US9270774B2

US9270774B2 - Combining stateless and stateful server load balancing

Info

Publication number: US9270774B2
Application number: US14/520,126
Authority: US
Inventors: Rajkumar Jalan; Feilong Xu; Lalgudi Narayanan KANNAN; Ronald Wai Lun Szeto
Original assignee: A10 Networks Inc
Current assignee: A10 Networks Inc
Priority date: 2011-10-24
Filing date: 2014-10-21
Publication date: 2016-02-23
Anticipated expiration: 2031-10-24
Also published as: US20150039671A1; EP2772026B1; CN104067569B; WO2013070391A1; EP2772026A4; KR101632187B1; US9906591B2; JP2015507380A; CN104067569A; US8897154B2; US10484465B2; US20180124169A1; KR20140088172A; EP2772026A1; US20130100958A1; IN2014CN03764A; JP5913609B2; US20160156708A1; HK1198565A1

Abstract

The processing of data packets sent over a communication session between a host and a server by a service gateway includes processing a data packet using a current hybrid-stateful or hybrid-stateless processing method. The processing then checks whether a hybrid-stateless or hybrid-stateful condition is satisfied. When one of the sets of conditions is satisfied, the process includes changing from a hybrid-stateful to a hybrid-stateless processing method, or vice versa, for a subsequently received data packet. If the conditions are not satisfied, the process continues as originally structured.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of and claims the priority benefit of U.S. patent application Ser. No. 13/280,336 filed on Oct. 24, 2011, and issued on Nov. 25, 2014 as U.S. Pat. No. 8,897,154, entitled “Combining Stateless and Stateful Server Load Balancing,” the disclosure of which is incorporated herein by reference.

BACKGROUND OF THE INVENTION

1. Field

This invention relates generally to data communications, and more specifically, to a service gateway.

2. Related Art

Demand for data communication services for consumer and corporate computing devices has been rapidly increasing. Service providers deploy service gateways such as server load balancers or traffic managers to bridge host computers or computing devices with servers providing the data services.

Service gateways provide services either using a stateful processing method or a stateless processing method. Generally, in a stateful processing method, packets are processed as a stream of packets, and each packet in the stream are processed in the same way. In a stateless processing method, packets are processed discretely, where each packet is assessed individually. The stateful processing method may be preferred over the stateless processing method due to the security and control features that may be implemented, however, the resource requirements of such features may make the services difficult to scale. The stateless processing method may be preferred over the stateful processing method due to its scalability, however, this is at the expense of security and control.

Traffic managed by service gateways is rarely uniform, as conditions on a network typically fluctuate, at times greatly. Currently, system administrators are required to choose either a stateful processing method or a stateless processing method for a particular service address, weighing the costs and benefits of each method. System administrators are not able to realize the advantages of both processing methods for such non-uniform traffic.

BRIEF SUMMARY OF THE INVENTION

According to one embodiment of the present invention, a method for processing data packets sent over a communication session between a host and a server by a service gateway, comprises: processing a data packet using a hybrid-stateful processing method by the service gateway; checking by the service gateway whether a hybrid-stateless condition is satisfied; in response to determining that the hybrid-stateless condition is satisfied, changing to a hybrid-stateless processing method for a subsequently received data packet by the service gateway; and in response to determining that the hybrid-stateless condition is not satisfied, processing the subsequently received data packet using the hybrid-stateful processing method by the service gateway.

In another embodiment of the present invention, a method for processing data packets sent over a communication session between a host and a server by a service gateway, comprises: processing a data packet using a hybrid-stateless processing method by the service gateway, wherein the hybrid-stateless processing method processes the data packet using a stateless processing method unless a service address or a server address of the data packet matches a session entry in a session table; checking by the service gateway whether a hybrid-stateful condition is satisfied; in response to determining that the hybrid-stateful condition is satisfied, changing to a hybrid-stateful processing method for a subsequently received data packet by the service gateway, wherein the hybrid-stateful processing method processes the subsequently received data packet using a stateful processing method unless the subsequently received data packet either does not comprise a service request or the subsequently received data packet is received from the server; in response to determining that the hybrid-stateful condition is not satisfied, processing the subsequently received data packet using the hybrid-stateless processing method by the service gateway; wherein the hybrid-stateful processing method comprises: receiving the data packet by the service gateway; determining by the service gateway whether the data packet is received by the service gateway from the host or the server; in response to determining that the data packet is received from the host, determining by the service gateway whether the data packet comprises a service request; in response to determining that the data packet comprises the service request, processing the data packet using the stateful processing method by the service gateway; in response to determining that the data packet is received from the host and does not comprise the service request, processing the data packet using the hybrid-stateless processing method by the service gateway; and in response to determining that the data packet is received from the server, processing the data packet using the hybrid-stateless processing method by the service gateway.

In one aspect of the present invention, the hybrid-stateless processing method comprises: receiving the subsequently received data packet from the host by the service gateway; obtaining the service address from the subsequently received data packet by the service gateway; comparing the service address of the subsequently received data packet against service addresses stored in session entries in the session table by the service gateway; in response to determining that the session table comprises a session entry matching the service address of the subsequently received data packet, processing the subsequently received data packet based on information stored in the matching session entry using the stateful processing method by the service gateway. In response to determining that the session table does not comprise any session entry matching the service address of the subsequently received data packet: comparing the service address of the subsequently received data packet against service addresses stored in mapping entries in a mapping table by the service gateway, finding a mapping entry matching the service address of the subsequently received data packet by the service gateway, and processing the subsequently received data packet based on information stored in the matching mapping entry using the stateless processing method by the service gateway.

System and computer program products corresponding to the above-summarized methods are also described and claimed herein.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a service gateway for processing a communication session between a host and a plurality of servers.

FIG. 2 illustrates a stateful processing method.

FIG. 3 illustrates a stateless processing method.

FIG. 4 illustrates an embodiment of a service gateway performing a hybrid-stateless processing method combining a stateful processing method and a stateless processing method according to the present invention.

FIG. 5 illustrates an embodiment of a service gateway performing a hybrid-stateful processing method combining a stateful processing method and a stateless processing method according to the present invention.

FIG. 6 illustrates an embodiment of a service gateway changing from a hybrid-stateful processing method to a hybrid-stateless processing in response to a hybrid-stateless condition being satisfied according to the present invention.

FIG. 7 illustrates an embodiment of a service gateway changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to a hybrid-stateful condition being satisfied according to the present invention.

FIG. 8 is a flowchart illustrating an embodiment of a hybrid-stateless processing method according to the present invention.

FIG. 9 is a flowchart illustrating an embodiment of a hybrid-stateful processing method according to the present invention.

FIG. 10 is a flowchart illustrating an embodiment of a method for changing from a hybrid-stateful processing method to a hybrid-stateless processing in response to a hybrid-stateless condition being satisfied according to the present invention.

FIG. 11 is a flowchart illustrating an embodiment of a method for changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to a hybrid-stateful condition being satisfied according to the present invention.

DETAILED DESCRIPTION OF THE INVENTION

The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. Thus, the present invention is not intended to be limited to the embodiment shown but is to be accorded the widest scope consistent with the principles and features described herein.

The present invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.

Furthermore, the present invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W) and DVD.

A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.

Input/output or I/O devices (including but not limited to keyboards, displays, point devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.

Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified local function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. Embodiments of the present invention provide a security gateway with the capability of processing packets using either a hybrid stateless processing method or a hybrid stateful processing method, and with the capability for assessing conditions in determining whether to switch from using the hybrid stateful processing method to the hybrid stateless processing method or vice versa. Before describing the various embodiments of the present invention, the stateful only and stateless only methods are first described with reference to FIGS. 1 through 3.

FIG. 1 illustrates a service gateway 110 for processing a communication session 300 between a host 100 and a server 200. A plurality of data packets are sent between host 100 and server 200 over the communication session 300. The service gateway 110 receives a service request 301 data packet from a host 100 to establish communication session 300. Service request 301 is delivered over a data network 153. Service request 301 may be a Web service request such as a HTTP (Hypertext Transport Protocol) request, a secure HTTP request, a FTP (File Transfer Protocol) request, a file transfer request, a SIP (Session Initiation Protocol) session request, a request based on Web technology, a video or audio streaming request, a Web conferencing session request, or any request over the Internet, corporate network, data center network, or a network cloud. Service request 301 may be a request for a mobile application download, an advertisement delivery request, an e-book delivery request, a collaboration session request, or an on-line newspaper or magazine delivery request.

Host

100 is a computing device with network access capabilities. Host 100 may be a workstation, a desktop personal computer or a laptop personal computer. In some embodiments, host 100 is a Personal Data Assistant (PDA), a tablet, a smartphone, or a cellular phone. For other examples, host 100 may be a set-top box, an Internet media viewer, an Internet media player, a smart sensor, a smart medical device, a net-top box, a networked television set, a networked DVR, a networked Blu-ray player, or a media center.

Service gateway

110 is a computing device operationally coupled to a processor 113 and a computer readable medium 114 for storing computer readable program code to be executed by the processor 113. Service gateway 110 may be implemented as a server load balancer, an application delivery controller, a service delivery platform, a traffic manager, a security gateway, a component of a firewall system, a component of a virtual private network (VPN), a load balancer for video servers, or a gateway to distribute load to one or more servers.

Server

200 is a computing device operationally coupled to a processor 213 and a computer readable medium 214 for storing computer readable program code to be executed by the processor 213. The computer readable program code may implement server 200 as a Web server, a file server, a video server, a database server, an application server, a voice system, a conferencing server, a media gateway, a SIP server, a remote access server, a VPN server, a media center, an app server or a network server providing a network or application service to host 100.

Data network

153 may include an Internet Protocol (IP) network. Data network 153 may include a corporate data network or a regional corporate data network, an Internet service provider network, a residential data network, a wired network such as Ethernet, a wireless network such as a WiFi network, or cellular network. Data network 153 may reside in a data center, or connects to a network or application network cloud.

Service request

301 from host 100 includes a service address 331, such as an IP address. Service address 331 includes an application layer address or a transport layer port number, such as transmission control protocol (TCP) port number or user datagram protocol (UDP) port number. Service address 331 is associated with service gateway 110 so that service gateway 110 processes the service request 301. Service address 331 may include a destination IP address of service request 301, and optionally may include destination transport layer port number of service request 301.

Service request

301 may include a TCP session request data packet, or a UDP data packet. Service address 331 is included in the data packet of service request 301.

Service gateway

110 determines a server address 321 based on service address 331 obtained from service request 301. Server address 321 is associated with server 200 and may include a network address or IP address of server 200. Server address 321 may include an application layer address, such as a TCP port number or a UDP port number of server 200.

Based on server address 321, service gateway 110 sends a service session request 306 to server 200. Subsequently service gateway 110 receives a response to session request 306 from server 200 and establishes a server-side service session 305 with server 200. Based on session request 306 response, service gateway 110 sends a service request 301 response to host 100, and establishes a host-side service session 302 with host 100 for service request 301.

Communication session

300 includes host-side service session 302 and server-side service session 305. Service session 302 includes one or more data packets from host 100 for communication session 300. Service session 305 includes one or more data packets from server 200 for communication session 300. Service session 302 may include service request 301.

Upon establishment of service session 302 and service session 305, service gateway 110 subsequently processes a data packet 304 of service session 302 received from host 100. Data packet 304 includes service address 331. Service gateway 110 modifies data packet 304 by replacing service address 331 with server address 321. Service gateway 110 sends modified data packet 304 to server 200.

When service gateway 110 receives a data packet 307 of service session 305 from server 200, service gateway 110

processes data packet

307. Data packet 307 of service session 305 may include server address 321. Service gateway 110 modifies data packet 307 by replacing server address 321 with service address 331. Service gateway 110 sends modified data packet 307 to host 100.

There are two common methods in processing service session 302 and service session 305: a stateful processing method and a stateless processing method. FIG. 2 illustrates a stateful processing method. In FIG. 2, service gateway 110 maintains a service session table 412. Session table 412 stores one or more service session entries. Service gateway 110 creates a session entry 420 for service session 302. Session entry 420

stores service address

331 and server address 321 to associate service address 331 and server address 321. Service gateway 110 may create session entry 420 after establishing host-side service session 302 and server-side service session 306. Service gateway 110 may create session entry 420 after receiving service request 301. Service gateway 110

stores service address

331 and server address 321 in session entry 420 after service gateway 110 determines the addresses. Service gateway 110

stores session entry

420 in session table 412.

Service gateway

110 includes a storage 400 and stores session table 412 in storage 400. Storage 400 is a memory module residing in service gateway 110. Service gateway 110 includes a network processing module (not shown) comprising a field programmable gate array (FPGA), a network processor, an application specific integrated circuit (ASIC). Storage 400 is associated with the network processing module. Examples of storage 400 include a content addressable memory (CAM), a ternary content addressable memory (TCAM), a static random accessible memory (SRAM), or a dynamic random accessible memory (DRAM).

Service gateway

110 obtains service address 331 from service request 301. Service gateway 110 maintains a service policy 471 and determines server address 321 based on service policy 471. Service policy 471 may be based on a relationship between server 200 and service address 331. Service policy 471 includes service address 331 and server address 321. Service gateway 110 selects service policy 471 based on a match between service address 331 obtained from service request 301 and the service address in the service policy 471. Service gateway 110 applies service policy 471 to service request 301. Service policy 471 may include a security policy 482 where a non-secure service request 301 can be sent to server 200. Service policy 471 may include a traffic policy 483, where service request 301 is served by server 200 when traffic load to server 200 is low. Service request 301 may be received from a predetermined network interface of service gateway 110 and traffic policy 483 indicates that service request 301 from the network interface should be sent to server 200.

Server

240 also serves service request 301. Service policy 471 may include a server load policy 484 indicating that service request 301 is to be sent to server 200 when server load of server 240 is high. In one example, service policy 471 includes a server availability policy 485 indicating that service request 301 is to be sent to server 200, where server 200 is a back-up server to server 240, and server 240 is not available. Service policy 471 may include a load balancing policy 486 between server 200 and server 240. Service gateway 110 selects server 200 using the load balancing policy 486, which may include a round robin or another load balancing scheme. Service policy 471 may include a host policy 487 indicating that service request 301 is to be sent to server 200 when host 100 satisfies host policy 487.

After service gateway 110 applies service policy 471 to service request 301, service gateway 110 retrieves server address 321 from service policy 471. Service gateway 110 creates session entry 420 with service address 331 and server address 321, associating service address 331 and server address 321. Service gateway 110

stores session entry

420 in session table 412.

Service gateway

110 uses session table 412 to process data packet 304 received from host 100, and data packet 307 received from server 200. When service gateway 110 receives data packet 304 from host 100, service gateway 110 obtains service address 331 from data packet 304. Service gateway 110 compares the obtained service address 331 against service addresses stored in session table 412. When service gateway 110 determines there is a match between the obtained service address 331 and session entry 420 in session table 412, service gateway 110 uses information stored in session entry 420 to process data packet 304. Service gateway 110 modifies data packet 304 by replacing service address 331 with server address 321, where server address 321 is obtained from the matched session entry 420. Service gateway 110 sends modified data packet 304 to server 200.

Service request

301 may include a host address 104 associated with host 100. Service gateway 110 retrieves host address 104 from service request 301. Service gateway 110 may use retrieved host address 104 when applying service policy 471. Service gateway 110 stores host address 104 in service session entry 420. Data packet 304 may include host address 104. Service gateway 110 obtains host address 104 from data packet 304 and compares the obtained host address 104 against addresses stored in session table 412 and session entry 420.

When service gateway 110 receives a data packet 307 of server-side service session 305 from server 200, service gateway 110 retrieves server address 321 from data packet 307. Service gateway 110 compares the obtained server address 321 against addresses stored in session table 412, and determines there is a match with session entry 420. In response to determining there is a match, service gateway 110 uses session entry 420 to process data packet 307. Service gateway 110 modifies data packet 307 by replacing server address 321 with service address 331, which is retrieved from the matched session entry 420. Service gateway 110 sends modified data packet 307 to host 100.

Data packet

307 may include host address 104. Service gateway 110 obtains host address 104 from data packet 307 and uses the obtained host address 104 in comparing against addresses stored in session table 412 and session entry 420.

Data packet

304 received from service session 302 may indicate a session termination request. For example, data packet 304 is a TCP FIN packet, a TCP RESET packet. Service gateway 110 inspects data packet 304 content and determines data packet 304 includes a session termination request. In response, service gateway 110 removes session entry 420 from session table 412. Service gateway 110 may remove session entry 420 after processing data packet 304 or waits for a pre-determined period of time before removing session entry 420.

The processing method illustrated in FIG. 2 is often referred as a stateful processing method. A stateful processing method allows service gateway 110 to apply one or more service policies to select server 200. The service policies may include security policies and other policies to protect server 200. Security policy 482 may cause service request 301 to be declined if a security concern is detected. Such security consideration is known to those skilled in the art and is not described in this application. Applying traffic policy 483 or server load policy 484 can also protect server 200 from overloading. Enforcing the service policies often improves service response time of server 200 to serve host 100.

However, applying service policy 471 to service request 301 requires computation resource of service gateway 110, such as CPU cycles. Such computation requirement may post a limitation on the ability of service gateway 110 to provide services when service gateway 110 receives and processes a large number of service requests over a short period of time.

For example, session table 412 has a certain capacity limit, such as 4 GB, 2000 entries, up to 10000 entries or 200 MB. The greater the number of service sessions serviced by service gateway 110 using a stateful processing method, the greater the number of session entries stored in session table 412. The capacity of session table 412 may become a severe limitation to the servicing capabilities of service gateway 110.

FIG. 3 illustrates a stateless processing method. In this method, service gateway 110 does not use session table 412. Instead, service gateway 110 maintains and uses a service mapping table 452. Service mapping table 452 is stored in storage 400. Service mapping table 452 includes a service mapping entry 460. Mapping entry 460 may include service address 331 and server address 321, associating service address 331 and server address 321. According to the service mapping entry 460, server 200 with server address 321 serves host 100 for service address 331.

When service gateway 110 receives a data packet 304 from host 100, service gateway 110 obtains service address 331 from data packet 304, and compares service address 331 with service addresses stored in service mapping table 452. When service gateway 110 determines there is a match with mapping entry 460, service gateway 110 retrieves server address 321 from mapping entry 460. Service gateway 110 modifies data packet 304 by replacing service address 331 with server address 321. Service gateway 110 sends modified data packet 304 to server 200.

When service gateway 110 receives a data packet 307 from server 200, service gateway 110

processes data packet

307 using service mapping table 452. Service gateway 110 obtains server address 321 from data packet 307. Service gateway 110 compares server address 321 against server addresses stored in service mapping table 452. When service gateway 110 determines there is a match with mapping entry 460, service gateway 110 retrieves service address 331 from mapping entry 460, and modifies data packet 307 by replacing server address 321 with service address 331. Subsequently service gateway 110 sends modified data packet 307 to host 100.

Service gateway

110 may match service address 331 or server address 321 against service mapping table 452 using a hash method. Service mapping table 452 includes a hash table using a hash function (HashFunc) 571. Mapping entry 460 is associated with a hash value (HashValue 581).

HashValue

581 includes the result of applying HashFunc 571 to service address 331. HashValue 581 may include the result of applying HashFunc 571 to server address 321.

HashValue

581 may include an index of mapping entry 460 in service mapping table 452. Mapping entry 460 occupies an entry in service mapping table 452 indexed by HashValue 581. For example, service mapping table 452 contains 1000 entries where the indices are 1-1000, and mapping entry 460 has an index of 894. In another example, service mapping table 452 contains 16 entries and mapping entry 460 has an index of 7.

Service gateway

110 applies HashFunc 571 to service address 331 of data packet 304 to obtain HashValue 581. Assume that service gateway 110 searches service mapping table 452 for an entry with index HashValue 581 and finds mapping entry 460. For data packet 307, service gateway 110 applies HashFunc 571 to server address 321 of data packet 307 to obtain HashValue 581. Service gateway 110 searches service mapping table 452 for an entry with index HashValue 581 and finds mapping entry 460.

Mapping entry

460 may include HashValue 581. After service gateway 110 applies hash function HashFunc 571 to obtain HashValue 581, service gateway 110 searches service mapping table 452 and finds mapping entry 460 containing an index matching HashValue 581.

Examples of hash functions HashFunc 571 include CRC checksum functions and other checksum functions; hash functions using a combination of bit-wise operators such as bit-wise AND operator, bit-wise OR operator, bit-wise NAND operator and bit-wise XOR operator; MD5 hash functions and other cryptography hash functions; Jenkins hash function and other non-cryptography hash functions; hardware based hash functions implemented in FPGA, ASIC or an integrated circuit board of service gateway 110; and other types of hash functions or table lookup functions. Typically such hash functions are simple and can be calculated rapidly by service gateway 110.

Data packet

304 includes host address 104 associated with host 100. Service gateway 110 obtains host address 104 from data packet 304 and uses the obtained host address 104 in the processing of data packet 304.

Data packet

307 includes host address 104. Service gateway obtains host address 104 from data packet 307 and uses the obtained host address 104 in the processing of data packet 307.

Typically, mapping entry 460 is configured by a service provider or an administrator of a service provider. Mapping entry 460 may be configured when server 200 becomes available, or when server address 321 or service address 331 becomes available. Server address 321 or service address 331 may be configured by the service provider to become available.

In this stateless processing method, service mapping table 452 is not related to the number of service sessions processed by service gateway 110. The capacity of service mapping table 452 is related to the number of available service addresses and server addresses. Such capacity is usually small. Service mapping tables 452 may have a few tens of entries or a few thousand entries.

The advantages of a stateless processing method include small resource requirement for service mapping table 452, a minimal or no computational requirement to handle service request 301, or no requirements to apply service policy 471. A stateless processing method is usually preferred over a stateful processing method when service gateway 110 receives a large number of service session requests in a short period of time, or under a heavy load of service requests. A stateless method is also preferred when the memory capacity of session table for new sessions is running low, say below 10% of the session table 412. A stateless method protects service gateway 110 from resource overload and therefore maintains service quality towards host 100 under stressful situations.

However, a stateless processing method may be less desirable than a stateful processing method due to security concerns, since service gateway 110 does not apply security policy 482. Similarly service gateway 110 does not apply any other policy in service policy 471, affecting security of server 200, security of data network 153, traffic condition of data network 153, and service quality rendered to host 100. A stateful processing method is also preferred over the stateless processing method when service gateway 110 may select server address 321 from a plurality of server addresses. For example, a service provider may configure a plurality of servers to serve service address 331 in a load balancing manner. A service provider may configure a backup server for service address 331.

In a typical deployment scenario, a service provider may use a stateful processing method for a first service address while using a stateless processing method for a different second service address. The service provider does not expect the first service to have significant traffic or usage. The service provider may not expect the second service to be a security concern. In reality, the first service may see a sudden surge of traffic due to an unforeseen situation, whereas the second service may suffer a security attack. Using a hybrid processing method according to the present invention, as described below, a service provider may combine a stateful processing method for the first service when the load is light and change to a stateless processing method when the load becomes heavy; and may deploy a hybrid processing method to combine a stateless processing method for the second service during normal circumstances and switch immediately to a stateful processing method when a security alert is detected for the second service.

The various embodiment of the present invention are now described with reference to FIGS. 4 through 11.

FIG. 4 illustrates an embodiment of a service gateway 110 performing a hybrid-stateless processing method combining a stateful processing method and a stateless process method according to the present invention. FIG. 8 is a flowchart illustrating an embodiment of a hybrid-stateless processing method according to the present invention. In this embodiment, the computer readable medium 114 of the service gateway 110 stores computer readable program code, which when executed by processor 113, implements the various embodiment of the present invention. Service gateway 110 maintains session table 412 and service mapping table 452 in storage 400. In this embodiment of a hybrid-stateless processing method, service gateway 110 processes a received data packet 304 with a stateless method using service mapping table 452 when the service address of the received data packet 304 does not match any service addresses stored in session table 412.

Service gateway

110 connects to server 200 and server 240. Server 200 is associated with server address 321. Server 240 is associated with server address 324. Service gateway 110 is associated with service address 331 and service address 334.

In some embodiments, session table 412 includes a session entry 420 which stores service address 331 and server address 321, associating service address 331 and server address 321. Service mapping table 452 includes a mapping entry 462 which stores service address 334 and server address 324, associating service addresses 334 and 324.

In various embodiments, server 200 may be the same as server 240. Server address 321 may be the same as server address 324. Service address 331 may be the same as service address 334.

Referring to both FIGS. 4 and 8, service gateway 110 receives a data packet 304 from host 100 (801). Service gateway 110 obtains service address 336 from data packet 304 (802). Service gateway 110 compares service address 336 of data packet 304 against service addresses stored in session table 412 (803).

In some embodiments, service gateway 110 finds a match in session entry 420, where service address 336

matches service address

331 of session entry 420 (804). In response to finding the match, service gateway 110

processes data packet

304 based on information stored in session entry 420 using a stateful processing method (805), such as the one described above with reference to FIG. 2.

When service gateway 110 does not find a match in session table 412 (804), service gateway 110 compares service address 336 of data packet 304 against service addresses in service mapping table 452 (806). If service gateway 110 finds a match in mapping entry 462 of service mapping table 452, wherein service address 336

matches service address

324 of mapping entry 462 (807), service gateway 110

processes data packet

304 based on information stored in mapping entry 462 using a stateless processing method (808), such as the one described above with reference to FIG. 3.

In various embodiments, service gateway 110 receives a data packet 307 from server 200 (830). Service gateway 110

extracts server address

321 from data packet 307 (831) and compares server address 321 of data packet 307 against server addresses stored in session table 412 (832). When service gateway 110 finds a match in session entry 420, with server address 321 of data packet 307

matching server address

321 of session entry 420 (803), service gateway 110

processes data packet

308 using the stateful processing method (805), as described above with reference to FIG. 2.

In some embodiments, service gateway 110 receives a data packet 308 from server 240 (830). Service gateway 110

extracts server address

324 from data packet 308 (832) and compares server address 324 of data packet 308 against server addresses stored in session table 412 (832). When service gateway 110 does not find a match (833), service gateway 110 compares server address 324 of data packet 308 against server addresses stored in service mapping table 452 (834) and finds a match in mapping entry 462, where server address 324 of data packet 308

matches server address

324 of mapping entry 462 (807). In response, service gateway 110 modifies data packet 308 based on information stored in mapping entry 462 using a stateless processing method (808). Service gateway 110 sends modified data packet 308.

FIG. 5 illustrates an embodiment of a service gateway 110 performing a hybrid-stateful processing method combining a stateful processing method and a stateless processing method according to the present invention. FIG. 9 is a flowchart illustrating an embodiment of the hybrid-stateful processing method according to the present invention. Referring to both FIGS. 5 and 9, service gateway 110 receives a data packet 304 from host 100 (901). In some embodiments, service gateway 110 determines that data packet 304 includes a service request 301 from host 100 (902). In response, service gateway 110 applies a stateful processing method to service request 301 (903). Service gateway 110 performs the stateful processing method, including applying service policy 471 to service request 301, creating session entry 420 using service address 331 of service request 301 and server address 321 of service policy 471, as described above with reference to FIG. 2.

In various embodiments, service gateway 110 determines data packet 304 does not include a service request (902). In response, service gateway 110

processes data packet

304 using the hybrid-stateless processing method, as described above with reference to FIG. 4.

In other embodiments, service gateway 110 receives a data packet 307 from server 200 (901). In this embodiment of a hybrid-stateful processing method, service gateway 110 applies a hybrid-stateless processing method to data packet 307 (904), as described above with reference to FIG. 4.

FIGS. 6 and 10 illustrate an embodiment of a service gateway and a method, respectfully, for changing from a hybrid-stateful processing method to a hybrid-stateless processing method in response to a hybrid-stateless condition being satisfied according to the present invention. Referring to both FIGS. 6 and 10, service gateway 110 is using a hybrid-stateful processing method (1001). Service gateway 110 maintains a hybrid-stateless condition 810. Service gateway 110 checks if hybrid-stateless condition 810 is satisfied (1002). In response to determining that the hybrid-stateless condition 810 is satisfied (1003), service gateway 110 changes to a hybrid-stateless processing method (1004). The service gateway 110 processes the next data packet received using the hybrid-stateless processing method, as described above with reference to FIGS. 4 and 8. In response to determining that the hybrid-stateless condition 810 is not satisfied (1003), the service gateway 110 continues using the hybrid-stateful processing method (1005), as described above with reference to FIGS. 5 and 9.

In some embodiments, hybrid-stateless condition 810 includes a session rate 811. For example, session rate 811 is 10 thousand sessions per second, 5 thousand active sessions per second, or one hundred sessions per 10 milliseconds.

In various embodiments, service gateway 110 calculates a session rate 821. Session rate 821 can be calculated based on a count of active host-side service sessions over a period of time. When the service session is associated with a session entry in session table 412, a service session is active. In various embodiments, session rate 821 calculates a difference between a count of received service requests and a count of received service termination requests over a period of time. In other embodiments, session rate 821 calculates a count of service requests received over a period of time.

In some embodiments, service gateway 110 calculates a session rate 821 in a predetermined period of time, such as every second, once every 250 milliseconds, once every 3 seconds or once every 10 seconds. In other embodiments, service gateway 110 calculates session rate 821 at variable times. For example, service gateway 110 calculates session rate 821 when a data packet from a host is received; when a service request is received; when a service termination request is received; or when a data packet is received from server 200. Service gateway 110 compares session rate 821 with session rate 811 of hybrid-stateless condition 810. If session rate 821 exceeds or is equal to session rate 811, service gateway 110 determines that hybrid-stateless condition 810 is met and satisfied.

In various embodiments, hybrid-stateless condition 810 includes a session table utilization 814. A session table utilization is a parameter setting forth a percentage of the session table capacity that is storing session entries. Hybrid-stateless condition 810 is satisfied if a count of stored session entries of session table 412 exceeds session table utilization 814. For example, session table utilization 814 is 90%, 85% or 95%. Service gateway 110 calculates a session table utilization 824 from time to time by calculating a count of stored session entries of session table 412. In some embodiments, service gateway 110 calculates session table utilization 824 periodically, such as every second, once every 20 milliseconds, once every 500 milliseconds, or once every 2 seconds. In other embodiments, service gateway 110 calculates session table utilization 824 when service gateway 110 processes a service request, a service termination request, or a data packet.

Service gateway

110 compares session table utilization 824 with session table utilization 814 of hybrid-stateless condition 810. When session table utilization 824 exceeds or is equal to session table utilization 814, service gateway 110 determines that hybrid-stateless condition 810 is met and satisfied.

In some embodiments, hybrid-stateless condition 810 further includes a time duration 816, where hybrid-stateless condition 810 must be considered met for at least a time duration 816 in order for the hybrid-stateless condition 810 to be satisfied. Examples of time duration 816 include 120 seconds, 30 seconds, and 5 seconds. Service gateway 110 checks from time to time whether the hybrid-stateless condition 810 is met, as described earlier. In various embodiments, service gateway 110 further includes a time duration 826 stored in memory. Initially, service gateway 110 assigns a value of 0 to the time duration 826. From time to time, service gateway 110 checks if hybrid-stateless condition 810 is met. If hybrid-stateless condition 810 is met, service gateway 110 increases the time duration 826 by an amount of time elapsed since the last time the hybrid-stateless condition 810 was checked. After the time duration 826 is modified, service gateway 110 checks if the time duration 826 exceeds time duration 816. If time duration 826 exceeds time duration 816, service gateway 110 determines that hybrid-stateless condition 810 is satisfied. Service gateway 110 subsequently changes to employ a hybrid-stateless method with subsequently received data packets.

If service gateway 110 determines hybrid-stateless condition 810 is not met, service gateway 110 modifies the time duration 826 to a value of 0.

In some embodiments, service gateway 110 receives hybrid-stateless condition 810 from an operator or an administrator 130. Administrator 130 can be a human operator provisioning hybrid-stateless condition 810 onto service gateway 110. Administrator 130 can be a network management system sending hybrid-stateless condition 810 to service gateway 110. Administrator 130 may include a storage medium storing hybrid-stateless condition 810. Service gateway 110 retrieves hybrid-stateless condition 810 from the storage of administrator 130.

FIGS. 7 and 11 illustrate an embodiment of a service gateway and a method, respectfully, for changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to a hybrid-stateful condition being satisfied according to the present invention. Referring to both FIGS. 7 and 11, service gateway 110 employs a hybrid-stateless processing method (1101) Service gateway 110 maintains a hybrid-stateful condition 910. Service gateway 110 checks if hybrid-stateful condition 910 is satisfied (1102). In response to determining that the hybrid-stateful condition 910 is satisfied (1103), service gateway 110 changes to a hybrid-stateful processing method (1104) and processes the next data packet using the hybrid-stateful processing method, described above with reference to FIGS. 5 and 9. In response to determining that the hybrid-stateful condition 910 is not satisfied (1103), service gateway 110 continues using the hybrid-stateless processing method (1105) and processes the next data packet using the hybrid-stateless processing method, as described above with reference to FIGS. 4 and 8.

In some embodiments, hybrid-stateful condition 910 includes a session rate 911. For example, session rate 911 is 1 thousand sessions per second, 500 active sessions per second, or ten sessions per 10 milliseconds.

Service gateway

110 can calculate a session rate 921. In some embodiments, session rate 921 calculates a difference between a count of received service requests and a count of received service termination requests over a period of time. Session rate 921 may also calculate a count of service requests received over a period of time. In various embodiments, service gateway 110 determines if a data packet received from a host includes a service request before applying a hybrid-stateless processing method to the received data packet. Service gateway 110 may also determine if a data packet received from a host or a server includes a service termination request before applying a hybrid-stateless processing method to the received data packet.

In some embodiments, service gateway 110 calculates session rate 921 in a predetermined period of time, such as every second, once every 100 milliseconds, once every 3 seconds, or once every 5 seconds. Service gateway 110 may also calculate session rate 921 at variable times. For example, service gateway 110 calculates session rate 921 when a data packet from a host is received; when a service request is received; when a service termination request is received; or when a data packet is received from a server. Service gateway 110 compares session rate 921 with session rate 911. If session rate 921 is below or smaller than session rate 911, service gateway 110 determines that hybrid-stateful condition 910 is met and satisfied.

In various embodiments, hybrid-stateful condition 910 includes a session table utilization 914. Hybrid-stateful condition 910 is satisfied if a count of stored session entries of session table 412 does not exceed session table utilization 914. For example, session table utilization 914 is 60%, 75% or 45%. Service gateway 110 calculates session table utilization 924 from time to time by calculating a count of stored session entries of session table 412. In some embodiments, service gateway 110 calculates session table utilization 924 periodically, such as every second, once every 20 milliseconds, once every 500 milliseconds, or once every 2 seconds. Service gateway 110 may also calculate session table utilization 924 when service gateway 110 processes a service request, a service termination request, or a data packet.

Service gateway

110 compares session table utilization 924 with session table utilization 914 of hybrid-stateful condition 910. If session table utilization 924 is smaller than session table utilization 914, service gateway 110 determines that hybrid-stateful condition 910 is met and satisfied.

Hybrid-stateful condition 910 may further include a time duration 916, where hybrid-stateful condition 910 must be considered met for at least a time duration 916 in order for the hybrid-stateful condition 910 is satisfied. Examples of time duration 916 include 100 seconds, 40 seconds, and 5 seconds. Service gateway 110 checks from time to time if the hybrid-stateful condition 910 is met as described earlier. In some embodiments, service gateway 110 further includes a time duration 926 stored in memory. Initially, service gateway 110 assigns a value of 0 to the time duration 926. From time to time, service gateway 110 determines if hybrid-stateful condition 910 is met. If hybrid-stateful condition 910 is met, service gateway 110 increases the time duration 926 by an amount of time elapsed since the last time the hybrid-stateful condition 910 was checked. In various embodiments, after the time duration 926 is modified, service gateway 110 checks if the time duration 926 exceeds time duration 916. If time duration 926 exceeds time duration 916, service gateway 110 determines hybrid-stateful condition 910 is satisfied. Service gateway 110 subsequently changes to employ a hybrid-stateful method with subsequently received data packets.

In some embodiments, service gateway 110 receives hybrid-stateful condition 910 from an operator or an administrator 130. Administrator 130 can be a human operator provisioning hybrid-stateful condition 910 onto service gateway 110. Administrator 130 can be a network management system sending hybrid-stateful condition 910 to service gateway 110. Administrator 130 can include a storage medium storing hybrid-stateful condition 910. Service gateway 110 retrieves hybrid-stateful condition 910 from the storage of administrator 130.

Returning to FIG. 8, FIG. 8 shows that when the service gateway 110 is processing data packets using the stateful processing method (805), the service gateway 110 would check whether the hybrid-stateless condition 801 is met (see FIG. 10). FIG. 8 also shows that when the service gateway 110 is processing data packets using the stateless processing method (808), the service gateway 110 would check whether the hybrid-stateful condition 910 is met (see FIG. 11). However, the references (C and D) to FIGS. 10 and 11 are not intended to convey any order of steps. The checking of the

conditions

810 or 910 may occur concurrently with the processing of data packets, as described above with reference to FIGS. 4 and 8.

Returning to FIG. 9, FIG. 9 shows that when the service gateway 110 is processing data packets using the stateful processing method (903), the service gateway 110 would check whether the hybrid-stateless condition 810 is met (see FIG. 10). FIG. 9 also shows that when the service gateway 110 is processing data packets using the hybrid-stateless processing method (904), the service gateway 110 would either check if the hybrid-stateless condition 810 or the hybrid-stateful condition 910 is met (see FIGS. 10 and 11), depending on the processing during the hybrid states processing method per FIGS. 4 and 8. However, the reference to FIGS. 10 (C) and 11 (D) are not intended to convey any order of steps. The checking of the

conditions

810 or 910 may occur concurrently with the processing of data packets as illustrated in FIGS. 5 and 9.

Although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.

Claims

What is claimed is:

1. A method for processing data packets sent over a communication session between a host and a server by a service gateway, comprising:

processing a data packet using a hybrid-stateful processing method by the service gateway, the hybrid-stateful processing method utilizing a service session table;

checking by the service gateway whether a hybrid-stateless condition is satisfied;

in response to determining that the hybrid-stateless condition is satisfied, changing to a hybrid-stateless processing method for a subsequently received data packet by the service gateway, the hybrid-stateless processing method utilizing a service mapping table; and

in response to determining that the hybrid-stateless condition is not satisfied, processing the subsequently received data packet using the hybrid-stateful processing method by the service gateway.

2. The method of claim 1, wherein the checking by the service gateway whether the hybrid-stateless condition is satisfied comprises:

comparing a time duration stored in memory against a predetermined time duration by the service gateway;

determining whether the time duration stored in memory exceeds the predetermined time duration;

in response to determining that the time duration stored in memory exceeds the predetermined time duration, determining by the service gateway that the hybrid-stateless condition is satisfied; and

in response to determining that the time duration stored in memory does not exceed the predetermined time duration, determining by the service gateway that the hybrid-stateless condition is not satisfied.

3. The method of claim 1, wherein the checking by the service gateway whether a hybrid-stateless condition is satisfied comprises receiving from an administrator the hybrid-stateless condition by the service gateway.

4. The method of claim 3, wherein the administrator comprises:

a human operator;

a network management system; or

a storage medium storing the hybrid-stateless condition.

5. A system, comprising:

a service gateway comprising a processor and a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code configured to:

process a data packet using a hybrid-stateful processing method, the hybrid-stateful processing method utilizing a service session table at the service gateway;

check whether a hybrid-stateless condition is satisfied;

in response to determining that the hybrid-stateless condition is satisfied, change to a hybrid-stateless processing method for a subsequently received data packet, the hybrid-stateless processing method utilizing a service mapping table at the service gateway; and

in response to determining that the hybrid-stateless condition is not satisfied, process the subsequently received data packet using the hybrid-stateful processing method.

6. The system of claim 5, wherein the check whether a hybrid-stateless condition is satisfied comprises:

compare a time duration stored in memory against a predetermined time duration by the service gateway;

determine whether the time duration stored in memory exceeds the predetermined time duration;

in response to determining that the time duration stored in memory exceeds the predetermined time duration, determine by the service gateway that the hybrid-stateless condition is satisfied; and

in response to determining that the time duration stored in memory does not exceed the predetermined time duration, determine by the service gateway that the hybrid-stateless condition is not satisfied.

7. The system of claim 5, wherein the check whether a hybrid-stateless condition is satisfied comprises receiving from an administrator the hybrid-stateless condition by the service gateway.

8. The system of claim 7, wherein the administrator comprises:

a human operator;

a network management system; or

a storage medium storing the hybrid-stateless condition.

9. A method for processing data packets sent over a communication session between a host and a server by a service gateway, comprising:

processing a data packet using a hybrid-stateless processing method by the service gateway, the hybrid-stateless processing method utilizing a service mapping table;

checking by the service gateway whether a hybrid-stateful condition is satisfied;

in response to determining that the hybrid-stateful condition is satisfied, changing to a hybrid-stateful processing method for a subsequently received data packet by the service gateway, the hybrid-stateful processing method utilizing a service session table; and

in response to determining that the hybrid-stateful condition is not satisfied, processing the subsequently received data packet using the hybrid-stateless processing method by the service gateway.

10. The method of claim 9, wherein the hybrid-stateful condition comprises a predetermined session rate, wherein the checking by the service gateway whether the hybrid-stateful condition is satisfied comprises:

calculating a session rate for a plurality of communication sessions received by the service gateway;

determining whether the calculated session rate is less than the predetermined session rate by the service gateway;

in response to determining that the calculated session rate is less than the predetermined session rate, determining by the service gateway that the hybrid-stateful condition is satisfied; and

in response to determining that the calculated session rate is greater than or equals the predetermined session rate, determining by the service gateway that the hybrid-stateful condition is not satisfied.

11. The method of claim 10, wherein the calculated session rate comprises:

a difference between a count of received service requests and a count of received service termination requests over a predetermined period of time or

a count of service requests over the predetermined period of time.

12. The method of claim 9, wherein the hybrid-stateful condition comprises a predetermined session table utilization, wherein the checking by the service gateway whether a hybrid-stateful condition is satisfied comprises:

counting a number of stored session entries in the session table by the service gateway;

determining whether the number of stored session entries does not exceed the predetermined session table utilization by the service gateway;

in response to determining that the number of stored session entries does not exceed the predetermined session table utilization, determining by the service gateway that the hybrid-stateful condition is satisfied; and

in response to determining that the number of stored session entries exceeds the predetermined session table utilization, determining by the service gateway that the hybrid-stateful condition is not satisfied.

13. The method of claim 9, wherein the checking by the service gateway whether the hybrid-stateful condition is satisfied comprises:

in response to determining that the time duration stored in memory exceeds the predetermined time duration, determining by the service gateway that the hybrid-stateful condition is satisfied; and

in response to determining that the time duration stored in memory does not exceed the predetermined time duration, determining by the service gateway that the hybrid-stateful condition is not satisfied.

14. The method of claim 13, wherein the checking by the service gateway whether a hybrid-stateful condition is satisfied comprises receiving from an administrator the hybrid-stateful condition by the service gateway.

15. The method of claim 14, wherein the administrator comprises:

a human operator;

a network management system; or

a storage medium storing the hybrid-stateful condition.