Providing predictable quality of service traffic steering

Patent metadata

Field	Value
Publication number	US-11032203-B2
Application number	US-201916395815-A
Country	US
Kind code	B2
Filing date	Apr 26, 2019
Priority date	Apr 26, 2019
Publication date	Jun 8, 2021
Grant date	Jun 8, 2021

Abstract

A first network device of a network receives first traffic and second traffic, and assigns a first priority to the first traffic and a second priority to the second traffic. The first network device provides, to a second network device, a first message requesting whether the second network device can process the first traffic, and receives, from the second network device, a first response with a first value indicating that the second network device can process the first traffic. The first network device establishes, with the second network device, a path that includes a first security association and a second security association. The first network device provides, to the second network device, the first traffic with the first priority, via the first security association of the path, and the second traffic with the second priority, via the second security association of the path.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a first network device of a network, first traffic and second traffic,
wherein the first traffic and the second traffic originated from an endpoint device associated with the network;

assigning, by the first network device, a first priority to the first traffic and a second priority to the second traffic,
wherein the first priority is greater than the second priority;

providing, by the first network device and to a second network device, a first message requesting whether the second network device can process the first traffic with the first priority;
receiving, by the first network device, from the second network device, and based on the first message, a first response with a first value indicating that the second network device can process the first traffic with the first priority;
providing, by the first network device and to the second network device, a second message with a second value specifying:
the first priority for a first security association, and
the second priority for a second security association;

establishing, by the first network device and with the second network device, a path that includes the first security association and the second security association;
providing, by the first network device and to the second network device, the first traffic, with the first priority, via the first security association of the path;
providing, by the first network device and to the second network device, the second traffic, with the second priority, via the second security association of the path;
providing, by the first network device and to a third network device, a third message requesting whether the third network device can process the first traffic with the first priority and the second traffic with the second priority;
receiving, by the first network device, from the third network device, and based on the third message, a second response with a first value indicating that the third network device cannot process the first traffic with the first priority,
the first value indicating that the third network device is non-enabled for processing the first traffic with the first priority;

establishing, by the first network device and with the third network device, another path that includes the second security association; and
providing, by the first network device and based on the second response, the first traffic with the first priority and the second traffic with the second priority via the other path.

2. The method of claim 1 , wherein the first traffic with the first priority, being received via the first security association of the path, is to cause the second network device to:
process the first traffic with a first set of processors to generate processed first traffic, and
provide the processed first traffic to another endpoint device associated with the network.

3. The method of claim 2 , wherein the second traffic with the second priority, being received via the second security association of the path, is to cause the second network device to:
process the second traffic with a second set of processors to generate processed second traffic, and
provide the processed second traffic to the other endpoint device associated with the network.

4. The method of claim 1 , wherein:
the first priority provides a first quality of service for the first traffic, and
the second priority provides a second quality of service for the second traffic,
wherein the first quality of service is greater than the second quality of service.

5. The method of claim 1 , wherein:
the first message includes a first Internet key exchange (IKE) message, and
the second message includes a second IKE message.

6. The method of claim 1 , wherein the first message includes information requesting:
whether the second network device is enabled or disabled to process the first traffic with the first priority, and
a quantity of security associations supported by the second network device.

7. The method of claim 1 , wherein providing the first traffic with the first priority, via the first security association of the path, includes:
providing the first traffic, with the first priority, via the first security association of the path and without fragmentation of the first traffic.

8. A first network device, comprising:
one or more memories; and
one or more processors to:
receive first traffic and second traffic that originated from an endpoint device associated with a network;
assign a first priority to the first traffic and a second priority to the second traffic,
wherein the first priority is greater than the second priority;

provide, to a second network device, a first message requesting whether the second network device can process the first traffic with the first priority;
receive, from the second network device and based on the first message, a first response with a first value indicating that the second network device can process the first traffic with the first priority;
establish, with the second network device, a path that includes a first security association and a second security association;
provide, to the second network device, the first traffic, with the first priority, via the first security association of the path;
provide, to the second network device, the second traffic, with the second priority, via the second security association of the path;
provide, to a third network device, a third message requesting whether the third network device can process the first traffic with the first priority and the second traffic with the second priority;
receive, from the third network device and based on the third message, a second response with a first value indicating that the third network device cannot process the first traffic with the first priority,
the first value indicating that the third network device is non-enabled for processing the first traffic with the first priority;

establish, with the third network device, another path that includes the second security association; and
provide, based on the second response, the first traffic with the first priority and the second traffic with the second priority via the other path.

9. The first network device of claim 8 , wherein the one or more processors are further to:
provide, to the second network device and prior to establishing the path, a second message with a second value specifying:
the first priority for the first security association, and
the second priority for the second security association.

10. The first network device of claim 8 , wherein the one or more processors, when providing the second traffic, with the second priority, via the second security association of the path, are to:
provide the second traffic, with the second priority, via the second security association of the path and without fragmentation of the second traffic.

11. The first network device of claim 8 , wherein the first security association provides shared security attributes between the first network device and the second network device to support secure communication of the first traffic.

12. The first network device of claim 11 , wherein the shared security attributes include one or more of:
an attribute identifying a cryptographic model,
an attribute identifying a traffic encryption key, or
an attribute identifying parameters for communication of the first traffic via the path.

13. The first network device of claim 8 , wherein the second security association provides shared security attributes between the first network device and the second network device to support secure communication of the se

Assignees

• Juniper Networks Inc

Inventors

• Mangla Umesh
• Andersson Johan

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L47/125

  by balancing the load, e.g. traffic engineering · CPC title

• H04L45/30

  Routing of multiclass traffic · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title