Granted Patent B2

US 9,596,300 · App. 14/174,361 · Granted Mar 14, 2017

Abstract

Claims (55)

1. A method, comprising:

defining, by a compute device, one or more rules to identify at least one connection between protocol entities, wherein each connection is hosted by network nodes in a packet data communication network;

receiving, by the compute device, data packets including information identifying communicating protocol entities;

comparing, by the compute device, the information identifying the communicating protocol entities to the one or more rules to identify each corresponding connection; and

storing, by the compute device, the received data packets into batches corresponding to each identified connection.

2. The method of claim 1 , comprising;

processing, by a compute device, at least one batch of received data packets according to a set of processing rules for the corresponding connection, said processing comprising one or more from a group comprising: firewall access control, firewall connection tracking, packet forwarding, Virtual Private Network operation, Network Address Translation, Deep Packet Inspection and load balancing decision in a network security device cluster.

3. The method of claim 1 , comprising:

maintaining, by a compute device, batches comprising a first set of batches corresponding to defined connections and a second set of batches without a corresponding defined connection; and

storing, by a compute device, the received data packets associated with a connection without a corresponding batch in the first set of batches, to a batch in the second set of batches.

4. The method of claim 1 , comprising:

maintaining, by a compute device, batches comprising a first set of batches corresponding to defined connections and a second set of batches without a corresponding defined connection; and

processing, by a compute device on a packet-by-packet basis, received packets stored in the second set of batches on the basis of a set of rules corresponding to individual connections of the received packets.

5. The method of claim 1 , comprising:

deriving, by a compute device, information identifying at least one communicating protocol entity from a received data packet; and

determining, by a compute device, a connection associated with the received data packet on the basis of the derived information including one or more from a group comprising: a source node network address, destination node network address and at least one identifier of an upper layer protocol entity above a network layer protocol providing the network addressing, wherein the at least one identifier includes a destination node port or a source node port.

6. The method of claim 1 , wherein the compute device is an intermediary network node, the data packets are received at the intermediary network node from a source network node and transmitted by the intermediary network node to a destination network node, said source and destination network nodes communicating on an end-to-end-connection between a source protocol entity and a destination protocol entity.

7. The method of claim 1 , wherein a batch comprises data packets belonging to the same connection and a batch identifier associated with the data packets.

8. The method of claim 1 , comprising:

calculating, by the compute device, a hash value on the basis of the information identifying communicating protocol entities of a received data packet; and

storing, by the compute device, the received data packets with the same hash value into the same batch.

9. The method of claim 1 , comprising:

maintaining, by the compute device, a plurality of batches of received data packets, wherein at least one of the batches corresponds to a defined connection between protocol entities hosted by network nodes in a packet data communication network;

identifying, by the compute device, a batch corresponding to a defined connection by a first hash value calculated on the basis of a subset of information identifying the defined connection; and

storing, by the compute device, a received data packet to a second batch, when a second hash value calculated on the basis of a subset of information identifying communicating protocol entities of the received data packet, is different than the first hash value.

10. The method of claim 1 , comprising:

maintaining, by the compute device, a plurality of batches of received data packets, wherein at least one of the batches corresponds to a defined connection between protocol entities hosted by network nodes in a packet data communication network; and

storing, by the compute device, a received data packet to a batch without a corresponding defined connection, on the basis of the information identifying communicating protocol entities of the received data packet fails to correspond with the defined connection corresponding to the batch.

11. The method of claim 1 , comprising:

defining, by the compute device, a limit to a number of batches;

storing, by the compute device, a received data packet to a new batch, when the number of batches is below the limit; and

storing, by the compute device, the received data packet to a batch without a corresponding defined connection, when the limit is met.

12. The method of claim 1 , wherein a batch is associated with a limit indicative of at least one of a time limit for storing a data packet in the batch, a memory limit, a limit for the number of data packets in the batch, or their combination, and the batch is processed after the limit is met.

13. The method of claim 1 , wherein a connection comprises a connection on at least one of a network protocol layer connection, a transport protocol layer connection or an application protocol layer connection.

14. An apparatus, comprising:

at least one network interface;

a memory coupled to the at least one network interface; and

a batching unit coupled to the memory and to the at least one network interface,

wherein the apparatus is to:

define one or more rules to identify at least one connection between protocol entities, wherein each connection is hosted by network nodes in a packet data communication network;

receive data packets including information identifying communicating protocol entities;

compare the information identifying the communicating protocol entities to the one or more rules to identify each corresponding connection; and

store the received data packets into batches corresponding to each identified connection.

15. The apparatus of claim 14 , further comprising a processing unit for processing the batches, wherein the processing unit is configured to:

process at least one batch of received data packets according to a set of processing rules for the corresponding connection, said processing comprising one or more from a group comprising: firewall access control, firewall connection tracking, packet forwarding, Virtual Private Network operation, Network Address Translation, Deep Packet Inspection and load balancing decision in a network security device cluster.

16. The apparatus of claim 14 , wherein the apparatus comprises a plurality of network interfaces and the batching unit is a central batching unit common to the network interfaces.

17. The apparatus of claim 14 , wherein the apparatus comprises a plurality of network interfaces, each comprising a dedicated batching unit.

18. The apparatus of claim 14 , wherein the apparatus comprises a plurality of network interfaces each having a dedicated batching unit, and a central batching unit common to the network interfaces, and the apparatus is to:

store the received data packets into batches in a first phase by the dedicated hatching units; and

store the received data packets that are unallocated to batches in the first phase, into batches in a second phase by the central batching unit.

19. One or more transitory computer readable storage media comprising a plurality of instructions that, when executed, cause a compute device to:

define one or more rules to identify at least one connection between protocol entities, wherein each connection is hosted by network nodes in a packet data communication network;

receive data packets including information identifying communicating protocol entities;

compare the information identifying the communicating protocol entities to the one or more rules to identify each corresponding connection; and

store the received data packets into batches corresponding to each identified connection.

Assignments (11)