(e) informing said network component of said dropping.

27. The method of claim 1, wherein each said security network component includes a firewall.

16. A system for protecting data communications, the system comprising:

(a) a cluster of security network components; and

(b) at least one load balancer, separate from said security network components, which operatively connects said security network components by transferring a plurality of data streams respectively to said security network components wherein said at least one load balancer receives a command from at least one of said security network components, wherein said command includes an instruction regarding balancing load of said data streams between said security network components, and wherein said balancing load of said data streams in accordance with said instruction is effected only by transferring said data streams respectively to said security network components by said at least one load balancer.

17. The system, according to claim 16, wherein network address translation is performed by a component selected from the group consisting of said security network components and said at least one load-balancer.

18. The system, according to claim 16, wherein said command includes control information based on at least one datum received by said at least one security network component.

19. The system, according to claim 16, wherein said command specifies at least one expected connection.

20. The system, according to claim 19, wherein said at least one expected connection includes at least one expected packet.

21. The system, according to claim 16, wherein at least one of said security network components includes an independent gateway connected through a network interface.

22. The system, according to claim 16, wherein at least one of the security components is a blade connected to said at least one load balancer.

23. The system, according to claim 16, wherein at least two of the security components are implemented at least in part by independent processors on one circuit board.

28. The system of claim 16, wherein each said security network component includes a firewall.

30. The system of claim 18, wherein said at least one datum is in a payload of a packet received by said at least one security network component.

24. A system for protecting data communications, the data communications including sessions wherein connection information is included as arguments of control commands of the sessions, the system comprising:

(a) a cluster of security network components; and

(b) at least one load balancer, separate from said security network components, which operatively connects said network components to at least one network;

wherein said network components and said at least one load balancer are configured so that

(i) said network components read said connection information; and

(ii) commands from the network components to said at least one load balancer allow maintaining connection stickiness in said sessions, wherein connection stickiness guarantees that all packets of each said sessions are processed by a single network component, and wherein, responsive to said commands, said at least one load balancer maintains said connection stickiness only by transferring packets of the sessions respectively to said security network components.

25. The system, according to claim 24, wherein said commands include a new-connection command, wherein at least one of said network components reads said connection information and based on said connection information, transfers expected connection information to said at least one load balancer.

26. The system, according to claim 24, wherein said commands include a register multicast command wherein all packets of related multicast connections are processed by a single network component.

29. The system of claim 24, wherein each said security network component includes a firewall.