Method and apparatus for restraining connection request stream associated with high volume burst client in a distributed network

[0002] The present invention relates in general to client/server data communication systems and more particularly, the present invention is directed towards a method and apparatus that restrains a connection request stream associated with a high volume burst client in a distributed network.

[0003] Computer systems are well known in the art and have become a business staple and are also found in many homes. One feature available to the business world is that of using electronic mailing (e-mail) to send and receive messages and other information to and from one another in a business setting. Similarly, home computers, such as desk tops or laptops, and other information devices, such as personal digital assistants (PDAs), allow telecommuting such that a user can connect to the user's work server and down load and upload messages.

[0004] The e-mail system allows clients of a network system, which is maintained by a server system, to send messages or data from one user to another. In order to minimize disk space and requirements as well as to maximize functionality and consistency of the electronic mailing engine used in the network system, the engine is typically located on the server and is merely accessed by a client in order to send messages or retrieve messages to or from another user or client on the server system. In this way, the client system typically allows the user to perform such operations as composing, updating, and sending messages while the server in such a system provides, in part, a server based message repository as well as providing message transmission and reception functions for the user at the client level.

[0005] One such email system is described with reference to FIG. 1 showing a messaging system 100 suitable for large, distributed networks such as the Internet or large scale intranet systems. The system 100 typically includes a central server 102 resident in a computer system 104 that can take the form of a mainframe system as well as a distributed type computing system. When the system. 100 is a messaging system, such as an email system, the central server 102, as the central email server, is coupled to an interface, such as a firewall 106, that mediates the flow of information between the mail server 102 and its it clients represented as client 108 , client 110, and client 112. Typically, when the client 108, for example, desires to establish a channel to the server 102, the client 108 will generate a request to open a connection to the mail server 102 by any one of a variety of transports and protocols that are submitted directly by the requesting client 108, via, for example, TCP/IP as an SMTP message from an Internet system. Such a connection request can be submitted by using a dial-up modem using the PhoneNet protocol, DECnet as a MAIL-11 message, DECnet as an SMTP message, UUCP, an X.400 transport, SNA, and so on. For instance, at sites with an Internet connection, Internet addresses are normally routed through an SMTP over TCP/IP channel, however, at sites with only a UUCP connection, Internet addresses would instead be routed through a UUCP channel.

[0006] Once the connection request has been accepted, a channel is open between the requesting client 108 and the server computer 102 allowing for the transfer of data. In some cases, however, the requesting client 108 can inadvertantly disrupt the operations of the server 102 by generating a large number of connection requests within a relatively short length of time (i.e., connection request stream) referred to as a connection request burst. A connection request burst is defined as those situations where a legitimate client (referred to as a burst client) as part of its normal operations occasionally generates a short term, high volume connection request stream. One of the problems with the short term connection request burst is that it has the potential to disrupt the server 102 by forcing it to direct an inordinate amount of connection resources to the burst client 108 thereby having the effect of overwhelming requests from other clients, such as client 110 and 112.

[0007] A conventional approach to dealing with the short term, burst client 108 is to first identify those clients as burst clients by comparing the client's current connection request rate a pre-determined threshold. Once identified as a burst client, the burst client is temporarily blocked from making any additional connection requests of the server so as to allow other clients to have access to the server 102.

[0008] Unfortunately, however, blocking the connection request stream of the burst client 108, even for a short period of time, can have substantial adverse effects on the burst client 108.

[0009] Therefore, it would be desirable to have an improved method and apparatus in a distributed network for providing a burst client access to a server computer without adversely affecting other clients coupled to the server.

[0010] To achieve the foregoing, and in accordance with the purpose of the present invention, method, apparatus, and computer readable medium for providing connection requests to a high volume burst client in a distributed network are disclosed. In one embodiment, in a client/server computer environment, a method for restraining a connection request stream associated with a high volume connection request burst client is disclosed. A connection request is received at a beginning of a throttling interval m+1, where the throttling interval m+1 is subsequent to a throttling interval m. A throttling interval m+1 wait time is calculated based upon a slow down threshold associated with the requesting client, an interval m connection request count for the requesting client, wherein the interval m connection request count is the total number of connection requests received during the interval m for the requesting client, and an interval m wait time. A throttling interval m+1 connection request count is set to zero and the server computer waits for the throttling interval m+1 wait time before accepting the request.

[0011] In a preferred embodiment, the throttling interval m+1 wait time is related to a difference between the interval m connection request count for the interval m and the slowdown threshold for that requesting client.

[0012] In another embodiment, in a client/server computer environment, an apparatus for restraining a connection request stream associated with a high volume connection request burst client is disclosed. The apparatus includes a connection request receiving unit for receiving a connection request at a beginning of a throttling interval m+1, where the throttling interval m+1 is subsequent to a throttling interval m. A memory unit coupled to the connection request receiving unit arranged to store data associated with a slow down threshold, an interval m connection request count for the requesting client, and an interval m wait time. The apparatus further includes a processor coupled to the memory arranged to calculate a throttling interval m+1 wait time based upon the slow down threshold associated with the requesting client, the interval in connection request count for the requesting client and further arranged to set a throttling interval m+1 connection request count to zero. A request throttler coupled to the processor is also included that is arranged to direct the server computer to wait the throttling interval m+1 wait time before accepting the request.

[0013] In yet another embodiment, a computer readable media including computer program code for restraining a connection request stream associated with a high volume connection request burst client is disclosed.

[0014] The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which:

[0015] FIG. 1 showing a burst client in a messaging system.

[0016] FIG. 2 shows a messaging system in accordance with an embodiment of the invention.

[0017] FIG. 3A and FIG. 3B illustrates throttling a connection request stream based upon a slowdown threshold in accordance with an embodiment of the invention.

[0018] FIG. 4 illustrates a flowchart detailing a process for deriving a wait time in accordance with an embodiment of the invention.

[0019] FIG. 5 illustrates a typical, general-purpose computer system suitable for implementing the present invention.

[0020] Reference will now be made in detail to a preferred embodiment of the invention. An example of the preferred embodiment is illustrated in the accompanying drawings. While the invention will be described in conjunction with a preferred embodiment, it will be understood that it is not intended to limit the invention to one preferred embodiment. To the contrary, it is intended to cover alternatives, modifications, and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims.

[0021] Broadly speaking the invention describes an IP throttler that is an Internet standards-based protocol and system for restraining, but not halting, connection requests from a burst client so as to maintain burst client access to the server computer without unduly affecting access of other clients. The IP throttler is designed to restrain connection requests by a burst client by slowing down, but not blocking, the processing of connections from the burst client's IP address to the server to a connection rate that the server can handle without adversely affecting other clients coupled thereto. In order to determine whether a particular client is a burst client, the IP throttler records all connecting IP addresses thereby allowing the server to ascertain a connection request rate for each client. A connection request rates is then tabulated for each client (based upon their particular IP address, for example) and compared to a slowdown threshold associated with that particular IP address. The slowdown threshold provides the maximum number of connections per time interval (such as a throttling interval) from a particular IP address that the server is willing to accept without slowing down new incoming connections for that IP address.

[0022] If the incoming connection rate from the particular IP address always stays below the slowdown threshold, no throttling is applied to this IP address. If, however, during the previous throttling interval, there are connections in excess of the slowdown threshold, then what is referred to as a wait time is used to delay the incoming connection request stream from only the burst client during a next throttling interval. In particular, the wait time is related to the number of connection requests (hits) above the slowdown threshold (referred to as a slowdown rate). For example, in one implementation, the slowdown rate represents how many hourly connections in excess of the slowdown threshold will cause one second of wait time.

[0023] In the following description, frameworks and methods of providing an apparatus and system for restraining the connection request stream from a burst client to a server computer in a distributed environment are described. Such distributed environments are exemplified by those networks that utilize SMTP requests and responses. Although the invention will initially be described in terms of a multithreaded, object oriented computing system implemented using SMTP requests and responses, it should be noted that the present invention can be used in any system that is capable of handling well defined requests and responses across a distributed network.

[0024] It should also be noted that although the invention is described in terms of the Internet, any distributed network could be suitably employed to implement any desired embodiment of the invention.

[0025] The invention will now be described in terms of an electronic messaging system, such as an email system, having a server computer that is part of a large network of computers typical of, for example, the Internet coupled to a client computer capable of generating any number of connection requests within a particular time interval.

[0026] Referring now to FIG. 2, a messaging system 200 in accordance with an embodiment of the invention is described. The messaging system 200 includes a server computer 202 coupled to client computers 204-1 through 204-nby way of an interconnected network of computers 206, which in this example, is the Internet. When the client computer 204-1, for example, desires to communicate with the server computer 202 in order, for example, to send an email message, the client computer will generate a connection request that is typically based upon the well known TCP/IP protocol. As well known in the art, TCP (Transmission Control Protocol) is a method used along with the Internet Protocol (IP) to send data in the form of message units between computers over the Internet. While IP takes care of handling the actual delivery of the data, TCP takes care of keeping track of the individual units of data (referred to as packets) that a message is divided into for efficient routing through the Internet.

[0027] In the most widely installed level of the Internet Protocol, an IP address is a number (currently a 32 bit number) that identifies each sender or receiver of information that is sent in packets across the Internet. For example, the Internet Protocol part of TCP/IP includes an IP address associated with the receiver in the message and sends it to the IP address that is obtained by looking up the domain name in the Universal Resource locator in an HTTP (i.e., WEB page) type request or in the e-mail address in an email-type request. The recipient can see the IP address of the Web page requester or the e-mail sender and can respond by sending another message using the IP address it received. An IP address has two parts: the identifier of a particular network on the Internet and an identifier of the particular device (which can be a server or a workstation) within that network.

[0028] Therefore, in the arrangement shown in FIG. 2, the client computer 204-1 has associated with it a unique IP address (IP_client) as well as does the server computer 202 (IP_server). In order to request a connection to the server computer 202, the client computer 204-1 generates a TCP/IP based connection request that includes both the client IP address IP_clientand the server IP address, IP_server. Once the connection request has been successfully routed to the server computer 202, a firewall 207 included in or coupled to the server computer 202 monitors all incoming connection requests from all the client computers 204-1 through 204-n. In the described embodiment, the firewall 207 includes an IP throttler unit 208 that is used to restrain the connection request stream from an identified burst client. The IP throttler unit 208 includes a connection request monitor 210 arranged to monitor the number of connection requests received by a particular requesting client based upon the requesting client's unique IP address. A processor unit 212 coupled to the connection request monitor 210 is configured to count the number of connection requests for a particular requester based upon its associated IP address per unit of time, also referred to as a throttling interval. A memory 214 coupled to the processor unit 212 is used to store various threshold values that are used to determine whether or not a particular client can be characterized as a burst client, and if so, how to prevent the burst of connection requests from adversely affecting the operation of the server computer 202 or the crowding out the other clients 204-2 through 204-n.

[0029] For example, with reference to FIG. 2, FIG. 3A and FIG. 3B, time is divided into intervals (one such interval is called a throttling interval) in which the number of connections per client IP address is recorded in the memory 214, a slowdown threshold SLD_tprovides the maximum number of connections per unit of time (such as an hour) from one IP address that the server computer 202 is willing to accept without slowing down new incoming connections from the burst client. If the incoming connection rate from one IP address always stays below the slowdown threshold SLD_t, no throttling is applied to the stream of connection requests coming from a particular IP address. If, however, during the previous throttling interval, the connection request rate is in excess of the slowdown threshold SLD_t, a restrictor unit 216 coupled to the processor 212 slows down the connection request rate stream by what is referred to as a wait time. In a preferred embodiment, the wait time is based on the slowdown rate that represents how many connections per unit time (such as an hour) in excess of the slowdown threshold will cause one second of wait time.

[0030] In one embodiment, after a throttling interval has ended, the wait time associated with an IP address is calculated/updated according to the number of connections coming from this IP address during this throttling interval. It should be noted that in the described embodiment, each of the clients 204-1 through 204-nhave their own slowdown threshold SLD_tthat can be set according to the needs of a particular system. For example, if the client 204-1 is a low volume type client, it can have a slowdown threshold SLD_t1that represents a low number of connection requests. However, if, for example, the client 204-2 is a client having a wide variation of connection requests per unit time depending upon various factors, such as time of day, etc., then it can have a slowdown threshold SLD_t2that provides for those intervals of high volume connection requests without sacrificing server access of the lower volume clients, such as 204-1.

[0031] Still referring to FIG. 2, FIG. 3A, and FIG. 3B, in a specific implementation, time is divided into throttling intervals m in which the number of connections per client IP address is monitored by the monitoring unit 210 and recorded in the memory 214. If a particular client's connection request rate for a throttling interval m is greater than the slowdown threshold SLD_t, for that client as determined by the processor unit 212, the processor unit 212 will direct the restrictor unit 216 to slow down the incoming connection request stream by a wait time W_tfor the next throttling interval m+1. In this way, the burst client maintains server access, although at a lower rate, without adversely affecting server access to other clients. For example, in FIG. 3B, the interval between the TCP accept and connection accepted by the application is increased by the wait time W_tin the interval m+1.

[0032] FIG. 4 shows a flowchart detailing a process 400 for throttling a connection request stream for a burst client in accordance with an embodiment of the invention. The process 400 begins at 402 determining is a new connection request has been received. When a new connection request has been received, a determination is made whether or not it is the beginning of a new interval at 404. If it is determined that it is not a beginning of a new interval, then the number of connections n_connis updated at 406, otherwise, a new wait time Wt is calculated at 408. At 410, the number of connections n_connis reset and the connection request is delayed based upon the new wait time Wt at 412. At 414, the connection is accepted by the application, and a 416 a determination is made whether or not a new connection request has been received. If a new connection request has been received, then control is passed back to 404, otherwise processing stops.

[0033] FIG. 5 illustrates a typical, general-purpose computer system suitable for implementing the present invention. As is well known in the art, ROM acts to transfer data and instructions uni-directionally to the CPUs 502, while RAM is used typically to transfer data and instructions in a bi-directional manner. CPUs 502 may generally include any number of processors. Both primary storage devices 504, 506 may include any suitable computer-readable media. A secondary storage medium 508, which is typically a mass memory device, is also coupled bi-directionally to CPUs 502 and provides additional data storage capacity. The mass memory device 508 is a computer-readable medium that may be used to store programs including computer code, data, and the like. Typically, mass memory device 508 is a storage medium such as a hard disk or a tape which generally slower than primary storage devices 504, 506. Mass memory storage device 508 may take the form of a magnetic or paper tape reader or some other well-known device. It will be appreciated that the information retained within the mass memory device 508, may, in appropriate cases, be incorporated in standard fashion as part of RAM 506 as virtual memory. A specific primary storage device 504 such as a CD-ROM may also pass data uni-directionally to the CPUs 502.

[0034] CPUs 502 are also coupled to one or more input/output devices 510 that may include, but are not limited to, devices such as video monitors, track balls, mice, keyboards, microphones, touch-sensitive displays, transducer card readers, magnetic or paper tape readers, tablets, styluses, voice or handwriting recognizers, or other well-known input devices such as, of course, other computers. Finally, CPUs 502 optionally may be coupled to a computer or telecommunications network, e.g., an Internet network or an intranet network, using a network connection as shown generally at 512. With such a network connection, it is contemplated that the CPUs 502 might receive information from the network, or might output information to the network in the course of performing the above-described method steps. Such information, which is often represented as a sequence of instructions to be executed using CPUs 502, may be received from and outputted to the network, for example, in the form of a computer data signal embodied in a carrier wave. The above-described devices and materials will be familiar to those of skill in the computer hardware and software arts.

[0035] Although only a few embodiments of the present invention have been described, it should be understood that the present invention may be embodied in many other specific forms without departing from the spirit or the scope of the present invention. Operations may also be removed or added without departing from the spirit or the scope of the present invention.

[0036] Although the methods for restraining a connection request stream for a high volume burst client in a distributed network in accordance with the present invention are particularly suitable for implementation with respect to a Java™ based environment, the methods may generally be applied in any suitable object-based environment. In particular, the methods are suitable for use in platform-independent object-based environments. It should be appreciated that the methods may also be implemented in some distributed object-oriented systems.

[0037] It should also be appreciated that the present invention may generally be implemented on any suitable object-oriented computer system. Therefore, the present examples are to be considered as illustrative and not restrictive, and the invention is not to be limited to the details given herein, but may be modified within the scope of the appended claims along with their full scope of equivalents.