Handling sequence numbers and/or an anti-replay window after failover between servers
View Patent ↗To prevent loss of packets due to failover between server systems in which a failover mechanism is provided in a first server system to enable a second server system to failover to the first server system, the first server system includes a first sequence number space that is different from a second sequence number space in the second server system. The first and second sequence number spaces are part of a total sequence number space. After failover from the second server system to the first server system, the first server system sends packets containing sequence numbers in the first sequence number space which are defined by a security protocol.
1. A method to prevent loss of packets due to failover between server systems, comprising:
providing a failover mechanism at a first server system to enable a second server system to failover to the first server system;
providing a first sequence number space in the first server system that is different from a second sequence number space in the second server system, wherein the first and second sequence number spaces are part of a total sequence number space; and
after failover from the second server system to the first server system, the first server system sending, to a client system, packets having sequence numbers in the first sequence number space, wherein the sequence numbers are defined by a security protocol, wherein the sequence numbers in the first sequence number space contained in the packets sent by the first server system to the client system differ from sequence numbers in the second sequence number space in packets sent by the second server system to the client system prior to the failover.
2. The method of claim 1 , wherein providing the first sequence number space comprises providing a sequence number space that is half of the total sequence number space, wherein the second sequence number space is the other half of the total sequence number space, and wherein the total sequence number space is defined by a number of bits of a sequence number.
3. The method of claim 1 , wherein the first server system sending packets having sequence numbers defined by the security protocol comprises the first server system sending packets having sequence numbers defined by an Internet Protocol Security (IPsec) protocol.
4. The method of claim 1 , wherein the first server system sending packets comprises the first server system sending packets having one of Authentication Header (AH) and Encapsulating Security Protocol (ESP) headers containing the sequence numbers.
5. The method of claim 1 , further comprising resetting a current inbound sequence number maintained by the first server system in response to detecting failover from the second server system to the first server system.
6. The method of claim 5 , further comprising resetting a mask value associated with the current inbound sequence number in response to detecting failover from the second server system to the first server system, wherein the mask value is to identify sequence numbers within a sliding anti-replay window that have been received by the first server system, and wherein resetting the current inbound sequence number causes the sliding anti-replay window to shift.
7. The method of claim 6 , further comprising an anti-replay control logic in the first server system using the current inbound sequence number and reset mask value to provide anti-replay protection.
8. The method of claim 1 , wherein the sequence numbers in the first sequence number space in the packets sent by the first server system to the client system allow the client system to accept the packets sent by the first server system after failover without dropping any of the packets sent by the first server system.
9. The method of claim 1 , wherein providing the first sequence number space and sending packets having sequence numbers in the first sequence number space are performed by a Virtual Private Network (VPN) server in the first server system.
10. A first server system, comprising:
an interface to communicate with a client system over a network;
failover control logic to enable failover from a second server system to the first server system;
anti-replay control logic to detect duplicate sequence numbers within a sliding window, wherein the sequence numbers are defined by a security protocol, and wherein the sliding window is based on a current inbound sequence number maintained by the first server system; and
reset logic responsive to failing over of the second server system to the first server system to reset the current inbound sequence number.
11. The first server system of claim 10 , wherein the anti-replay control logic detects duplicate sequence numbers in the sliding window further based on a mask value indicating which sequence numbers within the sliding window have been received, and
wherein the reset logic is responsive to failing over of the second server system to the first server system by further resetting the mask value.
12. The first server system of claim 10 , further comprising a sequence number counter to increment sequence numbers in successively transmitted packets, wherein the sequence number counter operates within a first sequence number space different from a second sequence number space assigned to the second server system.
13. The first server system of claim 12 , wherein the first and second sequence number spaces form different portions of a total sequence number space defined by a number of bits of a sequence number.
14. The first server system of claim 12 , wherein each of the sequence numbers in the first sequence number space is larger than any of the sequence numbers in the second sequence number space.
15. The first server system of claim 10 , wherein resetting the current inbound sequence number causes the sliding window to shift.
16. An article comprising at least one storage medium containing instructions that when executed cause a first server system to:
enable failover from a second server system to the first server system;
provide a first sequence number space in the first server system that is different from a second sequence number space in the second server system, wherein the first and second sequence number spaces are part of a total sequence number space; and
after failover from the second server system to the first server system, send, to a client system, packets having sequence numbers in the first sequence number space, wherein the sequence numbers are defined by a security protocol, wherein the sequence numbers in the first sequence number space contained in the packets sent by the first server system to the client system differ from sequence numbers in the second sequence number space in packets sent by the second server system to the client system prior to the failover.
17. The article of claim 16 , wherein sequence numbers in the first sequence number space are larger than sequence numbers in the second sequence number space to enable a client system to accept the sent packets from the first server system, where the client system previously received packets from the second server system that contained sequence numbers in the second sequence number space prior to the failover.
18. The article of claim 16 , wherein the instructions when executed cause the first server system to further:
reset a sliding anti-replay window of the first server system in response to the failover.
19. The article of claim 18 , wherein the instructions when executed cause the first server system to further:
reset a mask value associated with the anti-replay window in response to the failover.
20. The article of claim 16 , wherein sending the packets comprises sending the packets containing security headers containing the sequence numbers.
21. The article of claim 20 , wherein the security headers comprise one of Authentication Header (AH) and Encapsulating Security Protocol (ESP) headers containing the sequence numbers.