Redirecting data units to service modules based on service tags and a redirection table

[0001] A network element, such as a router or a switch, may include service modules that process packets. When the network element receives a packet at an ingress interface, the network element may send the packet to one of its service modules to render specialized services for the packet (e.g., hypertext transfer protocol (HTTP) caching service, intrusion detection system (IDS) service, load balancing service, firewall service, etc.). Upon rendering the services, the network element may drop the packet or send the original or modified packet to another network element through one of the egress interfaces.

[0002] According to one aspect, a method may include receiving a data unit at an ingress line interface of a network device, identifying a class of the received data unit, obtaining a service tag based on the class of the data unit, sending the service tag and the data unit across a switch fabric to a service module in the network device, and performing a service for the data unit at the service module.

[0003] According to another aspect, a device may include a first line interface and a service module. The first line interface may be configured to receive a data unit, identify a class of the received data unit, obtain a data unit descriptor and a service tag using the data unit, augment the data unit by combining the data unit with the data unit descriptor and the service tag, and send the augmented data unit to a service module. The service module may be configured to receive the augmented data unit from the first line interface and render a service for the augmented data unit. In addition, the service module may be configured to perform one of: send the augmented data unit to another service module, send the augmented data unit to a second line interface, or drop the augmented data unit.

[0004] According to yet another aspect, a device may include means for receiving a data unit at a network device, means for obtaining a data unit descriptor based on a forwarding table and the received data unit, means for identifying a class of the received data unit, means for obtaining a service tag based on the class of the received data unit, means for augmenting the data unit by attaching the service tag and the data unit descriptor to the data unit, means for retrieving an address of a destination service module from a redirection table by using a redirection index in the service tag, and means for sending the data unit to the service module based the address of the destination service module.

[0015] The following detailed description refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements.

[0016] The term “redirection” or “redirecting” a data unit, as used herein, may refer to sending a data unit from a hardware and/or software component of a network element to another component of the network element. The term “data unit,” as used herein, may refer to a packet, datagram, cell, a fragment of a packet, or other types of data that may be carried at a specified communication layer. As used herein, the term “service module” may refer to, within a network element, a logical or physical unit for performing a set of tasks or a service for a data unit that arrives at the network element. For example, a service module may provide a load balancing service, a firewall service, an intrusion detection system (IDS) service, a hypertext transfer protocol (HTTP) service, an encryption/decryption service, etc. A service module may be implemented in hardware, software, or a combination of hardware and software.

[0017] In the following, when a data unit is received at a line interface in a network element, the line interface may obtain a service tag for the data unit based on a lookup in an access control list (ACL). The service tag may include an index into a table, herein referred to as a redirection table, that designates one or more service modules and information about specific processing that the data unit may require.

[0018] Based on the service tag, the data unit may be sent from the line interface to the designated service modules. Each of the service modules may render a specific service and redirect the data unit to its next destination service module, based on the redirection table and/or the processing information provided in the service tag. After a last service at one of the service modules, the data unit may be either dropped or sent to an egress line interface for transmission from the network element into the network.

[0019] By using the service tag and the redirection table, at each service module, the data unit may be directed to a next service module or a line interface without an ACL lookup. Because the ACL lookup requires additional processing, without the ACL lookup, the data unit may be processed faster.

[0020] In addition, using the service tag and the redirection table may spare a user or an administrator from having to treat each service module as a network node with a network address. Treating a service module as a network node may require an administrator or a user to perform burdensome and mistake-prone tasks that are associated with reconfiguring network parameters (e.g., virtual local area network (VLAN) parameters) when a service module is added to or removed from the network element.

[0021] FIG. 1 is a diagram of an exemplary network 100 in which the concepts described herein may be implemented. Network 100 may include the Internet, an ad hoc network, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a cellular network, a public switched telephone network (PSTN), any other network, or combinations of networks.

[0022] As shown, network 100 may include N network elements 102-1 through 102-N (collectively referred to herein as “network element 102”). Each of network elements 102-1 through 102-N may include switches, routers, servers, and/or other types of devices. While network elements 102-1 through 102-N can be implemented as different types of devices, in the following paragraphs, network elements 102-1 through 102-N will be described in terms of a router. The links interconnecting network elements 102-1 through 102-N are shown by way of example. Network elements 102-1 through 102-N may be interconnected via various different links than those shown in FIG. 1.

[0023] FIG. 2 is a block diagram of an exemplary network element 102. As shown, network element 202 may include line interfaces 202-1 through 202-M, a switch fabric 204, and service modules 206-1 through 206-P. In the following, wherever appropriate, line interfaces 202-1 through 202-M and service modules 206-1 through 206-P may be collectively referred to herein as line interface 202 and service module 206, respectively. While not shown in FIG. 2 for the sake of simplicity, network element 102 may also include a processor, memory, and a bus. Moreover, depending on implementation, network element 102 may include additional, fewer, or different components than those illustrated in FIG. 2. For example, if network element 102 is implemented as a server device, network element 102 may include a large storage for fast data access, and software components, such as a web server, an application server, an email server, etc.

[0024] Each of line interfaces 202-1 through 202-M may include devices for receiving incoming data units from devices and/or elements in network 100 and for transmitting data units to other devices/elements in network 100. In addition, line interfaces 202-1 through 202-M may perform data unit forwarding, data unit classification, and/or internal redirection of the data units to service modules 206-1 through 206-P.

[0025] Switch fabric 204 may include switches for conveying a data unit from one or more of line interfaces 202-1 through 202-M or service modules 206-1 through 206-P to others of line interfaces 202-1 through 202-M or service modules 206-1 through 206-P.

[0026] Each of service modules 206-1 through 206-P may include hardware, software, or a combination of hardware and software for rendering a particular service for a received data unit. After processing the data unit, each of service modules 206-1 through 206-P may drop the data unit or direct the data unit to another of service modules 206-1 through 206-P or line interfaces 202-1 through 202-M.

[0027] In directing the data unit, service module 206 may employ a redirection table, which is described in detail below with respect to line interface 202. In one implementation, if service module 206 is implemented on a hardware component separate from other service modules, the service module may include a local copy of the redirection table to increase lookup speed. In another implementation where one or more service modules are implemented in software, the redirection table may be implemented in memory that is shared by the service modules.

[0028] Examples of service module 206 may include a firewall service module for permitting or denying data units from part of network 100 (e.g., a subnet) to enter other parts of network 100 (e.g., other subnets in network 100); a load balancing service module for distributing data units to multiple processors, threads, processes, hard disks, computers, and/or any other resources, in order to evenly spread the computational burden associated with handling the data units; an IDS service module for detecting and/or analyzing data units that may pose a threat to the security and/or normal operation of network element 102; an HTTP service module for handling incoming HTTP data units and for sending HTTP responses; etc.

[0029] In some implementations, functionalities of some components of network element 102 may be incorporated in other components of network element 102. For example, part of the processor may be included in line interface 202, so that line interface 202 may perform operations that are associated with redirecting and/or forwarding data units.

[0030] FIG. 3 is a functional block diagram of exemplary line interface 202. As shown, line interface 202 may include a forwarding module 302, a fabric interface 304, a classification table 306, a forwarding table 308, a redirection table 310, and an access control list (ACL) 312. Depending on implementation, line interface 202 may include fewer, additional, or different elements than those illustrated in FIG. 3.

[0031] Forwarding module 302 may include hardware and/or software for forwarding and/or classifying a data unit that is received at line interface 202. Forwarding module 302 may perform a lookup into forwarding table 306, classification table 308, and/or ACL 310, and may obtain a data unit descriptor that includes a forwarding address (e.g., a destination switch fabric port, a destination network port, etc.). In addition, forwarding module 302 may obtain a service tag for the data unit based on the classification and/or ACL lookup, augment the data unit by appending the service tag and the data unit descriptor to the data unit, and either direct the augmented data unit to a service module based on the service tag or forward the data unit to an egress line interface.

[0032] Fabric interface 304 may include hardware and/or software for providing an interface to switch fabric 204. Fabric interface 304 may include a buffer (not shown) for temporarily storing augmented data units. Without the buffer, the data units may be dropped if too many data units are produced at line interface 202 to be sent immediately to a service module or another line interface.

[0033] Classification table 306 may include rules for categorizing data units based on data unit headers. Examples of classification rules may include rules for performing an ACL lookup (e.g., if a field in a data unit header is one of specified values, perform a lookup into ACL 312), for performing a policy based routing (e.g., if a data unit header is a telephony data unit, route the data unit from X to Y via asynchronous transfer mode (ATM)), and for rendering differentiated quality of service (QoS). Forwarding table 308 may include information for identifying the egress line interface to forward an incoming data unit a network destination node based on the data unit's network destination address.

[0034] Redirection table 310 may include information for specifying one or more destination service modules. Redirection table 310 may be structured so that it minimizes the number of bits that are used to specify the destination. In one implementation, redirection table 310 may be directly attached to fabric interface and may be used to perform a lookup of the destination service modules. In the same implementation, the lookup may be performed after forwarding/classification/ACL lookups and before the packet is sent through fabric interface.

[0035] ACL 312 may include a list of rules that detail services or service ports that are available on network element 102. By performing an ACL lookup based on the data unit's class, a service tag may be obtained.

[0036] FIG. 4 is a block diagram of an exemplary redirection table 310. As shown, each row 402 of redirection table 310 (only one row shown for the sake of simplicity) may include a redirection number field 404, a Quality of Service (QoS) field 406, a destination field 408, and an action field 410. In different implementations, redirection table 310 may be structured differently (e.g., as a linked list) or may include rows with different fields.

[0037] Redirection number field 404 may contain a number that specifies a row in redirection table 310. Information that is needed for redirecting a data unit may be obtained by finding the row with a redirection number that matches a redirection index extracted from an augmented data unit. QoS field 406 may include a bit field for specifying a class of service for transporting a data unit across switch fabric 204. Destination field 408 may include a field for specifying one or more service modules as target destinations of the data unit. If the number of service modules in network element 102 is smaller than the largest number that can be expressed by destination field 408, destination field 408 may specify more than one target service module. For example, lower bits of destination field 408 may specify the first target and higher bits may specify the second target. Action field 410 field may specify one of four possible actions that a service module may perform after rendering a service for a data unit: no action; redirect the data unit to the next destination service module or a line interface; send a copy of the data unit to the next destination service module or the line interface; and unspecified.

[0038] The above paragraphs describe system elements that are related to devices and/or components for redirecting data units to service modules based on a service tag and a redirection table. FIG. 5 shows an exemplary process 500 that is capable of being performed by one or more of these devices and/or components.

[0039] Process 500 may begin at block 502, where a data unit may be received at line interface 202 (block 502). FIG. 6A is a block diagram of an exemplary data unit 602 that may be received at line interface 202. As shown, data unit 602 may include a data unit header 604 and a payload 606. Data unit header 604 may include information about the data unit, such as the version of Internet Protocol (IP) to which the data unit is compliant, the length of the data unit header, a type of transport service the data unit requires, a time to live value, a source IP address, a destination IP address, etc. Payload 606 may include data being transported or carried by data unit 602.

[0040] Returning to process 500, a data unit descriptor may be obtained (504). FIG. 6B shows a block diagram of a data unit descriptor 608. As shown, data unit descriptor 608 may include a destination switch fabric port field 610, a destination network port field 612, and another field 614. Depending on implementation, data unit descriptor 608 may include fewer, additional, or other fields than those shown in FIG. 6B.

[0041] Destination switch fabric port field 610 and destination network port field 612 may carry identifiers for specific ports on switch fabric 204 and a line interface. Other field 614 may carry other information relevant to the data unit. Information that is necessary to fill destination switch fabric port field 610 and destination network port field 612 may be obtained by performing a lookup in forwarding table 308.

[0042] A class of the data unit may be determined (block 506). Classification 306 table may be used to determine the class to which the data unit belongs based on, for example, headers of the data unit and/or destination address, port, etc. Each class may be related on different characteristics that pertain to the data unit, such as its security level that needs to be checked, its destination addresses, etc.

[0043] A service tag may be obtained based on the class of the data unit (block 508). In one implementation, the service tag may be obtained by looking up ACL 312 using the class as a key, by retrieving information from the ACL lookup, and by creating the service tag in accordance with the retrieved information.

[0044] FIG. 6C is a block diagram of the service tag 616. As shown, service tag 616 may include a redirect subcommand field 618, a redirection index field 620, and another field 622. In different implementations, service tag 616 may include fewer, additional, or different fields than the ones illustrated in FIG. 6C. Redirect subcommand field 618 may include information that can be used as a command or a hint by a service module. A subcommand in redirect subcommand field 618 may specify further processing that is required for the data unit. For example, a load balancing service module may examine redirect subcommand field 618, and upon detecting a requirement for security-related processing, may send the data unit to a firewall service module.

[0045] In addition, a service module may use the subcommand to assign the data unit to a particular hardware component or a service sub-module. For example, assume that redirect subcommand field 618 indicates that the data unit requires a fast response. At the load balancing module, the data unit may be assigned to a high priority process or thread based on the redirect subcommand.

[0046] Redirection index field 620 may include a number of the row in redirection table 310 at which information related to the data unit may be found. For example, assume that redirection index field 620 in service tag 616 contains number 12. At the 12^th row of redirection table 310, destination service modules of the data unit, as well as other relevant information, may be identified. Other field 622 may include other information related to the data unit (e.g., information related to flow of the data unit for fabric interface 304).

[0047] Returning to process 500, at block 510, the data unit may be augmented by appending data unit descriptor 608 and service tag 616 to data unit 602. FIG. 6D shows an augmented data unit that is appended with data unit descriptor 608 and service tag 616. As shown, data unit descriptor 608 may be attached to header 604, and service tag 616 may be attached to data unit descriptor 608.

[0048] A destination service module may be identified based on the redirection index of the service tag (block 512). The redirection index of the augmented data unit may be extracted and used to locate information in redirection table 310. Moreover, destination field 408 (FIG. 4) of the row of redirection table 310 whose redirection number matches the redirection index of the augmented data unit may be examined. Consequently, a service module that is designated in destination field 408 may be identified as the destination service module.

[0049] The augmented data unit may be sent to the destination service module (block 514). Sending the augmented data unit may entail conveying the augmented data unit to fabric interface 304, which may temporarily buffer the augmented data unit until the augmented data unit is ready to be transported via switch fabric 204.

[0050] The data unit may be processed at the destination service module (block 516). When the augmented data unit is received at the destination service module, the service module may render a service that is associated with the service module. For example, an IDS service module may run security tests on the data unit.

[0051] At block 518, the service module may take one of several possible after-service actions. In one case, if there is no further processing that is required for the augmented data unit, service tag 616 may be cleared (e.g., fill the fields of service tag 616 with “0's”) and the data unit may be sent to the original destination that is specified in data unit descriptor 608. For example, if an IDS service module determines that the augmented data unit does not pose a threat to the security of network element 102, the IDS service module may clear service tag 616 and send the data unit to an egress port in a line interface of network element 102.

[0052] In another case, when there is no further processing that is required, data unit descriptor 608 and contents of the data unit may be modified (e.g., network address). Depending on the modification, the data unit may be sent to a line interface that is different from one that has been originally specified. Examples of service modules that can change data unit descriptor 608 and/or the data unit contents may include a firewall service module and a load balancing service module.

[0053] In yet another case, if further processing is required, the service tag of the augmented data unit may be replaced with a new service tag, and the augmented data unit may be sent to another service module. For example, if the IDS service module determines that the data unit poses a potential threat, the IDS service module may rewrite the service tag and send the data unit to a service module that can examine the data unit in-depth. In another situation, the service tag may not be replaced, and the data unit may be sent to another service module that is specified in redirection table 310. In either of the above situations, process 500 may return to block 514 to repeat blocks 514-518.

[0054] In some cases, the augmented data unit may have been duplicated during services performed at a service module. In such instances, while the augmented data unit may be dropped or sent to another service module for further processing, the augmented data unit may not be sent to its network destination. A copy of the augmented data unit may already have been sent to the destination by the line interface that received the data unit.

[0055] In process 500, at each service module, the data unit may be directed to a next service module or a line interface without an ACL lookup. Because the ACL lookup requires additional processing, the data unit may be processed faster without the ACL lookup. In addition, using the service tag and the redirection table may spare a user or an administrator from having to treat each service module as a network destination node of the data unit and reconfiguring network parameters. Treating a service module as a network node may require an administrator or a user to perform burdensome and mistake-prone tasks that are associated with reconfiguring network parameters when a service module is added to and/or removed from network element 102.

[0056] The following example, with reference to FIG. 7, illustrates a process for redirecting data units to service modules based on a service tag and a redirection table. The example is consistent with the exemplary process described above with reference to FIG. 5.

[0057] In the example, as illustrated in FIG. 7, assume network element 700 includes line interfaces 702 and 704, a firewall service module 706, an IDS service module 708, and a switch fabric (not shown). In addition, assume that a data unit 710 arrives at line interface 702.

[0058] At line interface 702, service tag 712 and data unit descriptor 714 are obtained. Values for some of the fields in service tag 712 and data unit descriptor 714 are determined by performing lookups in forwarding table 308 and redirection table 310 (as described above with respect to FIG. 5). As the result of the lookups, destination switch fabric port field 610 in data unit descriptor 714 may designate a port on the switch fabric; destination network port field 612 may designate a port on egress line interface 704; and service tag 712 may designate firewall module 706 as its destination, indirectly via redirection table 310.

[0059] Once service tag 714, data unit descriptor 712, and data unit 710 are obtained, they are assembled to form an augmented data unit 716. Augmented data unit 716 is sent to firewall service module 706, as indicated by the arrow between firewall service module 706 and line interface 702 via a fabric interface (not shown) and the switch fabric.

[0060] When augmented data unit 716 arrives at firewall service module 706, firewall service module 706 determines that data unit 710 may be permitted to enter the network that is connected to network element 700. In addition, based on contents of redirect subcommand field 618 in service tag 712, firewall service module 706 determines that further processing is required at IDS service module 708. Firewall service module 706 replaces service tag 714 of augmented data unit 716 with service tag 718, which indirectly assigns IDS service module 708 as its next destination service module via redirection table 310. Augmented data unit 716 is sent to IDS service module 708.

[0061] When augmented data unit 716 enters IDS service module 708, IDS service module analyzes data unit 710 and determines data unit 710 has a valid authorization to enter network element 700. In addition, based on contents of redirect subcommand field 618, service tag 718 is cleared, and data unit 710 is sent to line interface 704, the original destination that is specified in data unit descriptor 608. At line interface 704, data unit 710 is sent to the network that is connected to network element 700.

[0062] The foregoing description of implementations provides illustration, but is not intended to be exhaustive or to limit the implementations to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the teachings.

[0063] For example, while series of blocks have been described with regard to an exemplary process illustrated in FIG. 5, the order of the blocks may be modified in other implementations. In addition, non-dependent blocks may represent acts that can be performed in parallel to other blocks.

[0064] It will be apparent that aspects described herein may be implemented in many different forms of software, firmware, and hardware in the implementations illustrated in the figures. The actual software code or specialized control hardware used to implement aspects does not limit the invention. Thus, the operation and behavior of the aspects were described without reference to the specific software code—it being understood that software and control hardware can be designed to implement the aspects based on the description herein.

[0065] Further, certain portions of the implementations have been described as “logic” that performs one or more functions. This logic may include hardware, such as a processor, an application specific integrated circuit, or a field programmable gate array, software, or a combination of hardware and software.

[0066] Even though particular combinations of features are recited in the claims and/or disclosed in the specification, these combinations are not intended to limit the invention. In fact, many of these features may be combined in ways not specifically recited in the claims and/or disclosed in the specification.

[0067] No element, act, or instruction used in the present application should be construed as critical or essential to the implementations described herein unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items. Where one item is intended, the term “one” or similar language is used. Further, the phrase “based on” is intended to mean “based, at least in part, on” unless explicitly stated otherwise.