Highly scalable architecture for application network appliances

Patent metadata

Field	Value
Publication number	US-9491201-B2
Application number	US-201514745524-A
Country	US
Kind code	B2
Filing date	Jun 22, 2015
Priority date	Aug 28, 2007
Publication date	Nov 8, 2016
Grant date	Nov 8, 2016

Abstract

A highly scalable application network appliance is described herein. According to one embodiment, a network element includes a switch fabric, a first service module coupled to the switch fabric, and a second service module coupled to the first service module over the switch fabric. In response to packets of a network transaction received from a client over a first network to access a server of a data center having multiple servers over a second network, the first service module is configured to perform a first portion of OSI (open system interconnection) compatible layers of network processes on the packets while the second service module is configured to perform a second portion of the OSI compatible layers of network processes on the packets. The first portion includes at least one OSI compatible layer that is not included in the second portion. Other methods and apparatuses are also describe.

First claim

The invention claimed is:

1. A method comprising:
at an application server of a gateway device, receiving a request from a client device for a data session with the application server;
authenticating a user of the client device by accessing user identity information from a directory;
extracting user attribute information from a user identity database;
creating a policy for the user of the client device based on the user attribute information, wherein the policy is used for identifying secure data transmission requirements for data traffic between the client device and the application server; and
negotiating security parameters with the client device.

2. The method of claim 1 , further comprising:
establishing a secure control channel for data traffic between the client device and the gateway device; and
downloading a policy from the gateway device to the client device via the secure control channel.

3. The method of claim 2 , further comprising:
establishing a proxy connection to provide a security service for the portions of data traffic sent by the client device.

4. The method of claim 3 , wherein establishing a secure control channel comprises establishing a Transparent Secure Transport Channel.

5. The method of claim 3 , and further comprising evaluating security zone characteristics of the downloaded policy in order to determine whether to encrypt the data traffic.

6. The method of claim 3 , further comprising:
authorizing the data traffic to be transmitted to the gateway device when the policy requires low security;
adding an integrity code to the data traffic using the negotiated security parameters when the policy requires medium security; and
encrypting the data traffic using the negotiated security parameters when the policy requires high security.

7. The method of claim 6 , wherein adding the integrity code comprises adding a Message Authentication Code (MAC) to the data traffic.

8. The method of claim 6 , wherein encrypting comprises encrypting an Internet Protocol (IP) payload of the data traffic.

9. The method of claim 6 , wherein encrypting comprises encrypting the IP payload while IP address and Transport Control Protocol (TCP) information of the data traffic remains unencrypted.

10. One or more non-transitory computer-readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
receive a request from a client device for a data session with an application server of a gateway device;
authenticate a user of the client device by accessing user identity information from a directory;
extract user attribute information from a user identity database;
create a policy for the user of the client device based on the user attribute information, wherein the policy is used for identifying secure data transmission requirements for data traffic between the client device and the application server; and
negotiate security parameters with the client device.

11. The non-transitory computer-readable storage media of claim 10 , further comprising instructions operable to:
establish a secure control channel for data traffic between the client device and the gateway device; and
download a policy from the gateway device to the client device via the secure control channel.

12. The non-transitory computer-readable storage media of claim 11 , further comprising instructions operable to:
establish a proxy connection to provide a security service for the portions of data traffic sent by the client device.

13. The non-transitory computer-readable storage media of claim 12 , wherein the secure control channel is a Transparent Secure Transport Channel.

14. The non-transitory computer-readable storage media of claim 12 , further comprising instructions operable to:
evaluate security zone characteristics of the downloaded policy in order to determine whether to encrypt the data traffic.

15. The non-transitory computer-readable storage media of claim 12 , further comprising instructions operable to:
authorize the data traffic to be transmitted to the gateway device when the policy requires low security;
add an integrity code to the data traffic using the negotiated security parameters when the policy requires medium security; and
encrypt the data traffic using the negotiated security parameters when the policy requires high security.

16. An apparatus comprising:
a network interface unit configured to enable network communications;
a processor coupled to the network interface unit, wherein the processor is configured to:
receive a request from a client device for a data session with an application server of a gateway device;
authenticate a user of the client device by accessing user identity information from a directory;
extract user attribute information from a user identity database;
create a policy for the user of the client device based on the user attribute information, wherein the policy is used for identifying secure data transmission requirements for data traffic between the client device and the application server; and
negotiate security parameters with the client device.

17. The apparatus of claim 16 , wherein the processor is further configured to:
establish a secure control channel for data traffic between the client device and the gateway device; and
download a policy from the gateway device to the client device via the secure control channel.

18. The apparatus of claim 17 , wherein the processor is further configured to:
establish a proxy connection to provide a security service for the portions of data traffic sent by the client device.

19. The apparatus of claim 17 , wherein the processor is further configured to:
evaluate security zone characteristics of the downloaded policy in order to determine whether to encrypt the data traffic.

20. The apparatus of claim 17 , wherein the processor is further configured to:
authorize the data traffic to be transmitted to the gateway device when the policy requires low security;
add an integrity code to the data traffic using the negotiated security parameters when the policy requires medium security; and
encrypt the data traffic using the negotiated security parameters when the policy requires high security.

Assignees

• Cisco Tech Inc

Inventors

• Bagepalli Nagaraj
• Gandhi Prashant
• Patra Abhijit
• Prabhu Kirti
• Thakar Anant

Classifications

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L69/321

  Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L69/161

  Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields · CPC title

• H04L63/166 Primary

  at the transport layer · CPC title