Abstract:
Systems and methods for a distributed multi-processing security gateway establishes a host side session, selects a proxy network address for a server based on network information, and using the proxy network address to establish a server side session. The proxy network address is selected such that a same processing element is assigned to process data packets from the server side session and the host side session. The network information includes a security gateway network address and a host network address. By assigning processing elements in this manner, higher capable security gateways are provided.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This patent application is a continuation of, and claims the priority benefit of, U.S. patent application Ser. No. 14/044,673 filed on Oct. 2, 2013, now U.S. Pat. No. 9,032,502 issued on May 12, 2015, and entitled “System and Method for Distributed Multi-Processing Security Gateway,” which in turn is a continuation of, and claims the priority benefit of, U.S. patent application Ser. No. 13/666,979 filed on Nov. 2, 2012, now U.S. Pat. No. 8,595,819 issued on Nov. 26, 2013, and entitled “System and Method for Distributed Multi-Processing Security Gateway,” which in turn is a continuation of U.S. patent application Ser. No. 11/501,607 filed on Aug. 8, 2006, now U.S. Pat. No. 8,332,925 issued on Dec. 11, 2012, and entitled “System and Method for Distributed Multi-Processing Security Gateway.” The disclosures of all of the above are incorporated herein by reference in their entirety. 
    
    
     TECHNICAL FIELD 
     This invention relates generally to data networking, and more specifically, to a system and method for a distributed multi-processing security gateway. 
     BACKGROUND 
     Data network activities increases as more and more computers are connected through data networks, and more and more applications utilize the data networks for their functions. Therefore, it becomes more important to protect the data network against security breaches. 
     There are currently many security gateways such as firewalls, VPN firewalls, parental control appliances, email virus detection gateways, special gateways for phishing and spyware, intrusion detection and prevention appliances, access control gateways, identity management gateways, and many other types of security gateways. These products are typical implemented using a general purpose micro-processor such as Intel Pentium, an AMD processor or a SPARC processor, or an embedded micro-processor based on RISC architecture such as MIPS architecture, PowerPC architecture, or ARM architecture. 
     Micro-processor architectures are limited in their processing capability. Typically they are capable of handling up to a gigabit per second of bandwidth. In the past few years, data network bandwidth utilization increases at a pace faster than improvements of microprocessor capabilities. Today, it is not uncommon to see multi-gigabit per second of data network bandwidth utilization in many medium and large secure corporate data networks. It is expected such scenarios to become more prevailing in most data networks, including small business data network, residential networks, and service provider data networks. 
     The trend in the increasing usage of data networks illustrates a need for better and higher capable security gateways, particularly in using multiple processing elements, each being a micro-processor or based on micro-processing architecture, to work in tandem to protect the data networks. 
     SUMMARY 
     A system and method for a distributed multi-processing security gateway establishes a host side session, selects a proxy network address for a server based on network information, and using the proxy network address to establish a server side session. The proxy network address is selected such that a same processing element is assigned to process data packets from the server side session and the host side session. The network information includes a security gateway network address and a host network address. By assigning processing elements in this manner, higher capable security gateways are provided. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1   a  illustrates a secure data network. 
         FIG. 1   b  illustrates an overview of a network address translation (NAT) process. 
         FIG. 1   c  illustrates a NAT process for a TCP session. 
         FIG. 2  illustrates a distributed multi-processing security gateway. 
         FIG. 3  illustrates a dispatching process. 
         FIG. 4  illustrates a proxy network address selection process. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1   a  illustrates a secure data network. Security gateway  170  protects a secure data network  199 . 
     In one embodiment, secure data network  199  is a residential data network. In one embodiment, secure data network  199  is a corporate network. In one embodiment, secure data network  199  is a regional corporate network. In one embodiment, secure data network  199  is a service provider network. 
     In one embodiment, security gateway  170  is a residential broadband gateway. In one embodiment, security gateway  170  is a corporate firewall. In one embodiment, security gateway  170  is a regional office firewall or a department firewall. In one embodiment, security gateway  170  is a corporate virtual private network (VPN) firewall. In one embodiment, security gateway  170  is an Internet gateway of a service provider network. 
     When host  130  inside secure data network  199  accesses a server  110  outside secure data network  199 , host  130  establishes a session with server  110  through security gateway  170 . Data packets exchanged within the session, between host  130  and server  110 , pass through security gateway  170 . Security gateway  170  applies a plurality of security policies during processing of the data packets within the session. Examples of security policies include network address protection, content filtering, virus detection and infestation prevention, spyware or phishing blocking, network intrusion or denial of service prevention, data traffic monitoring, or data traffic interception. 
       FIG. 1   b  illustrates an overview of a network address translation (NAT) process. 
     In one embodiment, a security policy is to protect network address of host  130 . Host  130  uses a host network address  183  in a session  160  between host  130  and server  110 . In one embodiment, the host network address  183  includes an IP address of host  130 . In another embodiment, the host network address  183  includes a session port address of host  130 . 
     Security gateway  170  protects host  130  by not revealing the host network address  183 . When host  130  sends a session request for session  160  to security gateway  170 , the session request includes host network address  183 . 
     Security gateway  170  establishes host side session  169  with host  130 . Host  130  uses host network address  183  in session  169 . 
     Security gateway  170  selects a proxy network address  187 . Security gateway  170  uses proxy network address  187  to establish server side session  165  with server  110 . 
     Server side session  165  is the session between security gateway  170  and server  110 . Host side session  169  is the session between security gateway  170  and host  130 . Session  160  includes server side session  165  and host side session  169 . 
     Security gateway  170  performs network address translation (NAT) process on session  160 . Security gateway  170  performs network address translation process on data packets received on server side session  165  by substituting proxy network address  187  with host network address  183 . Security gateway  170  transmits the translated data packets onto host side session  169 . Similarly, security gateway  170  performs network address translation process on data packets received on host side session  169  by substituting host network address  183  with proxy network address  187 . Security gateway  170  transmits the translated data packets onto server side session  165 . 
     In one embodiment, session  160  is a transmission control protocol (TCP) session. In one embodiment, session  160  is a user datagram protocol (UDP) session. In one embodiment, session  160  is an internet control messaging protocol (ICMP) session. In one embodiment, session  160  is based on a transport session protocol on top of IP protocol. In one embodiment, session  160  is based on an application session protocol on top of IP protocol. 
       FIG. 1   c  illustrates a NAT process for a TCP session. 
     Host  130  sends a session request  192  for establishing a session  160  with server  110 . Session  160  is a TCP session. Session request  192  includes host network address  183  and server network address  184 . Security gateway  170  receives session request  192 . Security gateway  170  extracts host network address  183  from session request  192 . Security gateway  170  determines a proxy network address  187 . In one embodiment, host network address  183  includes a host&#39;s IP address, and security gateway  170  determines a proxy IP address to substitute host&#39;s IP address. In one embodiment, host network address  183  includes a host&#39;s TCP port number, and security gateway  170  determines a proxy TCP port number to substitute host&#39;s TCP port number. Security gateway  170  extracts server network address  184  from session request  192 . Security gateway  170  establishes a server side session  165  with server  110  based on server network address  184  and proxy network address  187 . Server side session  165  is a TCP session. 
     Security gateway  170  also establishes a host side session  169  with host  130  by responding to session request  192 . 
     After establishing server side session  165  and host side session  169 , security gateway  170  processes data packets from server side session  165  and host side session  169 . 
     In one embodiment, security gateway  170  receives a data packet  185  from server side session  165 . Data packet  185  includes server network address  184  and proxy network address  187 . Security gateway  170  extracts server network address  184  and proxy network address  187 . Security gateway  170  determines host side session  169  based on the extracted network addresses. Security gateway  170  further determines host network address  183  from host side session  169 . Security gateway  170  modifies data packet  185  by first substituting proxy network address  187  with host network address  183 . Security gateway  170  modifies other parts of data packet  185 , such as TCP checksum, IP header checksum. In one embodiment, security gateway  170  modifies payload of data packet  185  by substituting any usage of proxy network address  187  with host network address  183 . 
     After security gateway  170  completes modifying data packet  185 , security gateway  170  transmits the modified data packet  185  onto host side session  169 . 
     In a similar fashion, security gateway  170  receives a data packet  188  from host side session  169 . Data packet  188  includes server network address  184  and host network address  183 . Security gateway  170  extracts server network address  184  and host network address  183 . Security gateway  170  determines server side session  165  based on the extracted network addresses. Security gateway  170  further determines proxy network address  187  from server side session  165 . Security gateway  170  modifies data packet  188  by first substituting host network address  183  with proxy network address  187 . Security gateway  170  modifies other parts of data packet  188 , such as TCP checksum, IP header checksum. In one embodiment, security gateway  170  modifies payload of data packet  188  by substituting any usage of host network address  183  with proxy network address  187 . 
     After security gateway  170  completes modifying data packet  188 , security gateway  170  transmits the modified data packet  188  onto server side session  165 . 
       FIG. 2  illustrates a distributed multi-processing security gateway. 
     In one embodiment, security gateway  270  is a distributed multi-processing system. Security gateway  270  includes a plurality of processing elements. A processing element  272  includes a memory module. The memory module stores host network addresses, proxy network addresses and other information for processing element  272  to apply security policies as described in  FIG. 1 . Processing element  272  has a processing element identity  273 . 
     Security gateway  270  includes a dispatcher  275 . Dispatcher  275  receives a data packet and determines a processing element to process the data packet. Dispatcher  275  typically calculates a processing element identity based on the data packet. Based on the calculated processing element identity, security gateway  270  assigns the data packet to the identified processing element for processing. 
     In one embodiment, dispatcher  275  receives a data packet  288  from host side session  269  and calculates a first processing element identity based on the host network address and server network address in data packet  288 . In another embodiment dispatcher  275  receives a data packet  285  from server side session  265  and calculates a second processing element identity based on the proxy network address and server network address in data packet  285 . 
     Security gateway  270  includes a network address selector  277 . Network address selector  277  selects a proxy network address based on network information. The network information includes a host network address obtained in a session request for session  260  and a security gateway network address. Other types of network information may also be used. The proxy network address is used to establish server side session  265 . The proxy network address is selected such that the first processing element identity and the second processing element identity calculated by dispatcher  275  are the same. In other words, a same processing element is assigned to process data packet  285  from server side session  265  and data packet  288  from host side session  269 . 
       FIG. 3  illustrates a dispatching process. 
     Dispatcher  375  calculates a processing element identity based on two network addresses obtained from a data packet  385  of session  360 . Session  360  includes host side session  369  and server side session  365 . The two network addresses of host side session  369  are server network address and host network address. The two network addresses of server side session  365  are proxy network address and server network address. Dispatcher  375  calculates to the same processing element identity for host side session  369  and server side session  365 . 
     In one embodiment, dispatcher  375  calculates based on a hashing function. 
     In one embodiment, dispatcher  375  computes a sum by adding the two network addresses. In one example, dispatcher  375  computes a sum by performing a binary operation, such as an exclusive or (XOR) binary operation, or an and (AND) binary operation, onto the two network addresses in binary number representation. In one example, dispatcher  375  computes a sum by first extracting portions of the two network addresses, such as the first 4 bits of a network address, and applies an operation such as a binary operation to the extracted portions. In one example, dispatcher  375  computes a sum by first multiplying the two network addresses by a number, and by applying an operation such as addition to the multiple. 
     In one embodiment, dispatcher  375  computes a processing element identity by processing on the sum. In one embodiment, there are 4 processing elements in security gateway  370 . In one example, dispatcher  375  extracts the first two bits of the sum, and interprets the extracted two bits as a numeric number between 0 and 3. In one example, dispatcher  375  extracts the first and last bit of the sum, and interprets the extracted two bits as a numeric number between 0 and 3. In one example, dispatcher  375  divides the sum by 4 and determines the remainder of the division. The remainder is a number between 0 and 3. 
     In one embodiment, security gateway  370  includes 8 processing elements. Dispatcher  375  extracts 3 bits of the sum and interprets the extracted three bits as a numeric number between 0 and 7. In one example, dispatcher  375  divides the sum by 8 and determines the remainder of the division. The remainder is a number between 0 and 7. 
     In one embodiment, a network address includes an IP address and a session port address. Dispatcher  375  computes a sum of the IP addresses and the session port addresses of the two network addresses. 
     Though the teaching is based on the above description of hashing functions, it should be obvious to the skilled in the art to implement a different hashing function for dispatcher  375 . 
       FIG. 4  illustrates a proxy network address selection process. 
     Network address selector  477  selects a proxy network address  487  for a host network address  483 . In one embodiment, host network address  483  includes a host IP address  484  and a host session port address  485 ; proxy network address  487  includes a proxy IP address  488  and a proxy session port address  489 . Proxy network address  487  is selected such that dispatcher  475  calculates to the same processing element identity on host side session  469  and server side session  465 . Session  460  includes server side session  465  and host side session  469 . 
     In one embodiment, the selection process is based on the dispatching process, illustrated in  FIG. 3 . In one example, dispatcher  475  uses the method of computing the sum of two IP addresses, and two session port addresses, and then divides the sum by 4. In one embodiment, network address selector  477  first selects proxy IP address  488 . Network address selector  477  then selects proxy session port address  489  such that when using the method on server network address  490  and host network address  483  dispatcher  475  calculates the same processing element identity as when using the method on server network address  490  and proxy network address  487 . 
     In one example, dispatcher  475  computes a sum from a binary operator XOR of the two network addresses, and extracts the last 3 digits of the sum. Network address selector  477  selects a proxy session port address  489  that has the same last 3 digits of the host session port address  485 . 
     In one embodiment, security gateway  470  performs network address translation process for a plurality of existing sessions. Network address selector  477  checks if the selected proxy network address  487  is not used in the plurality of existing sessions. In one embodiment, security gateway  470  includes a datastore  479 . Datastore  479  stores a plurality of proxy network addresses used in a plurality of existing sessions. Network address selector  477  determines the selected proxy network address  487  is not used by comparing the selected proxy network address  487  against the stored plurality of proxy network addresses and not finding a match. 
     In one embodiment, a processing element includes network address selector. A processing element receives a data packet assigned by security gateway based on a processing element identity calculated by dispatcher. In one embodiment, the processing element determines that the data packet includes a session request. The network address selector in the processing element selects a proxy network address based on the host network address in the session request as illustrated in  FIG. 4 . 
     In one embodiment, a particular first processing element includes network address selector. A second processing element without network address selector receives a data packet and determines that the data packet includes a session request. The second processing element sends the data packet to the first processing element using, for example, a remote function call. The first processing element receives the data packet. The network address selector selects a proxy network address based on the host network address in the session request. 
     In one embodiment, datastore is implemented in the memory module of a processing element. In one embodiment, the plurality of proxy network addresses in datastore are stored in each of the memory modules of each of the processing elements. In one embodiment, the plurality of proxy network addresses in datastore are stored in the memory modules in a distributive manner, with the proxy network addresses used in the sessions processed by a processing element stored in the memory module of the processing element. 
     In one embodiment, security gateway includes a memory shared by the plurality of process elements. Security gateway partitions the shared memory into memory regions. A process element has access to a dedicated memory region, and does not have access to other memory regions. 
     In one embodiment, security gateway includes a central processing unit. In one embodiment, the central process unit includes a plurality of processing threads such as hyper-thread, micro-engine or other processing threads implemented in circuitry such as application specific integrated circuit (ASIC) or field programmable gate array (FPGA). A processing element is a processing thread. 
     In one embodiment, a central processing unit includes a plurality of micro-processor cores. A processing thread is a micro-processor core. 
     In one embodiment, a security policy is for virus detection or blocking. In one embodiment, a security policy is for phishing detection or blocking. In one embodiment, a security policy is for traffic quota enforcement. In one embodiment, a security policy is for lawful data interception. 
     In one embodiment, the NAT process is for a UDP session. In one embodiment, security gateway receives a UDP packet. In one embodiment, security gateway determines that the UDP packet is not from an existing session. Security gateway processes the UDP packet as a session request. 
     In one embodiment, the NAT process is for an ICMP session. In a similar fashion, security gateway processes an ICMP packet from a non-existing session as a session request.