US20150039671A1 - Combining stateless and stateful server load balancing - Google Patents

Abstract

The processing of data packets sent over a communication session between a host and a server by a service gateway includes processing a data packet using a current hybrid-stateful or hybrid-stateless processing method. The processing then checks whether a hybrid-stateless or hybrid-stateful condition is satisfied. When one of the sets of conditions is satisfied, the process includes changing from a hybrid-stateful to a hybrid-stateless processing method, or vice versa, for a subsequently received data packet. If the conditions are not satisfied, the process continues as originally structured.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS
• This application is a continuation of and claims the priority benefit of U.S. patent application Ser. No. 13/280,336 filed on Oct. 24, 2011, and entitled “Combining Stateless and Stateful Server Load Balancing,” the disclosure of which is incorporated herein by reference.
BACKGROUND OF THE INVENTION
• 1. Field
• This invention relates generally to data communications, and more specifically, to a service gateway.
• 2. Related Art
• Demand for data communication services for consumer and corporate computing devices has been rapidly increasing. Service providers deploy service gateways such as server load balancers or traffic managers to bridge host computers or computing devices with servers providing the data services.
• Service gateways provide services either using a stateful processing method or a stateless processing method. Generally, in a stateful processing method, packets are processed as a stream of packets, and each packet in the stream are processed in the same way. In a stateless processing method, packets are processed discretely, where each packet is assessed individually. The stateful processing method may be preferred over the stateless processing method due to the security and control features that may be implemented, however, the resource requirements of such features may make the services difficult to scale. The stateless processing method may be preferred over the stateful processing method due to its scalability, however, this is at the expense of security and control.
• Traffic managed by service gateways is rarely uniform, as conditions on a network typically fluctuate, at times greatly. Currently, system administrators are required to choose either a stateful processing method or a stateless processing method for a particular service address, weighing the costs and benefits of each method. System administrators are not able to realize the advantages of both processing methods for such non-uniform traffic.
BRIEF SUMMARY OF THE INVENTION
• According to one embodiment of the present invention, a method for processing data packets sent over a communication session between a host and a server by a service gateway, comprises: processing a data packet using a hybrid-stateful processing method by the service gateway; checking by the service gateway whether a hybrid-stateless condition is satisfied; in response to determining that the hybrid-stateless condition is satisfied, changing to a hybrid-stateless processing method for a subsequently received data packet by the service gateway; and in response to determining that the hybrid-stateless condition is not satisfied, processing the subsequently received data packet using the hybrid-stateful processing method by the service gateway.
• In another embodiment of the present invention, a method for processing data packets sent over a communication session between a host and a server by a service gateway, comprises: processing a data packet using a hybrid-stateless processing method by the service gateway, wherein the hybrid-stateless processing method processes the data packet using a stateless processing method unless a service address or a server address of the data packet matches a session entry in a session table; checking by the service gateway whether a hybrid-stateful condition is satisfied; in response to determining that the hybrid-stateful condition is satisfied, changing to a hybrid-stateful processing method for a subsequently received data packet by the service gateway, wherein the hybrid-stateful processing method processes the subsequently received data packet using a stateful processing method unless the subsequently received data packet either does not comprise a service request or the subsequently received data packet is received from the server; in response to determining that the hybrid-stateful condition is not satisfied, processing the subsequently received data packet using the hybrid-stateless processing method by the service gateway; wherein the hybrid-stateful processing method comprises: receiving the data packet by the service gateway; determining by the service gateway whether the data packet is received by the service gateway from the host or the server; in response to determining that the data packet is received from the host, determining by the service gateway whether the data packet comprises a service request; in response to determining that the data packet comprises the service request, processing the data packet using the stateful processing method by the service gateway; in response to determining that the data packet is received from the host and does not comprise the service request, processing the data packet using the hybrid-stateless processing method by the service gateway; and in response to determining that the data packet is received from the server, processing the data packet using the hybrid-stateless processing method by the service gateway.
• In one aspect of the present invention, the hybrid-stateless processing method comprises: receiving the subsequently received data packet from the host by the service gateway; obtaining the service address from the subsequently received data packet by the service gateway; comparing the service address of the subsequently received data packet against service addresses stored in session entries in the session table by the service gateway; in response to determining that the session table comprises a session entry matching the service address of the subsequently received data packet, processing the subsequently received data packet based on information stored in the matching session entry using the stateful processing method by the service gateway. In response to determining that the session table does not comprise any session entry matching the service address of the subsequently received data packet: comparing the service address of the subsequently received data packet against service addresses stored in mapping entries in a mapping table by the service gateway, finding a mapping entry matching the service address of the subsequently received data packet by the service gateway, and processing the subsequently received data packet based on information stored in the matching mapping entry using the stateless processing method by the service gateway.
• System and computer program products corresponding to the above-summarized methods are also described and claimed herein.
BRIEF DESCRIPTION OF THE DRAWINGS
• FIG. 1 illustrates a service gateway for processing a communication session between a host and a plurality of servers.
• FIG. 2 illustrates a stateful processing method.
• FIG. 3 illustrates a stateless processing method.
• FIG. 4 illustrates an embodiment of a service gateway performing a hybrid-stateless processing method combining a stateful processing method and a stateless processing method according to the present invention.
• FIG. 5 illustrates an embodiment of a service gateway performing a hybrid-stateful processing method combining a stateful processing method and a stateless processing method according to the present invention.
• FIG. 6 illustrates an embodiment of a service gateway changing from a hybrid-stateful processing method to a hybrid-stateless processing in response to a hybrid-stateless condition being satisfied according to the present invention.
• FIG. 7 illustrates an embodiment of a service gateway changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to a hybrid-stateful condition being satisfied according to the present invention.
• FIG. 8 is a flowchart illustrating an embodiment of a hybrid-stateless processing method according to the present invention.
• FIG. 9 is a flowchart illustrating an embodiment of a hybrid-stateful processing method according to the present invention.
• FIG. 10 is a flowchart illustrating an embodiment of a method for changing from a hybrid-stateful processing method to a hybrid-stateless processing in response to a hybrid-stateless condition being satisfied according to the present invention.
• FIG. 11 is a flowchart illustrating an embodiment of a method for changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to a hybrid-stateful condition being satisfied according to the present invention.
DETAILED DESCRIPTION OF THE INVENTION
• The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. Thus, the present invention is not intended to be limited to the embodiment shown but is to be accorded the widest scope consistent with the principles and features described herein.
• The present invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
• Furthermore, the present invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
• The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.
• A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
• Input/output or I/O devices (including but not limited to keyboards, displays, point devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.
• Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
• The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified local function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
• The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. Embodiments of the present invention provide a security gateway with the capability of processing packets using either a hybrid stateless processing method or a hybrid stateful processing method, and with the capability for assessing conditions in determining whether to switch from using the hybrid stateful processing method to the hybrid stateless processing method or vice versa. Before describing the various embodiments of the present invention, the stateful only and stateless only methods are first described with reference toFIGS. 1 through 3.
• FIG. 1 illustrates aservice gateway110 for processing acommunication session300 between ahost100 and aserver200. A plurality of data packets are sent betweenhost100 andserver200 over thecommunication session300. Theservice gateway110 receives aservice request301 data packet from ahost100 to establishcommunication session300.Service request301 is delivered over adata network153.Service request301 may be a Web service request such as a HTTP (Hypertext Transport Protocol) request, a secure HTTP request, a FTP (File Transfer Protocol) request, a file transfer request, a SIP (Session Initiation Protocol) session request, a request based on Web technology, a video or audio streaming request, a Web conferencing session request, or any request over the Internet, corporate network, data center network, or a network cloud.Service request301 may be a request for a mobile application download, an advertisement delivery request, an e-book delivery request, a collaboration session request, or an on-line newspaper or magazine delivery request.
• Host100 is a computing device with network access capabilities. Host100 may be a workstation, a desktop personal computer or a laptop personal computer. In some embodiments,host100 is a Personal Data Assistant (PDA), a tablet, a smartphone, or a cellular phone. For other examples, host100 may be a set-top box, an Internet media viewer, an Internet media player, a smart sensor, a smart medical device, a net-top box, a networked television set, a networked DVR, a networked Blu-ray player, or a media center.
• Service gateway110 is a computing device operationally coupled to aprocessor113 and a computerreadable medium114 for storing computer readable program code to be executed by theprocessor113.Service gateway110 may be implemented as a server load balancer, an application delivery controller, a service delivery platform, a traffic manager, a security gateway, a component of a firewall system, a component of a virtual private network (VPN), a load balancer for video servers, or a gateway to distribute load to one or more servers.
• Server200 is a computing device operationally coupled to aprocessor213 and a computerreadable medium214 for storing computer readable program code to be executed by theprocessor213. The computer readable program code may implementserver200 as a Web server, a file server, a video server, a database server, an application server, a voice system, a conferencing server, a media gateway, a SIP server, a remote access server, a VPN server, a media center, an app server or a network server providing a network or application service to host100.
• Data network153 may include an Internet Protocol (IP) network.Data network153 may include a corporate data network or a regional corporate data network, an Internet service provider network, a residential data network, a wired network such as Ethernet, a wireless network such as a WiFi network, or cellular network.Data network153 may reside in a data center, or connects to a network or application network cloud.
• Service request301 fromhost100 includes aservice address331, such as an IP address.Service address331 includes an application layer address or a transport layer port number, such as transmission control protocol (TCP) port number or user datagram protocol (UDP) port number.Service address331 is associated withservice gateway110 so thatservice gateway110 processes theservice request301.Service address331 may include a destination IP address ofservice request301, and optionally may include destination transport layer port number ofservice request301.
• Service request301 may include a TCP session request data packet, or a UDP data packet.Service address331 is included in the data packet ofservice request301.
• Service gateway110 determines aserver address321 based onservice address331 obtained fromservice request301.Server address321 is associated withserver200 and may include a network address or IP address ofserver200.Server address321 may include an application layer address, such as a TCP port number or a UDP port number ofserver200.
• Based onserver address321,service gateway110 sends aservice session request306 toserver200. Subsequentlyservice gateway110 receives a response tosession request306 fromserver200 and establishes a server-side service session305 withserver200. Based onsession request306 response,service gateway110 sends aservice request301 response to host100, and establishes a host-side service session302 withhost100 forservice request301.
• Communication session300 includes host-side service session302 and server-side service session305.Service session302 includes one or more data packets fromhost100 forcommunication session300.Service session305 includes one or more data packets fromserver200 forcommunication session300.Service session302 may includeservice request301.
• Upon establishment ofservice session302 andservice session305,service gateway110 subsequently processes adata packet304 ofservice session302 received fromhost100.Data packet304 includesservice address331.Service gateway110 modifiesdata packet304 by replacingservice address331 withserver address321.Service gateway110 sends modifieddata packet304 toserver200.
• Whenservice gateway110 receives adata packet307 ofservice session305 fromserver200,service gateway110processes data packet307.Data packet307 ofservice session305 may includeserver address321.Service gateway110 modifiesdata packet307 by replacingserver address321 withservice address331.Service gateway110 sends modifieddata packet307 to host100.
• There are two common methods inprocessing service session302 and service session305: a stateful processing method and a stateless processing method.FIG. 2 illustrates a stateful processing method. InFIG. 2,service gateway110 maintains a service session table412. Session table412 stores one or more service session entries.Service gateway110 creates asession entry420 forservice session302.Session entry420stores service address331 andserver address321 toassociate service address331 andserver address321.Service gateway110 may createsession entry420 after establishing host-side service session302 and server-side service session306.Service gateway110 may createsession entry420 after receivingservice request301.Service gateway110stores service address331 andserver address321 insession entry420 afterservice gateway110 determines the addresses.Service gateway110stores session entry420 in session table412.
• Service gateway110 includes astorage400 and stores session table412 instorage400.Storage400 is a memory module residing inservice gateway110.Service gateway110 includes a network processing module (not shown) comprising a field programmable gate array (FPGA), a network processor, an application specific integrated circuit (ASIC).Storage400 is associated with the network processing module. Examples ofstorage400 include a content addressable memory (CAM), a ternary content addressable memory (TCAM), a static random accessible memory (SRAM), or a dynamic random accessible memory (DRAM).
• Service gateway110 obtainsservice address331 fromservice request301.Service gateway110 maintains aservice policy471 and determinesserver address321 based onservice policy471.Service policy471 may be based on a relationship betweenserver200 andservice address331.Service policy471 includesservice address331 andserver address321.Service gateway110 selectsservice policy471 based on a match betweenservice address331 obtained fromservice request301 and the service address in theservice policy471.Service gateway110 appliesservice policy471 toservice request301.Service policy471 may include asecurity policy482 where anon-secure service request301 can be sent toserver200.Service policy471 may include atraffic policy483, whereservice request301 is served byserver200 when traffic load toserver200 is low.Service request301 may be received from a predetermined network interface ofservice gateway110 andtraffic policy483 indicates thatservice request301 from the network interface should be sent toserver200.
• Server240 also servesservice request301.Service policy471 may include aserver load policy484 indicating thatservice request301 is to be sent toserver200 when server load ofserver240 is high. In one example,service policy471 includes aserver availability policy485 indicating thatservice request301 is to be sent toserver200, whereserver200 is a back-up server toserver240, andserver240 is not available.Service policy471 may include a load balancing policy486 betweenserver200 andserver240.Service gateway110 selectsserver200 using the load balancing policy486, which may include a round robin or another load balancing scheme.Service policy471 may include ahost policy487 indicating thatservice request301 is to be sent toserver200 whenhost100 satisfieshost policy487.
• Afterservice gateway110 appliesservice policy471 toservice request301,service gateway110 retrievesserver address321 fromservice policy471.Service gateway110 createssession entry420 withservice address331 andserver address321, associatingservice address331 andserver address321.Service gateway110stores session entry420 in session table412.
• Service gateway110 uses session table412 to processdata packet304 received fromhost100, anddata packet307 received fromserver200. Whenservice gateway110 receivesdata packet304 fromhost100,service gateway110 obtainsservice address331 fromdata packet304.Service gateway110 compares the obtainedservice address331 against service addresses stored in session table412. Whenservice gateway110 determines there is a match between the obtainedservice address331 andsession entry420 in session table412,service gateway110 uses information stored insession entry420 to processdata packet304.Service gateway110 modifiesdata packet304 by replacingservice address331 withserver address321, whereserver address321 is obtained from the matchedsession entry420.Service gateway110 sends modifieddata packet304 toserver200.
• Service request301 may include ahost address104 associated withhost100.Service gateway110 retrieveshost address104 fromservice request301.Service gateway110 may use retrievedhost address104 when applyingservice policy471.Service gateway110 stores hostaddress104 inservice session entry420.Data packet304 may includehost address104.Service gateway110 obtainshost address104 fromdata packet304 and compares the obtainedhost address104 against addresses stored in session table412 andsession entry420.
• Whenservice gateway110 receives adata packet307 of server-side service session305 fromserver200,service gateway110 retrievesserver address321 fromdata packet307.Service gateway110 compares the obtainedserver address321 against addresses stored in session table412, and determines there is a match withsession entry420. In response to determining there is a match,service gateway110 usessession entry420 to processdata packet307.Service gateway110 modifiesdata packet307 by replacingserver address321 withservice address331, which is retrieved from the matchedsession entry420.Service gateway110 sends modifieddata packet307 to host100.
• Data packet307 may includehost address104.Service gateway110 obtainshost address104 fromdata packet307 and uses the obtainedhost address104 in comparing against addresses stored in session table412 andsession entry420.
• Data packet304 received fromservice session302 may indicate a session termination request. For example,data packet304 is a TCP FIN packet, a TCP RESET packet.Service gateway110 inspectsdata packet304 content and determinesdata packet304 includes a session termination request. In response,service gateway110 removessession entry420 from session table412.Service gateway110 may removesession entry420 after processingdata packet304 or waits for a pre-determined period of time before removingsession entry420.
• The processing method illustrated inFIG. 2 is often referred as a stateful processing method. A stateful processing method allowsservice gateway110 to apply one or more service policies to selectserver200. The service policies may include security policies and other policies to protectserver200.Security policy482 may causeservice request301 to be declined if a security concern is detected. Such security consideration is known to those skilled in the art and is not described in this application. Applyingtraffic policy483 orserver load policy484 can also protectserver200 from overloading. Enforcing the service policies often improves service response time ofserver200 to servehost100.
• However, applyingservice policy471 toservice request301 requires computation resource ofservice gateway110, such as CPU cycles. Such computation requirement may post a limitation on the ability ofservice gateway110 to provide services whenservice gateway110 receives and processes a large number of service requests over a short period of time.
• For example, session table412 has a certain capacity limit, such as 4 GB, 2000 entries, up to 10000 entries or 200 MB. The greater the number of service sessions serviced byservice gateway110 using a stateful processing method, the greater the number of session entries stored in session table412. The capacity of session table412 may become a severe limitation to the servicing capabilities ofservice gateway110.
• FIG. 3 illustrates a stateless processing method. In this method,service gateway110 does not use session table412. Instead,service gateway110 maintains and uses a service mapping table452. Service mapping table452 is stored instorage400. Service mapping table452 includes aservice mapping entry460.Mapping entry460 may includeservice address331 andserver address321, associatingservice address331 andserver address321. According to theservice mapping entry460,server200 withserver address321 serveshost100 forservice address331.
• Whenservice gateway110 receives adata packet304 fromhost100,service gateway110 obtainsservice address331 fromdata packet304, and comparesservice address331 with service addresses stored in service mapping table452. Whenservice gateway110 determines there is a match withmapping entry460,service gateway110 retrievesserver address321 frommapping entry460.Service gateway110 modifiesdata packet304 by replacingservice address331 withserver address321.Service gateway110 sends modifieddata packet304 toserver200.
• Whenservice gateway110 receives adata packet307 fromserver200,service gateway110processes data packet307 using service mapping table452.Service gateway110 obtainsserver address321 fromdata packet307.Service gateway110 comparesserver address321 against server addresses stored in service mapping table452. Whenservice gateway110 determines there is a match withmapping entry460,service gateway110 retrievesservice address331 frommapping entry460, and modifiesdata packet307 by replacingserver address321 withservice address331. Subsequentlyservice gateway110 sends modifieddata packet307 to host100.
• Service gateway110 may matchservice address331 orserver address321 against service mapping table452 using a hash method. Service mapping table452 includes a hash table using a hash function (HashFunc)571.Mapping entry460 is associated with a hash value (HashValue581).
• HashValue581 includes the result of applyingHashFunc571 toservice address331.HashValue581 may include the result of applyingHashFunc571 toserver address321.
• HashValue581 may include an index ofmapping entry460 in service mapping table452.Mapping entry460 occupies an entry in service mapping table452 indexed byHashValue581. For example, service mapping table452 contains 1000 entries where the indices are 1-1000, andmapping entry460 has an index of 894. In another example, service mapping table452 contains 16 entries andmapping entry460 has an index of 7.
• Service gateway110 appliesHashFunc571 toservice address331 ofdata packet304 to obtainHashValue581. Assume thatservice gateway110 searches service mapping table452 for an entry withindex HashValue581 and findsmapping entry460. Fordata packet307,service gateway110 appliesHashFunc571 toserver address321 ofdata packet307 to obtainHashValue581.Service gateway110 searches service mapping table452 for an entry withindex HashValue581 and findsmapping entry460.
• Mapping entry460 may includeHashValue581. Afterservice gateway110 applieshash function HashFunc571 to obtainHashValue581,service gateway110 searches service mapping table452 and findsmapping entry460 containing anindex matching HashValue581.
• Examples of hash functionsHashFunc571 include CRC checksum functions and other checksum functions; hash functions using a combination of bit-wise operators such as bit-wise AND operator, bit-wise OR operator, bit-wise NAND operator and bit-wise XOR operator; MD5 hash functions and other cryptography hash functions; Jenkins hash function and other non-cryptography hash functions; hardware based hash functions implemented in FPGA, ASIC or an integrated circuit board ofservice gateway110; and other types of hash functions or table lookup functions. Typically such hash functions are simple and can be calculated rapidly byservice gateway110.
• Data packet304 includeshost address104 associated withhost100.Service gateway110 obtainshost address104 fromdata packet304 and uses the obtainedhost address104 in the processing ofdata packet304.
• Data packet307 includeshost address104. Service gateway obtainshost address104 fromdata packet307 and uses the obtainedhost address104 in the processing ofdata packet307.
• Typically,mapping entry460 is configured by a service provider or an administrator of a service provider.Mapping entry460 may be configured whenserver200 becomes available, or whenserver address321 orservice address331 becomes available.Server address321 orservice address331 may be configured by the service provider to become available.
• In this stateless processing method, service mapping table452 is not related to the number of service sessions processed byservice gateway110. The capacity of service mapping table452 is related to the number of available service addresses and server addresses. Such capacity is usually small. Service mapping tables452 may have a few tens of entries or a few thousand entries.
• The advantages of a stateless processing method include small resource requirement for service mapping table452, a minimal or no computational requirement to handleservice request301, or no requirements to applyservice policy471. A stateless processing method is usually preferred over a stateful processing method whenservice gateway110 receives a large number of service session requests in a short period of time, or under a heavy load of service requests. A stateless method is also preferred when the memory capacity of session table for new sessions is running low, say below 10% of the session table412. A stateless method protectsservice gateway110 from resource overload and therefore maintains service quality towardshost100 under stressful situations.
• However, a stateless processing method may be less desirable than a stateful processing method due to security concerns, sinceservice gateway110 does not applysecurity policy482. Similarlyservice gateway110 does not apply any other policy inservice policy471, affecting security ofserver200, security ofdata network153, traffic condition ofdata network153, and service quality rendered to host100. A stateful processing method is also preferred over the stateless processing method whenservice gateway110 may selectserver address321 from a plurality of server addresses. For example, a service provider may configure a plurality of servers to serveservice address331 in a load balancing manner. A service provider may configure a backup server forservice address331.
• In a typical deployment scenario, a service provider may use a stateful processing method for a first service address while using a stateless processing method for a different second service address. The service provider does not expect the first service to have significant traffic or usage. The service provider may not expect the second service to be a security concern. In reality, the first service may see a sudden surge of traffic due to an unforeseen situation, whereas the second service may suffer a security attack. Using a hybrid processing method according to the present invention, as described below, a service provider may combine a stateful processing method for the first service when the load is light and change to a stateless processing method when the load becomes heavy; and may deploy a hybrid processing method to combine a stateless processing method for the second service during normal circumstances and switch immediately to a stateful processing method when a security alert is detected for the second service.
• The various embodiment of the present invention are now described with reference toFIGS. 4 through 11.
• FIG. 4 illustrates an embodiment of aservice gateway110 performing a hybrid-stateless processing method combining a stateful processing method and a stateless process method according to the present invention.FIG. 8 is a flowchart illustrating an embodiment of a hybrid-stateless processing method according to the present invention. In this embodiment, the computerreadable medium114 of theservice gateway110 stores computer readable program code, which when executed byprocessor113, implements the various embodiment of the present invention.Service gateway110 maintains session table412 and service mapping table452 instorage400. In this embodiment of a hybrid-stateless processing method,service gateway110 processes a receiveddata packet304 with a stateless method using service mapping table452 when the service address of the receiveddata packet304 does not match any service addresses stored in session table412.
• Service gateway110 connects toserver200 andserver240.Server200 is associated withserver address321.Server240 is associated withserver address324.Service gateway110 is associated withservice address331 and service address334.
• In some embodiments, session table412 includes asession entry420 which storesservice address331 andserver address321, associatingservice address331 andserver address321. Service mapping table452 includes amapping entry462 which stores service address334 andserver address324, associating service addresses334 and324.
• In various embodiments,server200 may be the same asserver240.Server address321 may be the same asserver address324.Service address331 may be the same as service address334.
• Referring to bothFIGS. 4 and 8,service gateway110 receives adata packet304 from host100 (801).Service gateway110 obtainsservice address336 from data packet304 (802).Service gateway110 comparesservice address336 ofdata packet304 against service addresses stored in session table412 (803).
• In some embodiments,service gateway110 finds a match insession entry420, whereservice address336matches service address331 of session entry420 (804). In response to finding the match,service gateway110processes data packet304 based on information stored insession entry420 using a stateful processing method (805), such as the one described above with reference toFIG. 2.
• Whenservice gateway110 does not find a match in session table412 (804),service gateway110 comparesservice address336 ofdata packet304 against service addresses in service mapping table452 (806). Ifservice gateway110 finds a match inmapping entry462 of service mapping table452, whereinservice address336matches service address324 of mapping entry462 (807),service gateway110processes data packet304 based on information stored inmapping entry462 using a stateless processing method (808), such as the one described above with reference toFIG. 3.
• In various embodiments,service gateway110 receives adata packet307 from server200 (830).Service gateway110extracts server address321 from data packet307 (831) and comparesserver address321 ofdata packet307 against server addresses stored in session table412 (832). Whenservice gateway110 finds a match insession entry420, withserver address321 ofdata packet307matching server address321 of session entry420 (803),service gateway110processes data packet308 using the stateful processing method (805), as described above with reference toFIG. 2.
• In some embodiments,service gateway110 receives adata packet308 from server240 (830).Service gateway110extracts server address324 from data packet308 (832) and comparesserver address324 ofdata packet308 against server addresses stored in session table412 (832). Whenservice gateway110 does not find a match (833),service gateway110 comparesserver address324 ofdata packet308 against server addresses stored in service mapping table452 (834) and finds a match inmapping entry462, whereserver address324 ofdata packet308matches server address324 of mapping entry462 (807). In response,service gateway110 modifiesdata packet308 based on information stored inmapping entry462 using a stateless processing method (808).Service gateway110 sends modifieddata packet308.
• FIG. 5 illustrates an embodiment of aservice gateway110 performing a hybrid-stateful processing method combining a stateful processing method and a stateless processing method according to the present invention.FIG. 9 is a flowchart illustrating an embodiment of the hybrid-stateful processing method according to the present invention. Referring to bothFIGS. 5 and 9,service gateway110 receives adata packet304 from host100 (901). In some embodiments,service gateway110 determines thatdata packet304 includes aservice request301 from host100 (902). In response,service gateway110 applies a stateful processing method to service request301 (903).Service gateway110 performs the stateful processing method, including applyingservice policy471 toservice request301, creatingsession entry420 usingservice address331 ofservice request301 andserver address321 ofservice policy471, as described above with reference toFIG. 2.
• In various embodiments,service gateway110 determinesdata packet304 does not include a service request (902). In response,service gateway110processes data packet304 using the hybrid-stateless processing method, as described above with reference toFIG. 4.
• In other embodiments,service gateway110 receives adata packet307 from server200 (901). In this embodiment of a hybrid-stateful processing method,service gateway110 applies a hybrid-stateless processing method to data packet307 (904), as described above with reference toFIG. 4.
• FIGS. 6 and 10 illustrate an embodiment of a service gateway and a method, respectfully, for changing from a hybrid-stateful processing method to a hybrid-stateless processing method in response to a hybrid-stateless condition being satisfied according to the present invention. Referring to bothFIGS. 6 and 10,service gateway110 is using a hybrid-stateful processing method (1001).Service gateway110 maintains a hybrid-stateless condition810.Service gateway110 checks if hybrid-stateless condition810 is satisfied (1002). In response to determining that the hybrid-stateless condition810 is satisfied (1003),service gateway110 changes to a hybrid-stateless processing method (1004). Theservice gateway110 processes the next data packet received using the hybrid-stateless processing method, as described above with reference toFIGS. 4 and 8. In response to determining that the hybrid-stateless condition810 is not satisfied (1003), theservice gateway110 continues using the hybrid-stateful processing method (1005), as described above with reference toFIGS. 5 and 9.
• In some embodiments, hybrid-stateless condition810 includes asession rate811. For example,session rate811 is 10 thousand sessions per second, 5 thousand active sessions per second, or one hundred sessions per 10 milliseconds.
• In various embodiments,service gateway110 calculates asession rate821.Session rate821 can be calculated based on a count of active host-side service sessions over a period of time. When the service session is associated with a session entry in session table412, a service session is active. In various embodiments,session rate821 calculates a difference between a count of received service requests and a count of received service termination requests over a period of time. In other embodiments,session rate821 calculates a count of service requests received over a period of time.
• In some embodiments,service gateway110 calculates asession rate821 in a predetermined period of time, such as every second, once every 250 milliseconds, once every 3 seconds or once every 10 seconds. In other embodiments,service gateway110 calculatessession rate821 at variable times. For example,service gateway110 calculatessession rate821 when a data packet from a host is received; when a service request is received; when a service termination request is received; or when a data packet is received fromserver200.Service gateway110 comparessession rate821 withsession rate811 of hybrid-stateless condition810. Ifsession rate821 exceeds or is equal tosession rate811,service gateway110 determines that hybrid-stateless condition810 is met and satisfied.
• In various embodiments, hybrid-stateless condition810 includes asession table utilization814. A session table utilization is a parameter setting forth a percentage of the session table capacity that is storing session entries. Hybrid-stateless condition810 is satisfied if a count of stored session entries of session table412 exceedssession table utilization814. For example,session table utilization814 is 90%, 85% or 95%.Service gateway110 calculates asession table utilization824 from time to time by calculating a count of stored session entries of session table412. In some embodiments,service gateway110 calculatessession table utilization824 periodically, such as every second, once every 20 milliseconds, once every 500 milliseconds, or once every 2 seconds. In other embodiments,service gateway110 calculatessession table utilization824 whenservice gateway110 processes a service request, a service termination request, or a data packet.
• Service gateway110 comparessession table utilization824 withsession table utilization814 of hybrid-stateless condition810. Whensession table utilization824 exceeds or is equal tosession table utilization814,service gateway110 determines that hybrid-stateless condition810 is met and satisfied.
• In some embodiments, hybrid-stateless condition810 further includes atime duration816, where hybrid-stateless condition810 must be considered met for at least atime duration816 in order for the hybrid-stateless condition810 to be satisfied. Examples oftime duration816 include 120 seconds, 30 seconds, and 5 seconds.Service gateway110 checks from time to time whether the hybrid-stateless condition810 is met, as described earlier. In various embodiments,service gateway110 further includes atime duration826 stored in memory. Initially,service gateway110 assigns a value of 0 to thetime duration826. From time to time,service gateway110 checks if hybrid-stateless condition810 is met. If hybrid-stateless condition810 is met,service gateway110 increases thetime duration826 by an amount of time elapsed since the last time the hybrid-stateless condition810 was checked. After thetime duration826 is modified,service gateway110 checks if thetime duration826 exceedstime duration816. Iftime duration826 exceedstime duration816,service gateway110 determines that hybrid-stateless condition810 is satisfied.Service gateway110 subsequently changes to employ a hybrid-stateless method with subsequently received data packets.
• Ifservice gateway110 determines hybrid-stateless condition810 is not met,service gateway110 modifies thetime duration826 to a value of 0.
• In some embodiments,service gateway110 receives hybrid-stateless condition810 from an operator or anadministrator130.Administrator130 can be a human operator provisioning hybrid-stateless condition810 ontoservice gateway110.Administrator130 can be a network management system sending hybrid-stateless condition810 toservice gateway110.Administrator130 may include a storage medium storing hybrid-stateless condition810.Service gateway110 retrieves hybrid-stateless condition810 from the storage ofadministrator130.
• FIGS. 7 and 11 illustrate an embodiment of a service gateway and a method, respectfully, for changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to a hybrid-stateful condition being satisfied according to the present invention. Referring to bothFIGS. 7 and 11,service gateway110 employs a hybrid-stateless processing method (1101)Service gateway110 maintains a hybrid-stateful condition910.Service gateway110 checks if hybrid-stateful condition910 is satisfied (1102). In response to determining that the hybrid-stateful condition910 is satisfied (1103),service gateway110 changes to a hybrid-stateful processing method (1104) and processes the next data packet using the hybrid-stateful processing method, described above with reference toFIGS. 5 and 9. In response to determining that the hybrid-stateful condition910 is not satisfied (1103),service gateway110 continues using the hybrid-stateless processing method (1105) and processes the next data packet using the hybrid-stateless processing method, as described above with reference toFIGS. 4 and 8.
• In some embodiments, hybrid-stateful condition910 includes asession rate911. For example,session rate911 is 1 thousand sessions per second, 500 active sessions per second, or ten sessions per 10 milliseconds.
• Service gateway110 can calculate asession rate921. In some embodiments,session rate921 calculates a difference between a count of received service requests and a count of received service termination requests over a period of time.Session rate921 may also calculate a count of service requests received over a period of time. In various embodiments,service gateway110 determines if a data packet received from a host includes a service request before applying a hybrid-stateless processing method to the received data packet.Service gateway110 may also determine if a data packet received from a host or a server includes a service termination request before applying a hybrid-stateless processing method to the received data packet.
• In some embodiments,service gateway110 calculatessession rate921 in a predetermined period of time, such as every second, once every 100 milliseconds, once every 3 seconds, or once every 5 seconds.Service gateway110 may also calculatesession rate921 at variable times. For example,service gateway110 calculatessession rate921 when a data packet from a host is received; when a service request is received; when a service termination request is received; or when a data packet is received from a server.Service gateway110 comparessession rate921 withsession rate911. Ifsession rate921 is below or smaller thansession rate911,service gateway110 determines that hybrid-stateful condition910 is met and satisfied.
• In various embodiments, hybrid-stateful condition910 includes asession table utilization914. Hybrid-stateful condition910 is satisfied if a count of stored session entries of session table412 does not exceedsession table utilization914. For example,session table utilization914 is 60%, 75% or 45%.Service gateway110 calculatessession table utilization924 from time to time by calculating a count of stored session entries of session table412. In some embodiments,service gateway110 calculatessession table utilization924 periodically, such as every second, once every 20 milliseconds, once every 500 milliseconds, or once every 2 seconds.Service gateway110 may also calculatesession table utilization924 whenservice gateway110 processes a service request, a service termination request, or a data packet.
• Service gateway110 comparessession table utilization924 withsession table utilization914 of hybrid-stateful condition910. Ifsession table utilization924 is smaller thansession table utilization914,service gateway110 determines that hybrid-stateful condition910 is met and satisfied.
• Hybrid-stateful condition910 may further include atime duration916, where hybrid-stateful condition910 must be considered met for at least atime duration916 in order for the hybrid-stateful condition910 is satisfied. Examples oftime duration916 include 100 seconds, 40 seconds, and 5 seconds.Service gateway110 checks from time to time if the hybrid-stateful condition910 is met as described earlier. In some embodiments,service gateway110 further includes atime duration926 stored in memory. Initially,service gateway110 assigns a value of 0 to thetime duration926. From time to time,service gateway110 determines if hybrid-stateful condition910 is met. If hybrid-stateful condition910 is met,service gateway110 increases thetime duration926 by an amount of time elapsed since the last time the hybrid-stateful condition910 was checked. In various embodiments, after thetime duration926 is modified,service gateway110 checks if thetime duration926 exceedstime duration916. Iftime duration926 exceedstime duration916,service gateway110 determines hybrid-stateful condition910 is satisfied.Service gateway110 subsequently changes to employ a hybrid-stateful method with subsequently received data packets.
• In some embodiments,service gateway110 receives hybrid-stateful condition910 from an operator or anadministrator130.Administrator130 can be a human operator provisioning hybrid-stateful condition910 ontoservice gateway110.Administrator130 can be a network management system sending hybrid-stateful condition910 toservice gateway110.Administrator130 can include a storage medium storing hybrid-stateful condition910.Service gateway110 retrieves hybrid-stateful condition910 from the storage ofadministrator130.
• Returning toFIG. 8,FIG. 8 shows that when theservice gateway110 is processing data packets using the stateful processing method (805), theservice gateway110 would check whether the hybrid-stateless condition801 is met (seeFIG. 10).FIG. 8 also shows that when theservice gateway110 is processing data packets using the stateless processing method (808), theservice gateway110 would check whether the hybrid-stateful condition910 is met (seeFIG. 11). However, the references (C and D) toFIGS. 10 and 11 are not intended to convey any order of steps. The checking of theconditions810 or910 may occur concurrently with the processing of data packets, as described above with reference toFIGS. 4 and 8.
• Returning toFIG. 9,FIG. 9 shows that when theservice gateway110 is processing data packets using the stateful processing method (903), theservice gateway110 would check whether the hybrid-stateless condition810 is met (seeFIG. 10).FIG. 9 also shows that when theservice gateway110 is processing data packets using the hybrid-stateless processing method (904), theservice gateway110 would either check if the hybrid-stateless condition810 or the hybrid-stateful condition910 is met (seeFIGS. 10 and 11), depending on the processing during the hybrid states processing method perFIGS. 4 and 8. However, the reference toFIGS. 10 (C) and11 (D) are not intended to convey any order of steps. The checking of theconditions810 or910 may occur concurrently with the processing of data packets as illustrated inFIGS. 5 and 9.
• Although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.

Claims (15)

What is claimed is:

1. A method for processing data packets sent over a communication session between a host and a server by a service gateway, comprising:

processing a data packet using a hybrid-stateful processing method by the service gateway;

checking by the service gateway whether a hybrid-stateless condition is satisfied;

in response to determining that the hybrid-stateless condition is satisfied, changing to a hybrid-stateless processing method for a subsequently received data packet by the service gateway; and

in response to determining that the hybrid-stateless condition is not satisfied, processing the subsequently received data packet using the hybrid-stateful processing method by the service gateway.

2. The method ofclaim 1, wherein the checking by the service gateway whether the hybrid-stateless condition is satisfied comprises:

comparing a time duration stored in memory against a predetermined time duration by the service gateway;

determining whether the time duration stored in memory exceeds the predetermined time duration;

in response to determining that the time duration stored in memory exceeds the predetermined time duration, determining by the service gateway that the hybrid-stateless condition is satisfied; and

in response to determining that the time duration stored in memory does not exceed the predetermined time duration, determining by the service gateway that the hybrid-stateless condition is not satisfied.

3. The method ofclaim 1, wherein the checking by the service gateway whether a hybrid-stateless condition is satisfied comprises receiving from an administrator the hybrid-stateless condition by the service gateway.

4. The method ofclaim 3, wherein the administrator comprises:

a human operator;

a network management system; or

a storage medium storing the hybrid-stateless condition.

5. A system, comprising:

a service gateway comprising a processor and a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code configured to:

process a data packet using a hybrid-stateful processing method;

check whether a hybrid-stateless condition is satisfied;

in response to determining that the hybrid-stateless condition is satisfied, change to a hybrid-stateless processing method for a subsequently received data packet; and

in response to determining that the hybrid-stateless condition is not satisfied, process the subsequently received data packet using the hybrid-stateful processing method.

6. The system ofclaim 5, wherein the check whether a hybrid-stateless condition is satisfied comprises:

compare a time duration stored in memory against a predetermined time duration by the service gateway

determine whether the time duration stored in memory exceeds the predetermined time duration;

in response to determining that the time duration stored in memory exceeds the predetermined time duration, determine by the service gateway that the hybrid-stateless condition is satisfied; and

in response to determining that the time duration stored in memory does not exceed the predetermined time duration, determine by the service gateway that the hybrid-stateless condition is not satisfied.

7. The system ofclaim 5, wherein the check whether a hybrid-stateless condition is satisfied comprises receiving from an administrator the hybrid-stateless condition by the service gateway.

8. The system ofclaim 7, wherein the administrator comprises:

a human operator;

a network management system; or

a storage medium storing the hybrid-stateless condition.

9. A method for processing data packets sent over a communication session between a host and a server by a service gateway, comprising:

processing a data packet using a hybrid-stateless processing method by the service gateway;

checking by the service gateway whether a hybrid-stateful condition is satisfied;

in response to determining that the hybrid-stateful condition is satisfied, changing to a hybrid-stateful processing method for a subsequently received data packet by the service gateway; and

in response to determining that the hybrid-stateful condition is not satisfied, processing the subsequently received data packet using the hybrid-stateless processing method by the service gateway.

10. The method ofclaim 9, wherein the hybrid-stateful condition comprises a predetermined session rate, wherein the checking by the service gateway whether the hybrid-stateful condition is satisfied comprises:

calculating a session rate for a plurality of communication sessions received by the service gateway;

determining whether the calculated session rate is less than the predetermined session rate by the service gateway;

in response to determining that the calculated session rate is less than the predetermined session rate, determining by the service gateway that the hybrid-stateful condition is satisfied; and

in response to determining that the calculated session rate is greater than or equals the predetermined session rate, determining by the service gateway that the hybrid-stateful condition is not satisfied.

11. The method ofclaim 10, wherein the calculated session rate comprises:

a difference between a count of received service requests and a count of received service termination requests over a predetermined period of time or

a count of service requests over the predetermined period of time.

12. The method ofclaim 9, wherein the hybrid-stateful condition comprises a predetermined session table utilization, wherein the checking by the service gateway whether a hybrid-stateful condition is satisfied comprises:

counting a number of stored session entries in the session table by the service gateway;

determining whether the number of stored session entries does not exceed the predetermined session table utilization by the service gateway;

in response to determining that the number of stored session entries does not exceed the predetermined session table utilization, determining by the service gateway that the hybrid-stateful condition is satisfied; and

in response to determining that the number of stored session entries exceeds the predetermined session table utilization, determining by the service gateway that the hybrid-stateful condition is not satisfied.

13. The method ofclaim 9, wherein the checking by the service gateway whether the hybrid-stateful condition is satisfied comprises:

comparing a time duration stored in memory against a predetermined time duration by the service gateway

determining whether the time duration stored in memory exceeds the predetermined time duration;

in response to determining that the time duration stored in memory exceeds the predetermined time duration, determining by the service gateway that the hybrid-stateful condition is satisfied; and

in response to determining that the time duration stored in memory does not exceed the predetermined time duration, determining by the service gateway that the hybrid-stateful condition is not satisfied.

14. The method ofclaim 13, wherein the checking by the service gateway whether a hybrid-stateful condition is satisfied comprises receiving from an administrator the hybrid-stateful condition by the service gateway.

15. The method ofclaim 14, wherein the administrator comprises:

a human operator;

a network management system; or

a storage medium storing the hybrid-stateful condition.

Images