Systems and methods for object rate limiting in multi-core system
The present invention is directed towards systems and methods for managing a rate of request for an object transmitted between a server and one or more clients via a multi-core intermediary device. A first core of the intermediary device can receive a request for an object and assume ownership of the object. The first core can store the object in shared memory along with a rate-related counter for the object and generate a hash to the object and counter. Other cores can obtain the hash from the first core and access the object and counter in shared memory. Policy engines and throttlers in operation on each core can control the rate of access to the stored object.
1. A method for managing a rate of requests for an object transmitted between a server and one or more clients via a multi-core intermediary device, the method comprising:
(a) receiving, by a first packet processing engine executing on a first core of a plurality of cores of an intermediary device deployed between a plurality of clients and one or more servers, a request from a client for a first object of a plurality of objects from a server, each of the plurality of packet processing engines executing on a corresponding core of the plurality of cores, the intermediary device comprising a rate limit for a first object across the plurality of cores, the rate limit comprising a predetermined number of requests for the first object to traverse the intermediary device within a predetermined time period, the first object comprises a predetermined application layer object;
(b) designating, by the intermediary device, the first core as an owner core of the first object;
(c) establishing, by the first packet processing engine, a location in shared memory accessible by the plurality of cores for storing a rate related counter for the first object, the rate related counter identifying a number of requests for the first object traversing the intermediary device;
(d) receiving, by a second packet processing engine executing on a second core of the plurality of cores, a second request for the first object;
(e) receiving, by the second packet processing engine from the first packet processing engine, the location in shared memory; and
(f) determining, by the second packet processing engine via the rate related counter obtained from the location in shared memory, whether or not the rate limit for the first object has been reached.
2. The method of claim 1 , wherein step (c) further comprises generating, by the first packet processing engine, a hash for the first object.
3. The method of claim 2 , wherein step (e) further comprises receiving, by the second packet processing engine from the first packet processing engine, the hash for the first object.
4. The method of claim 1 , wherein step (d) further comprises determining, by the second packet processing engine, identification of the first core as the owner core by evaluating an expression on the first object and computing the hash value for the first object.
5. The method of claim 4 , further comprising performing by the second packet processing engine a lookup of the first object in a memory cache of the second packet processing engine using the identification of the first core and the hash value.
6. The method of claim 1 , wherein step (d) further comprises storing, by the second packet processing engine, the location in shared memory and a hash value of the first object to a memory cache of the second packet processing engine.
7. The method of claim 1 , further comprising receiving, by a third packet processing engine of the plurality of packet processing engines, a third request for the first object and identifying the location of the shared memory for the first object via cache memory of the third packet processing engine and determining whether or not the rate limit of the first object has been reached by the rate related counter in shared memory.
8. The method of claim 1 , wherein step (f) further comprises storing, by the second packet processing engine, an update to the rate related counter at the location of shared memory.
9. The method of claim 1 , wherein step (e) further comprises determining, by the second packet processing engine, that a memory cache of the second processing engine does not store information on the first object and transmitting, by the second packet processing engine, a request for information on the first object from the second packet processing engine.
10. The method of claim 9 , further comprising determining, by the second packet processing engine, identification of the first core as the owner core by evaluating an expression on the first object.
11. A system for managing a rate of requests for an object transmitted between a server and one or more clients via a multi-core intermediary device, the system comprising:
an intermediary device deployed between a plurality of clients and one or more servers, the intermediary device comprising a rate limit for a first object across the plurality of cores, the rate limit comprising a predetermined number of requests for the first object to traverse the intermediary device within a predetermined time period, the first object comprises a predetermined application layer object;
a first packet processing engine executing on a first core of a plurality of cores of the intermediary device, each of the plurality of packet processing engines executing on a corresponding core of the plurality of cores, the first packet processing engine receiving a request from a client for a first object of a plurality of objects from a server; and
a second packet processing engine executing on a second core of the plurality of cores of the intermediary device, the second packet processing engine receiving a second request for the first object, wherein
the intermediary device designates the first core as an owner core of the first object;
the first packet processing engine establishes a location in shared memory accessible by the plurality of cores for storing a rate related counter for the first object, the rate related counter identifying a number of requests for the first object traversing the intermediary device;
the second packet processing engine receives from the first packet processing engine the location in shared memory; and
the second packet processing engine determines via the rate related counter obtained from the location in shared memory, whether or not the rate limit for the first object has been reached.
12. The system of claim 11 , wherein the first packet processing engine generates a hash for the first object.
13. The system of claim 12 , wherein the second packet processing engine receives from the first packet processing engine the hash for the first object.
14. The system of claim 11 , wherein the second packet processing engine determines identification of the first core as the owner core by evaluating an expression on the first object and computing the hash value for the first object.
15. The system of claim 14 , further wherein the second packet processing engine performs a lookup of the first object in a memory cache of the second packet processing engine using the identification of the first core and the hash value.
16. The system of claim 11 , wherein the second packet processing engine further stores the location in shared memory and a hash value of the first object to a memory cache of the second packet processing engine.
17. The system of claim 11 , further comprising a third packet processing engine of the plurality of packet processing engines receiving a third request for the first object and identifying the location of the shared memory for the first object via cache memory of the third packet processing engine and determining whether or not the rate limit of the first object has been reached by the rate related counter in shared memory.
18. The system of claim 11 , wherein the second packet processing engine further stores an update to the rate related counter at the location of shared memory.
19. The system of claim 11 , wherein the second packet processing engine further determines that a memory cache of the second processing engine does not store information on the first object and transmits a request for information on the first object from the second packet processing engine.
20. The system of claim 19 , further wherein the second packet processing engine determines identification of the first core as the owner core by evaluating an expression on the first object.