System and method for providing expandable proxy firewall services
View Patent ↗A mechanism that enables flexible expansion of proxy firewall services is disclosed. In accordance with the present invention, the firewall system can be configured to include a dispatch host computer and one or more load host computers. Proxy firewall services can be provided by proxy applications that reside on either the dispatch host computer and/or the load host computers. In one embodiment, a load host computer can be configured to support multiple proxy applications. In other embodiments, a load host computer can be dedicated to a single resource intensive application. In this framework, a network administrator can flexibly decide how to accommodate the demand for proxy firewall services. Load hosts can be added or removed from the firewall system without disrupting ongoing security services. In one embodiment, this feature is enabled through the inclusion of a configuration file on the dispatch host computer that stores information relating to the load host computers in the firewall system.
1. A computer system for providing proxy firewall services for a computer network, comprising:
a dispatch host computer, said dispatch host computer being connectable to an external network; and
at least one load host computer coupled to said dispatch host computer, said at least one load host computer configured to provide proxy firewall services, said at least one load host computer being connectable to one or more application servers, wherein said connection from the external network is distributed from said dispatch host computer to a particular load host computer based on an analysis of the type of protocol of the connection and an analysis of activity across the load host computers;
wherein said at least one load host computer and said dispatch host computer communicate information regarding the connection of said at least one load host computer to the computer system;
wherein said dispatch host computer includes a configuration file with information relating to load host computers in the computer system, wherein upon the connection of another load host computer to the computer system, said configuration file is updated to reflect the availability of said another load host computer in the computer system.
2. The computer system of claim 1 , wherein said dispatch host computer includes a monitoring element that listens for connections on multiple ports.
3. The computer system of claim 2 , wherein said monitoring element is a dispatch proxy.
4. The computer system of claim 1 , wherein said at least one load host computer is a protocol specific load host computer.
5. The computer system of claim 1 , wherein said at least one load host computer can handle multiple protocols.
6. The computer system of claim 1 , wherein said dispatch host computer provides proxy firewall services.
7. A method of providing proxy firewall services for a computer network, comprising: identifying a set of load host computers, each load host computer in said set of load host computers being configured to provide proxy firewall services;
monitoring one or more incoming ports at a dispatch host computer for a connection;
upon identification of said connection, selecting from said set of load host computers a load host computer to which said connection should be forwarded based on an analysis of the type of protocol of said connection and an analysis of activity across the load host computers;
wherein said identifying comprises communicating information between said dispatch host computer and said load host computers relating to the availability of said load host computers.
8. The method of claim 7 , wherein said monitoring comprises monitoring for a connection with a dispatch proxy that monitors one or more incoming ports on said dispatch host computer simultaneously.
9. The method of claim 7 , wherein said selecting comprises selecting a load host computer based on a round robin load distribution among said load host computers.
10. The method of claim 7 , wherein said selecting comprises selecting a load host computer based on the availability of the load host computers.
11. The method of claim 7 , wherein said selecting comprises selecting a load host computer based on the percentage of the total number of simultaneous proxied connections the load host computer can support.
12. The method of claim 7 , wherein said selecting comprises selecting a load host computer that can support a resource intensive protocol.
13. A firewall network resource method comprising: identifying a resource intensive protocol;
designating a load host computer for providing primary support for said resource intensive protocol; and
routing a connection for said resource intensive protocol from a dispatch host computer to said designated load host, wherein said designated load host provides exclusive support for said resource intensive protocol and wherein designating includes analyzing activity across a plurality of host computers and selecting a load host computer based on the load host computer activity analysis.
14. The method of claim 13 , further comprising:
processing on the dispatch host computer a connection for at least one protocol other than said resource intensive protocol.
15. The method of claim 13 , wherein said designated load host is dedicated to said resource intensive protocol.
16. The method of claim 13 , further comprising:
designating another load host for multi-purpose support.
17. The method of claim 13 , wherein said dispatch host computer has multi-purpose support.
18. A method of expanding proxy firewall services for a computer network comprising: receiving a connecting at a dispatch host computer;
selecting a first load host computer to which the connection should be forwarded;
forwarding said connection to said first load host computer;
connecting a second load host computer to said dispatch host computer; and
updating a configuration file on said dispatch host computer to reflect the connection of said second load host computer, wherein upon said updating, said second load host computer is available to process forwarded connections from said dispatch host computer, wherein said updating comprises communicating information between said dispatch host computer and said second load host computer regarding the availability of said second load host computer.
19. The method of claim 18 , wherein said connecting and said updating occur during the provision of proxy firewall services.
20. The method of claim 18 , wherein said connecting includes signaling the dispatch host computer upon connection.