Granted Patent B2

US 7,970,899 · App. 11/367,765 · Granted Jun 28, 2011

Abstract

Claims (18)

1. An integrated data flow packet admission and traffic management apparatus deployed between a local area network and a wide area network, the apparatus comprising:

a non-statutory machine readable storage, digital electronic circuitry, and processors;

a security engine, the security engine coupled to, a traffic management engine, both the security engine and the traffic management engine coupled to a policy table, and the traffic management engine further coupled to a network interface;

the security engine comprising a classification component coupled to the network interface, whereby classification is only performed once; and

the classification component coupled to the traffic management engine;

a connection table coupled to the classification component, wherein said connection table comprises an information store of data to match an incoming packet with an extant admitted connection, and wherein the security engine comprises a data flow identification logic circuit, wherein a data flow is one of an extant admitted connection or a new connection, wherein said data flow identification logic circuit identifies a first packet of a new connection, and causes a drop or deny directive to said first packet of a new connection when an additional admission of said new connection to the connection table would exceed available bandwidth.

2. The integrated data flow packet admission and traffic management apparatus of claim 1 , wherein the data flow identification logic circuit comprises: a network layer address examination logic circuit, which sets characteristics of follow-on packet streams in a control packet to specific port or port ranges necessary to support a protocol for a duration of a session.

3. The integrated data flow packet admission and traffic management apparatus of claim 2 , wherein the network layer address examination logic circuit comprises: a destination network layer address logic circuit, which controls depth of outbound queues and window size and segment size without feedback from a destination.

4. The integrated data flow packet admission and traffic management apparatus of claim 1 , wherein the data flow identification logic circuit comprises: an application layer data examination logic circuit, which sets a type of service bit wherein a first type of service bit is set for voice service and a second type of service bit is set for video streaming service.

5. The integrated data flow packet admission and traffic management apparatus of claim 1 wherein the classification component comprises: a tag and forward logic circuit, whereby a packet which matches an existing admitted connection is identified, is tagged with a class identifier, and is forwarded to the traffic management engine.

6. An integrated data flow packet admission and traffic management apparatus comprising:

a non-statutory machine readable storage, digital electronic circuitry, and processors;

a security engine, the security engine coupled to a connection table, the security engine further coupled to a policy table;

wherein the security engine comprises a classification component, said classification component coupled to at least one application layer gateway logic component, and said application layer gateway logic component coupled to an admission control logic component, said admission control logic component coupled to a traffic management engine;

wherein the admission control logic component determines an accept, a deny, or a drop directive for a packet based on a class of data flows with which the packet is associated and further tags the packet with a class identifier for an existing data flow; and wherein each application layer gateway logic component comprises a protocol specific component, which reserves a specific port or port range to support a specific protocol for a duration of a protocol session, and closes the reserved port or port range upon termination of the protocol session, whereby services which would fail when traversing a network address translation component are sustained.

7. The integrated data flow packet admission and traffic management apparatus of claim 6 wherein the traffic management engine comprises: a plurality of outbound queues and a queuing engine circuit coupled to the network interface circuit, and a type of service packet processing circuit component; wherein said type of service packet processing circuit component determines a precedence for each packet and assigns each packet to an outbound queue appropriate to its type of service bit and data flow class.

8. The integrated data flow packet admission and traffic management apparatus of claim 6 wherein the traffic management engine comprises: a maximum segment size packet processing circuit component coupled to the network interface circuit; wherein said maximum segment size packet processing circuit component modifies a request for maximum requested segment size for a low priority connection to use smaller packets.

9. The integrated data flow packet admission and traffic management apparatus of claim 6 wherein the traffic management engine comprises: a rate shaping packet processing circuit component coupled to the network interface circuit; wherein said rate shaping packet processing circuit component receives, modifies, and forwards a TCP acknowledgement packet for control over an outbound queue's depth.

Assignments (13)