Granted Patent B1

US 6,920,493 · App. 09/812,841 · Granted Jul 19, 2005

Abstract

Claims (73)

1. A system for dynamically configuring parameterized validation rules in a distributed computing environment, comprising:

a plurality of packet validation devices, each situated within the distributed computing environment at packet routing points and validating packet traffic using parameterized validation rules;

a plurality of hierarchical tree nodes structured into a plurality of tiered layers with each tree node interfaced to at least one other tree node, those tree nodes at a lowermost layer further interfaced to at least one packet validation device from which validation rule parameters are retrieved and processed;

a root tree node interfaced to an uppermost layer of tree nodes from which validation rule parameters are retrieved and disseminated to each of the packet validation devices; and

a filter executed by each tree node on retrieved validation rule parameters to remove at least one of duplicate validation rule parameters and validation rule parameters sharing commonly identified network address space.

2. A system according to claim 1 , further comprising:

a concast tree interconnecting the packet validation devices, the tree nodes, and the root tree node via an interconnection reserved for validation rule parameter exchange.

3. A system according to claim 1 , further comprising:

a dissemination path interconnecting the root tree node with each packet validation device via an interconnection reserved for validation rule parameter exchange.

4. A system according to claim 1 , wherein the validation rule parameters each comprise a source network address and subnet mask, a source network port, a destination network address and subnet mask, a destination network port, and one or more network protocol identifiers.

5. A method for dynamically configuring parameterized validation rules in a distributed computing environment, comprising:

fielding a plurality of packet validation devices, each situated within the distributed computing environment at packet routing points and validating packet traffic using parameterized validation rules;

interconnecting a plurality of hierarchical tree nodes structured into a plurality of tiered layers with each tree node interfaced to at least one other tree node, those tree nodes at a lowermost layer further interfaced to at least one packet validation device from which validation rule parameters are retrieved and processed;

interfacing a root tree node to an uppermost layer of tree nodes from which validation rule parameters are retrieved and disseminated to each of the packet validation devices; and

executing a filter by each tree node on retrieved validation rule parameters to remove at least one of duplicate validation rule parameters and validation rule parameters sharing commonly identified network address space.

6. A method according to claim 5 , further comprising:

interconnecting a tree between the packet validation devices, the tree nodes, and the root tree node via an interconnection reserved for validation rule parameter exchange.

7. A method according to claim 5 , further comprising:

interconnecting a dissemination path between the root tree node and each packet validation device via an interconnection reserved for validation rule parameter exchange.

8. A method according to claim 5 , wherein the validation rule parameters each comprise a source network address and subnet mask, a source network port, a destination network address and subnet mask, a destination network port, and one or more network protocol identifiers.

9. A computer-readable storage medium holding code for performing the method of claim 5 .

10. A system for communicating coalesced rule parameters in a distributed computing environment, comprising:

a plurality of packet validation devices communicatively interposed between network routing points within the distributed computing environment and applying parameterized rules to transiting network packet traffic;

a plurality of processing tree nodes configured into a concast tree, comprising:

in a lowermost layer of the concast tree, each processing tree node collecting and coalescing rule parameters from at least one packet validation device; and

in each successive layer of the concast tree, each processing tree node collecting and coalescing the rule parameters from at least one processing tree node in a next lower layer of the concast tree;

a control center assembling the coalesced rule parameters from each packet validation device in an uppermost layer of the concast tree; and

a dissemination path forwarding the coalesced rule parameters from the control center to each packet validation device.

11. A system according to claim 10 , wherein each processing tree node further comprises:

a parameter filter removing duplicate rule parameters and consolidating commonly identified network address space.

12. A system according to claim 10 , wherein each packet validation device further comprises:

a rule filter limiting application of the coalesced rule parameters to those network routing points within a pre-determined vicinity.

13. A system according to claim 10 , wherein the dissemination path further comprises:

the distributed computing environment through which the coalesced rule parameters are broadcast to each packet validation device.

14. A system according to claim 10 , wherein the dissemination path further comprises:

the concast tree through which the coalesced rule parameters are sent to each packet validation device via the processing tree nodes.

15. A system according to claim 10 , wherein the concast tree farther comprises:

an in-band communication channel logically defined via bandwidth reserved within the distributed computing environment.

16. A system according to claim 10 , wherein the concast tree further comprises:

an out-of-band communication channel interfacing the packet validation devices, the processing tree nodes, and the control center via interconnections peripheral to the distributed computing environment.

17. A system according to claim 10 , wherein the rule parameters each comprise:

source packet information describing a source network address and subnet mask;

source port information describing a source network port;

destination packet information describing a destination network address and subnet mask;

destination port information describing a destination network port; and

network protocol information identifying one or more network protocols.

18. A system according to claim 10 , wherein the distributed computing environment comprises an internet-protocol (IP)-based network.

19. A method for communicating coalesced rule parameters in a distributed computing environment, comprising:

applying parameterized rules to network packet traffic transiting a plurality of packet validation devices communicatively interposed between network routing points within the distributed computing environment;

configuring a plurality of processing tree nodes into a concast tree, comprising:

collecting and coalescing rule parameters from at least one packet validation device into a processing tree node in a lowermost layer of the concast tree; and

collecting and coalescing the rule parameters from at least one processing tree node in a next lower layer of the concast tree in each successive layer of the concast tree;

assembling the coalesced rule parameters from each packet validation device in an uppermost layer of the concast tree into a control center and forwarding the assembled coalesced rule parameters to each packet validation device.

20. A method according to claim 19 , further comprising:

removing duplicate rule parameters and consolidating commonly identified network address space.

21. A method according to claim 19 , further comprising

limiting application of the coalesced rule parameters to those network routing points within a pre-determined vicinity.

22. A method according to claim 19 , further comprising:

broadcasting the assembled coalesced rule parameters through the distributed computing environment to each packet validation device.

23. A method according to claim 19 , further comprising:

sending the assembled coalesced rule parameters to each packet validation device through the concast tree via the processing tree nodes.

24. A method according to claim 19 , further comprising:

logically defining an in-band communication channel by reserving bandwidth within the distributed computing environment.

25. A method according to claim 19 , wherein the concast tree further comprises:

interfacing the packet validation devices, the processing tree nodes, and the control center via an out-of-band communication channel using interconnections peripheral to the distributed computing environment.

26. A method according to claim 19 , wherein the rule parameters each comprise:

source packet information describing a source network address and subnet mask;

source port information describing a source network port;

destination packet information describing a destination network address and subnet mask;

destination port information describing a destination network port; and

network protocol information identifying one or more network protocols.

27. A method according to claim 19 , wherein the distributed computing environment comprises an internet-protocol (IP)-based network.

28. A computer-readable storage medium holding code for performing the method of claim 19 .

Assignments (7)