F5 Networks, Inc.

F5, Inc.

Nio Technology (anhui) Co., Ltd.

Fs, Inc.

Hao Cai

Timothy Scott Michels

Paul Imre Szabo

William Ross Baumann

Peter Michael Thornewell

Michael Thomas Barthelow

Lars Pierson Friend

Christopher Ryan Baker

Alan B Mimms

Robert Andrew Kovalchik

Lisa M Golden

Qingyuan Wang

Qi Lu

Adam Huson

Itai Druckmann

David Ryan

Daniel J McDermott

Haiyong Xie

Minzheng Zhao

Amit Fridman

Navin Donkana

Timothy S Michel

Systems and methods include receiving sessions associated with a communication between a client and an in-vehicle application service, assigning received sessions with a quality of service (QoS) processing priority, collecting a flow signature of the sessions, generating an expected runtime flow signature based on the collected flow signature, comparing the flow signature of sessions with the expected runtime flow signature based on a time at which each of the sessions were received, promoting a QoS processing priority of a group of the sessions, and dropping sessions based on a QoS processing priority.

Systems and methods of securing vehicle services from denial-of-service attacks using dynamic signature

Technology related to broadcast packet direct memory access (DMA) operations is disclosed. When a network interface controller (NIC) connected to a host computer receives a broadcast packet, it can transmit a request to an agent process running on the host computer for a plurality of destination buffers. In some embodiments, the request to the agent comprises all or part of the packet, or metadata about the packet. In such embodiments, the agent can use the contents of the request to identify services that should receive the packet. Alternatively, the NIC can identify the destination services and can transmit identifiers for the destination services to the agent. The agent can transmit requests for memory buffers to the services and can receive memory location identifiers in response. The agent can transmit the identifiers to the NIC, which can perform multiple DMA operations to write the broadcast packet to the identified memory locations.

Multi-destination DMA for packet broadcast

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with allocating a traffic load through heterogenous topology of a network includes extracting a header of each of a plurality of received packets of a traffic flow. Each of the headers comprises fields. Next, the network traffic manager apparatus executes a hashing function over the fields of each of the headers, applies a load balancing function to determine one of a plurality of endpoints to send each of the received packets based on one or more endpoint characteristics, and maps the index for each corresponding one of the received packets to the corresponding selected one of the endpoints. The received packets are not evenly divided among the plurality of endpoints. Lastly, the network traffic manager apparatus sends the received packets selected endpoint based on the mapping from the load balancing policy.

Methods for allocating a traffic load and devices thereof

Technology related to scheduling services on a platform including configurable computing resources is disclosed. In one example, a method includes scheduling a service to execute on a first computing node based on an availability of general-purpose computing resources at the first computing node. The first computing node can be selected from a plurality of computing nodes. Network traffic transiting the first computing node can be analyzed during the execution of the service to determine a hardware accelerator of a second computing node is capable of assisting the execution of the service. The service can be scheduled to execute on the second computing node and the hardware accelerator of the second computing node can be used to assist with the execution of the service.

Scheduling services on a platform including configurable resources

Technology related to scheduling services on a platform including configurable computing resources is disclosed. In one example, a method includes scheduling a first service to execute on a computing node based on an availability of general-purpose computing resources at the computing node. The computing node can be selected from a plurality of computing nodes. Network traffic transiting the computing node can be analyzed during the execution of the first service to determine a hardware accelerator of the computing node is capable of assisting the execution of the first service. The hardware accelerator can be used to assist with the execution of the first service. A second service can be scheduled on the computing node based on the availability of the general-purpose computing resources and the usage of the hardware accelerator on the computing node.

Embodiments are directed towards managing name service communications. A name service device may be arranged to employ a hardware domain name service (DNS) processor to receive a name service query. The hardware DNS processor may perform operations on the name service query. If operations performed by the hardware DNS processor do not resolve the name service query, further operations may be performed. The name service device may be arranged to provide a name service reply that includes the answer to the name service query. And, the name service device may be arranged to send the name service reply back to the hardware DNS processor. Accordingly, the hardware DNS processor on the name service device may send the name service reply that includes at least an answer to the name service query to the requesting computers.

Methods of collaborative hardware and software DNS acceleration and DDOS protection

Performance of connection flow management between a hardware-based network interface and a software module of a network traffic management device is disclosed. A flow connection setup for a flow connection is established between a client device and a server at the network traffic management device. It is then determined if the flow connection is symmetrical or asymmetrical in nature. A flow signature entry and a transformation data entry for the flow connection is generated, by software executed by the network traffic management device, in opposing first and second symmetric or asymmetric flow directions. The flow signature entry and the transformation data entry for the first and second flow directions is sent from the software module to the network interface. The network interface stores and utilizes the flow signature entry and the transformation data entry to perform acceleration on data packets in the first and second flow directions.

System and method for achieving hardware acceleration for asymmetric flow connections

Embodiments are directed towards network address based flood attack mitigation methods. A PTMD disposed between one or more computers may monitor several network flows and generate metrics associated with malicious network activity, such as, flood attacks. If flood attacks are determined to be occurring, the PTMD may determine the network addresses targeted by the flood attack. Further, the PTMD may activate flood attack mitigation procedures for the targeted network addresses such that other network addresses associated with the monitored network flows are excluded from the flood attack mitigation procedure. The PTMD may monitor the network traffic subsequently communicated to the targeted network addresses. Accordingly, the PTMD may determine if the flood attack has ceased based on characteristics of the monitored network traffic. If the flood attack has ceased, the flood attack mitigation procedures for the targeted network addresses may be deactivated.

Systems and methods for network destination based flood attack mitigation

Embodiments are directed towards improving the performance of network traffic management devices by optimizing the management of hot connection flows. A packet traffic management device ('PTMD') employs a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS performs high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS performs statistics gathering, and per-packet policy enforcement, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components. Making efficient use of the high speed flow cache capacity may be improved by maximizing the number of hot connection flows based on unique service and network traffic characteristics through adaptive feedback pattern learning together with administrator configurable service preferences that may have flow control data for most bandwidth hungry and desired hot services offloaded to the high-speed flow cache, at appropriate time.

Hot service flow hardware offloads based on service priority and resource usage

Embodiments are directed towards employing a packet traffic management device that has a split data flow segment ('DFS') and control segment ('CS') to determine if a connection flow update provided by the DFS to the CS is valid. The CS may be utilized to establish connection flows at the DFS based on connection flow requests. The CS may generate a connection flow identifier (&#x201c;CFID&#x201d;) for a connection flow request. The CS may cache the CFID at the CS. The CS may establish a connection flow at the DFS based at least on the connection flow request and the CFID. After a connection flow is established, a DFS may provide a connection flow update and a corresponding CFID to the CS. The CS may determine that the connection flow update is valid if the corresponding CFID matches the CFID cached at the CS.

Minimize recycle SYN issues for split TCP hot flows to improve system reliability and performance

A method performed by a hypervisor in a virtual network traffic management cluster, the method comprising: assigning a set of continuous available source media access control (SMAC) addresses to one or more virtual network traffic management devices in a network traffic management cluster, the one or more virtual network traffic management devices configured to handle connections for virtual guest instances; assigning a region of predetermined size in a SMAC-index mapping table to a corresponding virtual network traffic management device; wherein the assigned SMAC addresses and assigned region in the SMAC-index mapping table are accessible by the virtual guest instances; and maintaining SMAC-index pool allocation to virtual guest instances handled by corresponding virtual network traffic management devices.

Hardware assisted flow acceleration and L2 SMAC management in a heterogeneous distributed multi-tenant virtualized clustered system

Embodiments are directed towards minimizing the impact flood attacks may have on packet traffic management performance. A packet traffic management device ('PTMD') may employ a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS may perform high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS may perform statistics gathering, per-packet policy enforcement (e.g., packet address translations), or the like, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components that may be comprised of high-performance computer memory. The impact of flood attacks may be reduced by protecting the high-speed flow caches from being consumed by flow control data associated with malicious and/or in-operative non-genuine network connections. In at least one of the various embodiments, flood control filters may be adaptively activated based on the condition and quality of network traffic received at PTMD.

Growing community of inventors

Sammamish, WA, United States of America

Hao Cai