Network policy application based on session state

Patent metadata

Field	Value
Publication number	US-12289243-B2
Application number	US-202117454071-A
Country	US
Kind code	B2
Filing date	Nov 9, 2021
Priority date	Dec 21, 2020
Publication date	Apr 29, 2025
Grant date	Apr 29, 2025

Abstract

Techniques are disclosed for the detection of different states of a session comprising a bidirectional flow of network traffic between client devices so as to enable a network device to apply different network policies to different states of the session. In one example, a computing device identifies multiple states of a session and defines a plurality of network policies. Each network policy defines performance requirements for network traffic during each state of the session. A network device receives the plurality of network policies and determines a state of the session. The network device selects a path based on the performance requirements of the network policy associated with the determined state of the session. The network device forwards traffic associated with the session along the selected path while the session is in the determined state.

First claim

What is claimed is:

1. A method comprising:
receiving, by a network device of a plurality of network devices forming a network, a first network policy defining one or more first performance requirements for network traffic during a session establishment state of a session and a second network policy defining one or more second performance requirements for network traffic during a data communication state of the session, wherein the session comprises a bidirectional flow of network traffic between a first client device and a second client device;
based at least in part on determining that the session is in the session establishment state, selecting, by the network device and based on the one or more first performance requirements defined by the first network policy corresponding to the session establishment state of the session, a first path of a plurality of different paths through the network;
forwarding, by the network device, network traffic associated with the session establishment state of the session along the first path;
based at least in part on determining a change in the session from the session establishment state to the data communication state, selecting, by the network device and based on the one or more second performance requirements defined by the second network policy corresponding to the data communication state of the session, a second path of the plurality of different paths, the second path different from the first path; and
forwarding, by the network device, network traffic associated with the data communication state of the session along the second path.

2. The method of claim 1 , further comprising:
based at least in part on determining a change in the session from the data communication state to a teardown state, selecting, by the network device and based on one or more third performance requirements defined by a third network policy corresponding to the teardown state, a third path of the plurality of different paths, the third path different from the second path; and
forwarding, by the network device, network traffic associated with the teardown state of the session along the third path.

3. The method of claim 1 , wherein the one or more first performance requirements comprise one or more of jitter, latency, packet loss, bandwidth, or cost.

4. The method of claim 1 , wherein determining the change in the session from the session establishment state to the data communication state is based on at least one of:
a number of packets associated with the session received by the network device;
an elapsed time of the session; or
a type of packet received by the network device.

5. The method of claim 1 , wherein a plurality of different states of the session includes the session establishment state, the data communication state, and a teardown state.

6. The method of claim 1 ,
wherein determining the session is in the session establishment state is based at least in part on receiving a packet comprising a Transmission Control Protocol (TCP) “SYN” message from the first client device; and
wherein determining the change in the session from the session establishment state to the data communication state based at least in part on receiving a packet comprising a TCP “ACK” message from the first client device.

7. The method of claim 1 ,
wherein determining the session is in the session establishment state is based at least in part on receiving a packet comprising a Transport Layer Security (TLS) “ClientHello” message from the first client device; and
wherein determining the change in the session from the session establishment state to the data communication state is based at least in part on receiving a packet comprising a TLS “Finished” message from the first client device.

8. The method of claim 1 , wherein a plurality of different states of the session includes:
the session establishment state;
the data communication state, and
at least one of a real-time state, a time-sensitive state, or a time-insensitive state.

9. A network device of a plurality of network devices forming a network, the network device comprising:
storage media; and
processing circuitry configured to:
receive a first network policy defining one or more first performance requirements for network traffic during a session establishment state of a session and a second network policy defining one or more second performance requirements for network traffic during a data communication state of the session, wherein the session comprises a bidirectional flow of network traffic between a first client device and a second client device;
based at least in part on determining that the session is in the session establishment state, select, based on the one or more first performance requirements defined by the first network policy corresponding to the session establishment state of the session, a first path of a plurality of different paths through the network;
forward network traffic associated with the session establishment state of the session along the first path;
based at least in part on determining a change in the session from the session establishment state to the data communication state, select, based on the one or more second performance requirements defined by the second network policy corresponding to the data communication state of the session, a second path of the plurality of different paths, the second path different from the first path; and
forward network traffic associated with the data communication state of the session along the second path.

10. The network device of claim 9 , wherein the processing circuitry is further configured to:
based at least in part on determining a change in the session from the data communication state to a teardown state, select, based on one or more third performance requirements defined by a third network policy corresponding to the teardown state, a third path of the plurality of different paths, the third path different from the second path; and
forward network traffic associated with the teardown state of the session along the third path.

11. The network device of claim 9 , wherein the one or more first performance requirements comprise one or more of jitter, latency, packet loss, bandwidth, or cost.

12. The network device of claim 9 , wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the data communication state based on a number of packets associated with the session received by the network device.

13. The network device of claim 9 , wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the data communication state based on an elapsed time of the session.

14. The network device of claim 9 , wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the data communication state based on a type of packet received by the network device.

15. The network device of claim 9 , wherein a plurality of different states of the session includes the session establishment state, the data communication state, and a teardown state.

16. The network device of claim 9 ,
wherein the processing circuitry is configured to determine the session is in the session establishment state based at least in part on receiving a packet comprising a Transport Layer Security (TLS) “ClientHello” message from the first client device; and
wherein the processing circuitry is configured to determine the change in the session from the session establishment state to the

Assignees

• Juniper Networks Inc

Inventors

• Timmons Patrick

Classifications

• H04L67/14

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title

• H04W28/02

  Traffic management, e.g. flow control or congestion control · CPC title

• H04L67/142

  Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms · CPC title

• H04L67/141

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L45/306

  Route determination based on the nature of the carried application · CPC title