Proxy-less wide area network acceleration

A method, system, and computer-usable medium are disclosed for network acceleration, comprising: responsive to receiving at an acceleration device a stream of one or more datagrams from a sending endpoint device within a first local area network of the acceleration device, the stream for transmission to a receiving endpoint device within a second local area network coupled to the first local area network by a wide area network: communicating by the acceleration device to the sending endpoint device a respective acknowledgement to each of the one or more datagrams; and transmitting by the acceleration device the one or more datagrams via multiple communication links of the wide area network to a second acceleration device within the second local area network and coupled to the receiving endpoint device.

FIELD OF DISCLOSURE

The present invention relates in general to the field of computers and similar technologies, and in particular to software utilized in this field. Still more particularly, it relates to a method, system and computer-usable medium for accelerating network communication in order to improve network security.

BACKGROUND

Many existing network firewalls and gateways are capable of implementing multilink topologies and Virtual Private Network (VPN) technologies, thus allowing for secure wide area network (WAN) connectivity between two endpoints. However, using existing technologies, endpoints that communicate to each other using a WAN communicate directly to each other through the WAN, which in turn may have an adverse effect on connection throughput and latency, preventing full saturation of WAN links. Accordingly, systems and methods which improve throughput and decrease latency may be desirable.

SUMMARY

In accordance with the teachings of the present disclosure, certain disadvantages and problems associated with existing approaches to network traffic transmission have been reduced or eliminated.

In accordance with embodiments of the present disclosure, a computer-implementable method for securing network communication may include, responsive to receiving at an acceleration device, a stream of one or more datagrams from a sending endpoint device within a first local area network of the acceleration device, the stream for transmission to a receiving endpoint device within a second local area network coupled to the first local area network by a wide area network: communicating by the acceleration device to the sending endpoint device a respective acknowledgement to each of the one or more datagrams; and transmitting by the acceleration device the one or more datagrams via multiple communication links of the wide area network to a second acceleration device within the second local area network and coupled to the receiving endpoint device.

In accordance with these and other embodiments of the present disclosure, a system may include a processor, a data bus coupled to the processor, and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations. The computer program code may be executable by the processor and configured for, responsive to receiving at an acceleration device a stream of one or more datagrams from a sending endpoint device within a first local area network of the acceleration device, the stream for transmission to a receiving endpoint device within a second local area network coupled to the first local area network by a wide area network: communicating by the acceleration device to the sending endpoint device a respective acknowledgement to each of the one or more datagrams; and transmitting by the acceleration device the one or more datagrams via multiple communication links of the wide area network to a second acceleration device within the second local area network and coupled to the receiving endpoint device.

In accordance with these and other embodiments of the present disclosure, a non-transitory, computer-readable storage medium embodying computer program code may be disclosed, the computer program code comprising computer executable instructions configured for, responsive to receiving at an acceleration device a stream of one or more datagrams from a sending endpoint device within a first local area network of the acceleration device, the stream for transmission to a receiving endpoint device within a second local area network coupled to the first local area network by a wide area network: communicating by the acceleration device to the sending endpoint device a respective acknowledgement to each of the one or more datagrams; and transmitting by the acceleration device the one or more datagrams via multiple communication links of the wide area network to a second acceleration device within the second local area network and coupled to the receiving endpoint device.

Technical advantages of the present disclosure may be readily apparent to one having ordinary skill in the art from the figures, description and claims included herein. The objects and advantages of the embodiments will be realized and achieved at least by the elements, features, and combinations particularly pointed out in the claims.

It is to be understood that both the foregoing general description and the following detailed description are explanatory examples and are not restrictive of the claims set forth in this disclosure.

DETAILED DESCRIPTION

For the purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an information handling system may be a personal computer, a personal data assistant (PDA), a consumer electronic device, a mobile device such as a tablet or smartphone, a connected “smart device,” a network appliance, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include volatile and/or non-volatile memory, and one or more processing resources such as a central processing unit (CPU) or hardware or software control logic. Additional components of the information handling system may include one or more storage systems, one or more communications ports for communicating with networked devices, external devices, and various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communication between the various hardware components.

FIG. 1illustrates an example information handling system100in which the methods and systems disclosed herein may be implemented, in accordance with embodiments of the present disclosure. Information handling system100may include a processor (e.g., central processor unit or “CPU”)102, input/output (I/O) devices104(e.g., a display, a keyboard, a mouse, and/or associated controllers), a storage system106, and various other subsystems108. In various embodiments, information handling system100may also include network port110operable to couple to a network140, which may likewise be accessible by a service provider server142. Information handling system100may also include system memory112, which may be coupled to the foregoing via one or more buses114. System memory112may store operating system (OS)116and in various embodiments may also include a WAN accelerator118. In some embodiments, information handling system100may be able to download WAN accelerator118from service provider server142. In other embodiments, WAN accelerator118may be provided as a service from the service provider server142.

In various embodiments, download WAN accelerator118may perform WAN acceleration of network communications between two endpoint devices of a network, as described in greater detail elsewhere in this disclosure. In some embodiments, WAN accelerator118and the functionality thereof improves processor efficiency, and thus the efficiency of information handling system100, by performing WAN acceleration with decreased processing resources as compared to existing approaches for communicating information over a network. In these and other embodiments, WAN accelerator118and the functionality thereof may improve an efficiency (e.g., increased throughput, decrease latency), and thus the effectiveness of information handling system100, by enabling network communication between endpoints with greater effectiveness than existing approaches for network communication. As will be appreciated, once information handling system100is configured to perform the functionality of WAN accelerator118, information handling system100becomes a specialized computing device specifically configured to perform the functionality of WAN accelerator118and is not a general purpose computing device. Moreover, the implementation of functionality of WAN accelerator118on information handling system100improves the functionality of information handling system100and provides a useful and concrete result of improving network communications by performing network acceleration using proxy-less WAN acceleration.

FIG. 2illustrates a block diagram of a system for performing deep packet inspection using cached inspection results, in accordance with embodiments of the present disclosure. In some embodiments, a security device220may include an external network interface222, a security configuration management interface226, and a WAN accelerator118. Security device220may be implemented using any suitable information handling system100, including without limitation a firewall, an intrusion prevention system, an intrusion detection system, or any other suitable security device capable of implementing WAN accelerator118. In some embodiments, security device220may be implemented as an individual security device220, a virtual context security device220, or a security device220cluster.

Security device220may also include in some embodiments a repository of deep packet inspection configuration settings234and a deep packet inspection cache236. In some embodiments, firewall configuration management interface226may be implemented to receive deep packet inspection configuration instructions from WAN accelerator118.

Security device220may also include in some embodiments a repository of WAN accelerator configuration settings234and a WAN accelerator cache236. In some embodiments, firewall configuration management interface226may be implemented to receive WAN acceleration configuration instructions from WAN accelerator118.

Skilled practitioners of the art will be familiar with multicast, which is commonly used in a network environment for simultaneously providing Internet Protocol (IP) datagrams, or packets, to a target group of recipient network addresses in real-time or near real-time. In some embodiments, the target group recipient network addresses may be respectively associated with a corresponding endpoint device ‘1’244through ‘n’246. As used herein, an endpoint device refers to an information processing system such as a personal computer, a laptop computer, a tablet computer, a personal digital assistant (PDA), a smart phone, a mobile telephone, a digital camera, a video camera, or other device capable of storing, processing and communicating data via a network, such as an internal network240. In various embodiments, the communication of the data may take place in real-time or near-real-time.

Embodiments of the invention may reflect an appreciation that network communication may represent an efficient means for communicating useful information. However, those of skill in the art will likewise appreciate that existing technologies do not provide full saturation of WAN links for communication of network traffic between endpoints. Those of skill in the art may appreciate that traditional approaches to WAN communication allow for accurate communication, but with undesirable throughput and latency.

In operation, WAN accelerator118may perform proxy-less acceleration of communication between endpoints of a network which have a WAN interfaced between the endpoints. As described in greater detail elsewhere in this disclosure, WAN accelerator118may be configured to maximize WAN communication throughput and minimize WAN communication latency by, when on the transmission end of a network communication, actively acknowledging data transmitted by the transmitting endpoint and compressing the data stream, and by, when on the receiving end of a network communication, providing for decompression and reassembling of a data stream. In addition, WAN accelerators118on both the receive end and transmission end of a data stream may provide for fast retransmit and error recovery of data, as also described in greater detail below.

FIG. 3illustrates a block diagram of an example network300in which a VPN may be implemented, in accordance with embodiments of the present disclosure. As shown inFIG. 3, network300may include a first site labeled as site A that may include internal network240A, a firewall/gateway220A, and one or more interfaces306A. Network300may similarly include a second site labeled as site B that may include internal network240B, a firewall/gateway220B, and one or more interfaces306B. Interfaces306A may be coupled to interfaces306B via a WAN308. In some embodiments, WAN308my comprise the Internet and interfaces306A and306B may comprise Internet service providers (ISPs). In other embodiments, WAN308may comprise a multiple-protocol label switching network, a network of leased lines, or any other suitable network.

Each of internal network240A and240B may include an instance of an internal network240ofFIG. 2, and thus, may include one or more endpoint devices of which network devices244and246are examples. In addition, each of firewall/gateway220A and220B may include an instance of a firewall/gateway220ofFIG. 2, and thus, may implement or otherwise include an instance of a WAN accelerator118. AlthoughFIG. 3illustrates one possible topology for network300which is configured as a multi-interface (e.g., multi-ISP) VPN, network300may be implemented in other topologies, including those in which one or both of sites A and B include only a single interface306A/306B, and/or including those in which a cluster of firewalls/gateways304A/304B is used in lieu of a single firewall/gateway304A/304B.

In operation, skilled practitioners in the art may recognize that the various components of network300may be used to implement secured multi-link communication between a single endpoint within internal network240A and a single endpoint within internal network240B, in that communication between the single endpoint of network240A and the single endpoint of network240B may be simultaneously routed over multiple links of wide area network308in order to provide communication with high availability and high bandwidth. However, as mentioned above, skilled practitioners may appreciate that existing approaches to multi-link communication may not allow for full saturation of the various links present in a wide area network.

In operation, a firewall/gateway220(e.g.,220A or220B) may be capable of functioning both as a transmit-side firewall/gateway220and a receive-side firewall gateway220. For example, in a transmission from an endpoint within internal network240A to an endpoint within internal network240B, firewall/gateway220A would be considered the transmit-side firewall/gateway220for such transmission and firewall/gateway220B would be considered the receive-side firewall/gateway220for such transmission. Similarly, in a transmission from an endpoint within internal network240B to an endpoint within internal network240A, firewall/gateway220B would be considered the transmit-side firewall/gateway220for such transmission and firewall/gateway220A would be considered the receive-side firewall/gateway220for such transmission.

When functioning as a transmit-side firewall/gateway220, a firewall/gateway220may be configured to, upon receipt of a datagram from an endpoint at the same LAN site of the transmit-side firewall/gateway220for transmission to another LAN site via WAN308, communicate an acknowledgement of the transmitted datagram to the endpoint. By actively acknowledging datagrams, rather than traditional approaches in which acknowledgments are communicated from the receiving endpoint of a transmission, transmit-side firewall/gateway220may cause the transmitting endpoint at the site of transmit-side firewall/gateway220to more quickly transmit a stream of datagrams to transmit-side firewall/gateway220, as the transmitting endpoint may “think” that datagrams are being successfully received by the receiving endpoint at the other site.

After acknowledging datagrams received from the transmitting endpoint, the transmit-side firewall/gateway220may immediately compress and appropriately balance the datagram traffic among the links of WAN308without buffering and/or ordering the traffic as may be required in existing proxy-based approaches. The transmit-side firewall/gateway220may also, in the event of full saturation of communication links of WAN308, queue datagrams (e.g., within WAN accelerator cache) for communication via WAN308.

Further, the transmit-side firewall/gateway220may store datagrams to be communicated over WAN308in an appropriate window or buffer (e.g., a Transmission Control Protocol or “TCP” window) until such time as an acknowledgment of such datagrams has been received by the transmit-side firewall/gateway220from the receive-side firewall/gateway220via WAN308. Accordingly, in the event of datagram loss within WAN308, the transmit-side firewall/gateway220may be able to perform a retransmit of lost datagrams to the receive-side firewall/gateway220.

When functioning as a receive-side firewall/gateway220, a firewall/gateway220may be configured to, upon receipt of a datagram from the transmit-side firewall/gateway220via WAN308, communicate an acknowledgement of the transmitted datagram to the transmit-side firewall/gateway220. As datagrams are received by the receive-side firewall/gateway220, the receive-side firewall/gateway220may decompress the datagrams and reorder the datagrams. For example, the receive-side firewall/gateway220may reorder the datagrams in an appropriate queue of WAN accelerator cache236. After datagrams are properly reordered, the receive-side firewall/gateway220may communicate the datagrams to the appropriate receiving endpoint. Reordering may be required because multiple links are used and datagrams may arrive out of order.

Further, the receive-side firewall/gateway220may implement fast retransmit (e.g. TCP Fast Transmit) and/or error recovery services to recover potential loss of datagrams within WAN308, as well as maintain a queue (e.g., within WAN accelerator cache236) of datagrams communicated to but not yet acknowledged by the receiving endpoint, in order to perform retransmission of lost datagrams.

The proxy-less WAN acceleration described herein may provide for improved network communication over that of existing proxy-to-proxy implementation, which requires significant overhead for network traffic, and due to the fact that a proxy by its very nature requires more resource consumption than the proxy-less approach described above, which may be implemented utilizing only standard Transmit Control Protocol/Internet Protocol (TCP/IP) protocols.