Elastic service instance provisioning in a dynamic service chain

Patent metadata

Field	Value
Publication number	US-12425464-B2
Application number	US-202318396581-A
Country	US
Kind code	B2
Filing date	Dec 26, 2023
Priority date	Mar 1, 2019
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

Disclosed is increasing available bandwidth for processing of packets by a security service in a dynamic service chain, monitoring available bandwidth of the security service, taking into account a number of instances of the security service currently running, detecting a traffic volume that has exceeded a configurable threshold, provisioning a new instance to increase the available bandwidth of the security service, putting the new instance into service including updating a constant hash table (CHT) used to implement distributed routing and load balancing and distributing the updated CHT to instances of an other service that is upstream in the dynamic service chain from the security service. The method can include assigning new streams to use the new instance.

First claim

What is claimed is:

1. A computer-implemented method of increasing available bandwidth for processing of packets by a security service in a dynamic service chain of services running on one or more servers, including:
a controller monitoring available bandwidth of the security service, taking into account a number of instances of the security service currently running;
the controller detecting a traffic volume through a data center and being processed by the security service that has exceeded a configurable threshold and responsively signaling a workload orchestrator to provision a new instance of the security service, thereby increasing the available bandwidth of the security service;
upon successful provisioning of the new instance, the controller putting the new instance into service including updating a consistent hash table (CHT) used to implement distributed routing and load balancing over multiple instances of the security service in the dynamic service chain;
the controller distributing the updated CHT to instances of an other service that is upstream in the dynamic service chain from the security service; and
a first instance of the other service routing at least one new stream to be processed by the security service downstream of the other service, by using the updated CHT to assign an instance of the security service based on an affinity code of packets in the new stream, thereby selecting an affinity-based route that includes an instance of the security service for the new stream.

2. The computer-implemented method of claim 1 , wherein the dynamic service chain is a security service chain for a subscriber.

3. The computer-implemented method of claim 1 , wherein the affinity code for the new stream is included in an added header as an added IP header as IP source and destination.

4. The computer-implemented method of claim 1 , further including a packet in the new stream carrying a service chain for a subscriber in an added packet header and the security service being among services specified in the service chain.

5. The computer-implemented method of claim 1 , wherein instances of the security service in the dynamic service chain run in containers and the containers are hosted in pods.

6. The computer-implemented method of claim 1 , wherein instances of the security service in the dynamic service chain are implemented on virtual machines, bare metal servers or custom hardware.

7. The computer-implemented method of claim 1 , wherein failure of a particular service instance of the security service is detected by the controller, and performing actions further including:
monitoring the particular service instance for packet processing activity; and
causing updating of the CHT for the security service to remove the particular service instance from availability, should it be inactive for a configurable predetermined amount of time.

8. The computer-implemented method of claim 1 , further including actions of processing a plurality of packets in a stream through the dynamic service chain and directing the plurality of packets for processing, as a document, to a cloud access security broker (abbreviated CASB) in the dynamic service chain that controls exfiltration of sensitive content in documents stored on cloud-based services in use by users of an organization.

9. A tangible non-transitory computer readable storage media, including program instructions loaded into memory that, when executed on processors, cause the processors to implement a computer-implemented method of increasing available bandwidth for processing of packets by a security service in a dynamic service chain of services running on one or more servers, including:
a controller monitoring available bandwidth of the security service, taking into account a number of instances of the security service currently running;
the controller detecting a traffic volume through a data center and being processed by the security service that has exceeded a configurable threshold and responsively signaling a workload orchestrator to provision a new instance of the security service, thereby increasing the available bandwidth of the security service;
upon successful provisioning of the new instance, the controller putting the new instance into service including updating a consistent hash table (CHT) used to implement distributed routing and load balancing over multiple instances of the security service in the dynamic service chain;
the controller distributing the updated CHT to instances of an other service that is upstream in the dynamic service chain from the security service; and
a first instance of the other service routing at least one new stream to be processed by the security service downstream of the other service, by using the updated CHT to assign an instance of the security service based on an affinity code of packets in the new stream, thereby selecting an affinity-based route that includes an instance of the security service for the new stream.

10. The tangible non-transitory computer readable storage media of claim 9 , wherein the affinity code for the new stream is included in an added header as an added IP header as IP source and destination.

11. The tangible non-transitory computer readable storage media of claim 9 , further including a packet in the new stream carrying a service chain for a subscriber in an added packet header and the security service being among services specified in the dynamic service chain.

12. The tangible non-transitory computer readable storage media of claim 9 , wherein instances of the security service in the dynamic service chain run in containers and the containers are hosted in pods.

13. The tangible non-transitory computer readable storage media of claim 9 , wherein instances of the security service in the dynamic service chain are implemented on virtual machines, bare metal servers or custom hardware.

14. The tangible non-transitory computer readable storage media of claim 9 , further including actions of processing a plurality of packets in a stream through the dynamic service chain of services and directing the plurality of packets for processing, as a document, to a cloud access security broker (abbreviated CASB) that controls exfiltration of sensitive content in documents stored on cloud-based services in use by users of an organization, by monitoring manipulation of the documents.

15. A system including program instructions loaded into non-transitory memory that, when executed on processors, cause the processors to implement a computer-implemented method of increasing available bandwidth for processing of packets by a security service in a dynamic service chain of services running on one or more servers, including:
a controller monitoring available bandwidth of the security service, taking into account a number of instances of the security service currently running;
the controller detecting a traffic volume through a data center and being processed by the security service that has exceeded a configurable threshold and responsively signaling a workload orchestrator to provision a new instance of the security service, thereby increasing the available bandwidth of the security service;
upon successful provisioning of the new instance, the controller putting the new instance into service including updating a consistent hash table (CHT) used to implement distributed routing and load balancing over multiple instances of the security service in the dynamic service chain;
the controller distributing the updated CHT to instances of an other service that is upstream in the dynamic service chain from the security service;

Assignees

• Netskope Inc

Inventors

• Muniyappa Umesh Bangalore
• Ithal Ravi

Classifications

• H04L67/1001

  for accessing one among a plurality of replicated servers · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L69/16

  Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] · CPC title

• H04L45/7453

  using hashing · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title