Freescale Semiconductor,inc.

Nxp Usa, Inc.

Srinivasa Rao Addepalli

Subhashini A Venkataramanan

Jyothi Vemulapalli

Satya Srinivasa Murthy Nittala

Denis A Crasta

Rekesh John

Vamsi Ambati

John Myla

Rajesh Kumar Madabushi

Balaji Padnala

Srinivas Reddy Lonka

Naga Veera Venkata Raghava Rao Gunturu

Shad I Ansari

A method and apparatus receive packets, wherein the packets comprise headers, and the headers comprise session parameter values, route the packets in response to the session parameter values matching an active traffic session entry of the active traffic session entries in an active traffic session cache memory, match the session parameter values against historical session entries in an historical session cache memory in response to the session parameter values not matching any active traffic session entry of the active traffic session entries in the active traffic session cache memory, wherein the historical session entries for traffic sessions in the historical session cache memory persist after the traffic sessions are no longer active, and, in response to the session parameter values not matching any historical session entry of the historical session entries in the historical session cache memory, performing a packet security check on the packets.

Method and apparatus to accelerate session creation using historical session cache

This disclosure describes an approach to handle packets that arrive at a network security device, such as a router. At a data plane of the security device, packet identifiers included in an incoming packet not currently belonging to an IP session of the device are compared to packet identifiers stored in a table stored in a memory of the security device. The incoming packet identifiers includes a source IP, a destination IP, a protocol, a destination port, and a source port while the identifiers stored in the table do not include the source port. A new session is established for the incoming packet in response to the set of packet identifiers matching one of the entries in the table.

Rule lookup using predictive tuples based rule lookup cache in the data plane

This disclosure describes an approach to detect replay attacks while having multiple cores in a multi-core processor manage an established tunneling session. The tunneling session includes a number of flows. One of the cores is assigned to manage one of the flows, and another core is assigned to manage another of the flows. A replay attack over the tunneling session is inhibited by maintaining a flow-based sequence context at each of the flows, and the flow-based sequence context is maintained by the core that is managing the respective flow.

Flow-based anti-replay checking

A domain name dependency server (DDS) stores known relationships between domain names. In response to a domain relationship query from a local DNS server for a given domain name, the DDS supplies the domain names that are related to the given domain name. This reduces or eliminates serial requests for the related domain names from the local DNS server, reducing overall DNS lookup latency for the requested service. The DDS can be shared among multiple local DNS servers, and can be updated dynamically or manually to enhance the accuracy of its stored domain name relationships.

Domain name collaboration service using domain name dependency server

A mechanism is provided by which communication is reduced between a data plane of a network device and a control plane associated with that network device upon introduction of a new flow. A holding table is provided for every active flow table in the data plane. The holding table holds flow contexts for new flows not found in the associated active flow table, while awaiting flow information from the control plane. Each flow context includes a queue of subsequent data packets associated with the flow, which are held from the control plane pending receipt of the flow information from the control plane. A timeout mechanism compensates for packet loss between the network device and control plane. When the data plane receives the flow information from the control plane, the data plane then processes all the queued packets, deletes the flow context, and enters the data into an associated flow table.

Method and system for avoiding new flow packet flood from data plane to control plane of a network device

The present disclosure provides for methods, network devices, and computer readable storage media for packet reordering. In one embodiment, a method includes receiving a first packet of a first flow at a network device and determining whether flow-identifying information extracted from the first packet matches an existing flow entry. The method also includes, in response to a determination that the flow-identifying information does not match any existing flow entries, generating a new transient flow entry that includes the flow-identifying information and packet-in state. The method also includes forwarding the first packet to a controller via a packet-in stream.

Reducing packet reordering in flow-based networks

In a network control system, a method for managing traffic flow in a distributed controller environment includes stamping a packet to be forwarded between data forwarding units with flow control information based on an action set associated with a flow entry pushed by a logical controller. The packet is stamped by one or more of the data forwarding units. The flow control information is used to forward the packet between data forwarding units, thereby defining a datapath packet flow.

Federation of controllers management using packet context

A decentralized method for IPSec processing in virtual environments includes assigning a unique identifier to each of a set of compute nodes. Each compute node can emulate one or more virtual machines that generate IP packets for forwarding over a network (e.g., the Internet). An IP packet, received from a trusted source at a compute node, is encrypted and a trailer is appended to the encrypted packet. The trailer includes the unique identifier of the compute node. The encrypted packet with appended trailer is forwarded to a secure gateway that can perform an anti-replay check using stored parameters corresponding to the unique identifier in the trailer. In inbound processing, the unique identifier is inserted into a trailer appended to an encrypted packet by the security gateway and a VPN server directs the incoming encrypted packet to the appropriate compute node for forwarding to the virtual machine.

System and method for internet protocol security processing

A system for steering data packets in a communication network that includes compute nodes having processors for executing application and service virtual machines (VMs), and traffic steering accelerators. A virtual local area network-identifier (VLAN-ID) assignment module generates records and associates the records with the service VMs. Each record includes an input VLAN-ID, an output VLAN-ID, and a port number corresponding to one of the service VMs. A service-chaining module generates chaining rules associated with n-Tuples. A traffic steering controller generates a chain of the records based on the service chaining rules. The traffic steering accelerator then steers the data packets based on the input and output VLAN-IDs included in the data packet.

System for steering data packets in communication network

A communication system network element includes a Local Gateway co-located with a Home eNodeB. The Local Gateway has an open flow switch and a flow table, and provides service continuity of active SIPTO (selective IP traffic offload) sessions using open flow/software defined networking. An operator-controlled Open flow controller manages sessions at the Local Gateway. A flow modification feature is used to modify an existing flow in the flow table, which provides a means for interception and handover from a source Home eNodeB to a target Home eNodeB.

Wireless communication system with SIPTO continuity

Embodiments of a symmetric multi-processing (SMP) system can provide full affinity of a connection to a core processor when desired, even when ingress packet distribution, protocol processing layer and applications may autonomously process packets on different cores of the SMP system. In an illustrative embodiment, the SMP system can include a server application that is configured to create a plurality of tasks and bind the plurality of tasks to a plurality of core processors. One or more of the plurality of tasks are configured to create a corresponding listening endpoint socket, bind and listen on a protocol address that is common to the plurality of tasks.

Core-affine processing on symmetric multiprocessing systems

A network service dispatcher is provided that transparently navigates network traffic through network service appliances utilizing sub-session connection information generated in accordance with policies pertaining to a client-server session. The network service dispatcher intercepts a first data packet of a new session between two computer systems and generates sub-session connection information that navigates the data packet through one or more network service appliances in a manner transparent to the client or server. In turn, the network service dispatcher utilizes the sub-session connection information to navigate subsequent forward or reverse data packets in the session without performing a policy-based search for each data packet.

Steering traffic among multiple network services using a centralized dispatcher

An approach is provided where incoming packets are received at a data plane and header fields are extracted from the incoming packet. Flows from a flow data store are matched with the extracted header fields from the incoming packet. Packet descriptor data associated with the incoming packet is marked in the selected incoming packet forming a marked ingress packet with marking performed when the matching fails. The marked ingress packet is forwarded to a control plane that retrieves flow-related data related to the marked ingress packet and updates the marked packet descriptor data using the retrieved flow-related data, thereby forming an updated marked packet. The control plane passes the updated marked packet back to the data plane for further processing to update the flow data stored in the flow data store.

Method and apparatus for snoop-and-learn intelligence in data plane

A method and system for resolving a conflict between private internet protocol addresses assigned in a network between an internet protocol security remote access server (IRAS) and an internet protocol security remote access client (IRAC) arranged behind a network address translator (NAT) router in the network. By modifying internet key exchange version2 (IKEv2) and internet key exchange (IKE) protocol negotiations between IRAC and IRAS to include a private attribute used by IRAC to send all its internet protocol (IP) subnet addresses to IRAS, IRAS dynamically resolves any conflict of the IP addresses with that of its internal networks by mapping and assigning non-conflicting virtual IP addresses and network subnet addresses to IRAC for IRAC to access the internal networks of IRAS. The conflict resolving mechanism used in run time allows mobile virtual private networks (VPN) to access corporate networks employing IP routers implementing IP security (IPsec) remote access mechanism without access failure due to IP address conflicts.

Growing community of inventors

San Jose, CA, United States of America

Srinivasa Rao Addepalli