Interposer with Security Assistant Key Escrow
US-2015288679-A1 · Oct 8, 2015 · US
US9935827B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-9935827-B2 |
| Application number | US-201414569476-A |
| Country | US |
| Kind code | B2 |
| Filing date | Dec 12, 2014 |
| Priority date | Sep 30, 2014 |
| Publication date | Apr 3, 2018 |
| Grant date | Apr 3, 2018 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
Some embodiments provide an elastic architecture for providing a service in a computing system. To perform a service on the data messages, the service architecture uses a service node (SN) group that includes one primary service node (PSN) and zero or more secondary service nodes (SSNs). The service can be performed on a data message by either the PSN or one of the SSN. However, in addition to performing the service, the PSN also performs a load balancing operation that assesses the load on each service node (i.e., on the PSN or each SSN), and based on this assessment, has the data messages distributed to the service node(s) in its SN group. Based on the assessed load, the PSN in some embodiments also has one or more SSNs added to or removed from its SN group. To add or remove an SSN to or from the service node group, the PSN in some embodiments directs a set of controllers to add (e.g., instantiate or allocate) or remove the SSN to or from the SN group. Also, to assess the load on the service nodes, the PSN in some embodiments receives message load data from the controller set, which collects such data from each service node. In other embodiments, the PSN receives such load data directly from the SSNs.
Opening claim text (preview).
We claim: 1. For a service node (SN) group comprising a plurality of service nodes for performing a service on received data message flows, wherein one service node is a primary service node (PSN) and each other service node is a secondary service node (SSN), a non-transitory machine readable medium storing a PSN program comprising sets of instructions for: analyzing data message load on each service node; based on the analysis, identifying several ranges of hash values that are derivable from header values of potential data message flows and associating each range with a service node; and providing a first set of load balancing parameters (LBPs) to a load balancer (LB) set that distributes the received data message flows to the service nodes of the SN group, wherein the first LBP set comprises the hash value ranges and associated service nodes after providing the first LBP set to the LB set, continuing to analyze the data message load on the service nodes, and based on the continued analysis, providing a second LBP set to the LB set that has at least one hash range that is not in the first LBP set. 2. The non-transitory machine readable medium of claim 1 , wherein each load balancer in the LB set distributes the received data message flows to the service nodes in a stateless manner. 3. The non-transitory machine readable medium of claim 1 , wherein upon receiving a new data message flow, each load balancer in the LB set (i) computes a hash value from the flow's header parameter set, and (ii) directs data messages of the flow to a particular service node that is associated with a hash value range that contains the computed hash value. 4. The non-transitory machine readable medium of claim 1 , wherein the second LBP set differs from the first LBP set in terms of the association between the hash ranges and service nodes. 5. The non-transitory machine readable medium of claim 1 , wherein the second LBP set further has at least one hash range that is in the first LBP set but is associated with different service nodes in the first and second LBP sets. 6. For a service node (SN) group comprising a plurality of service nodes for performing a service on received data message flows, wherein one service node is a primary service node (PSN) and each other service node is a secondary service node (SSN), a non-transitory machine readable medium storing a PSN program comprising sets of instructions for: analyzing data message load on each service node; based on the analysis, identifying several ranges of hash values that are derivable from header values of potential data message flows and associating each range with a service node; providing to a load balancer (LB) set the hash value ranges and associated service nodes as a first set of load balancing parameters (LBP), the LB set for distributing the received data message flows to the service nodes of the SN group; after providing the first LBP set to the LB set, continuing to analyze message load on each service node; based on the continued analysis, determining that a service node should be added to the SN group; and distributing a second LBP set to add the service node to the SN group, the second LBP set differing from the first LBP set in terms of at least one hash range that is not in the first LBP set. 7. For a service node (SN) group comprising a plurality of service nodes for performing a service on received data message flows, wherein one service node is a primary service node (PSN) and each other service node is a secondary service node (SSN), a non-transitory machine readable medium storing a PSN program comprising sets of instructions for: analyzing data message load on each service node; based on the analysis, identifying several ranges of hash values that are derivable from header values of potential data message flows and associating each range with a service node; providing to a load balancer (LB) set the hash value ranges and associated service nodes as a first set of load balancing parameters (LBP), the LB set for distributing the received data message flows to the service nodes of the SN group; after providing the first LBP set to the LB set, continuing to analyze message load on each service node; and based on the continued analysis, determining that a service node should be added to the SN group; directing a controller set to add the service node to the SN group; receiving confirmation from the controller set that the service node has been added; and after receiving confirmation, distributing a second LBP set to add the service node to the SN group. 8. For a service node (SN) group comprising a plurality of service nodes for performing a service on received data message flows, wherein one service node is a primary service node (PSN) and each other service node is a secondary service node (SSN), a non-transitory machine readable medium storing a PSN program comprising sets of instructions for: analyzing data message load on each service node; based on the analysis, identifying several ranges of hash values that are derivable from header values of potential data message flows and associating each range with a service node; providing to a load balancer (LB) set the hash value ranges and associated service nodes as a first set of load balancing parameters (LBP), the LB set for distributing the received data message flows to the service nodes of the SN group; after providing the first LBP set to the LB set, continuing to analyze message load on each service node; based on the continued analysis, determining that a service node should be removed from the SN group; and distributing a second LBP set to remove the service node from the SN group, the second LBP set differing from the first LBP set in terms of at least one hash range that is not in the first LBP set. 9. The non-transitory machine readable medium of claim 1 , wherein each load balancer in the LB set distributes the received data message flows to the service nodes in a stateless manner; wherein after a load balancer receives the second LBP set, the load balancer distributes the received data message flows that were being directed to one service node to another service node, and wherein the PSN program further comprises sets of instructions for: obtaining connection-flow state from another service node in the SN group; using the connection-flow state to determine that a particular data message flow that the PSN receives is a flow that is currently being processed by the other service node; and directing data messages of the particular data message flow to the other service node. 10. The non-transitory machine readable medium of claim 9 , wherein each service node exchanges connection-flow states with other service nodes, and wherein each particular service node uses the connection-flow states of each other service node to determine whether a new data message flow that the particular service node receives is currently being processed by another service node, and if so, to direct data messages of the new data message flow to the other service node. 11. The non-transitory machine readable medium of claim 1 , wherein the PSN program further comprises a set of instructions for providing the LBP set to each SSN; and wherein each SSN directs a new data message flow that the SSN receives from the LB set to another service node when the SSN determines, based on the LBP set, that another SSN should process the new data message flow. 12. The non-transitory machine readable medium of claim 11 , wherein each load balancer in the LB set distributes the received data message flows to the service nodes in a stateless manner; and wherein
by balancing the load, e.g. traffic engineering · CPC title
Fixed service order, e.g. Round Robin · CPC title
Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components · CPC title
Threshold monitoring · CPC title
by checking functioning · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.