Patent application EP17306699A (EP), filed 2017-12-04
Publication number: EP3493058A1
Title: METHOD AND DEVICE FOR MIGRATING A STATEFUL FUNCTION
Abstract: A first salient idea is to keep the traffic flowing though the migrating stateful function, without freezing any connection as the traffic is steered, and to process the data traffic by the first instance as the migration is ongoing when the data traffic corresponds to an existing state and does not require any state update. A second salient idea is to forward the data traffic received by the first instance to the second instance when the data traffic corresponds to a new state created or an existing state updated by the first instance as the migration is ongoing. The first instance will process the traffic with or without forwarding to the second instance as long as it receives any data traffic. The migration terminates when the first instance no longer receives any data traffic. The data traffic, forwarded by the first instance to the second instance, is forwarded together with a metadata describing the new state creation or the existing state update, allowing the second instance to process both the data traffic resulting from a traffic steered from to the second instance and the traffic still buffered by the first instance after the migration started, resulting in a data loss less migration. Processing the data traffic by the first instance for existing states without forwarding to the second instance and forwarding the data traffic from the first instance to the second instance along with a metadata allows to keep a high level of performance of the stateful function by maintaining the data processing by the first instance while the second instance is starting, and to avoid any data loss during the migration by forwarding the data traffic received and processed, after the migration started, by the first instance, along with the metadata for any new state to the second instance.
IPC codes: G06F   9/   448            A I
G06F   9/   455            A I
G06F   9/    48            A I
H04L  29/    08            A I
Claims: number: 1
text: A method for migrating a stateful function from a first instance (SNF1) to a second instance (SNF2), the stateful function processing data items of a data flow according to a set of states, the method comprising in the first instance (SNF1):
number: 2
text: The method according to claim 1, wherein if a state is updated by the first instance (SNF1) as said migrating is ongoing, the data item (200C) is forwarded from the first instance (SNF1) to the second instance (SNF2) together with an updated information item describing the updated state.
number: 3
text: A method for migrating a stateful function from a first instance (SNF1) to a second instance (SNF2), the stateful function processing data items (200A, 202A, 200B, 202B, 200C, 202C) of a data flow according to a set of states, the method comprising in the second instance (SNF2):
number: 4
text: The method according to claim 3, further comprising:
number: 5
text: The method according to claim 1 or 2, wherein applying the stateful function to the data item (200A, 202A, 200B, 202B, 200C, 202C) comprises extracting a key from the data item (200A, 202A, 200B, 202B, 200C, 202C) and processing the data item (200A, 202A, 200B, 202B, 200C, 202C) according to the state corresponding to the key.
number: 6
text: The method according to any of claims 1 to 5, wherein the stateful function operates between an egress network interface (230) and an ingress network (240) interface, said extracting a key from a data item comprising extracting an egress key if the data item (200A, 200B, 200C) is received from the egress network interface (230), and extracting an ingress key if the data item (202A, 202B, 202C) is received from the ingress network interface (240).
number: 7
text: The method according to claim 6, wherein the new state is created if there is no state in the set of states corresponding to the egress key.
number: 8
text: The method according to any of claims 5 to 7, wherein processing the data item (202A, 202B, 202C) comprises dropping the data item if there is no state in the set of states corresponding to the ingress key.
number: 9
text: The method according to any of claims 5 to 8, wherein the stateful function comprises a network address translation, and creating the new state comprises allocating a translated port identifier different from the translated port identifiers of already existing states.
number: 10
text: The method according to any of claims 5 to 8, wherein the stateful function comprises a stateful firewall, and processing the data item (200A, 202A, 200B, 202B, 200C, 202C) comprises updating the state with a time of reception of the data item.
number: 11
text: A first processing device (3) for migrating a stateful function from a first instance to a second instance, the first instance running on the first processing device (3), the stateful function processing data items (200A, 202A, 200B, 202B, 200C, 202C) of a data flow according to a set of states, the first processing device (3) comprising means for:
number: 12
text: The first processing device (3) according to claim 11, wherein if a state is updated by the first instance as said migrating is ongoing, the data item (200C) is forwarded from the first instance to the second instance together with an updated information item describing the updated state.
number: 13
text: A second processing device (3) for migrating a stateful function from a first instance to a second instance, the second instance running on second processing device, the stateful function processing data items (200A, 202A, 200B, 202B, 200C, 202C) of a data flow according to a set of states, the second processing device comprising means for:
number: 14
text: The second processing device (3) according to claim 13, further comprising means for:
number: 15
text: A computer program product for migrating a stateful function from a first instance to a second instance, the computer program product comprising program code instructions executable by a processor for:
Office action: search_report, dated 2019-06-05
Rejection reasons: novelty_epc_54
inventive_step_epc_56
Prior art cited: ref_id: US2014101656A1
ref_type: patent
severity: background
ref_id: US2017230333A1
ref_type: patent
severity: background
ref_id: EP2797295A1
ref_type: patent
severity: background
ref_id: [XYI]     - CHEN XIANQIN ET AL: "Seamless virtual machine live migration on network security enhanced hypervisor", 18 October 2009, BROADBAND NETWORK&MULTIMEDIA TECHNOLOGY, 2009. IC-BNMT '09. 2ND IEEE INTERNATIONAL CONFERENCE ON, IEEE, PISCATAWAY, NJ, USA, PAGE(S) 847 - 853, ISBN: 978-1-4244-4590-5, XP031576211
ref_type: npl
severity: background
ref_id: - SHIRIN BATENI ET AL: "DESIGN A SECURITY FIREWALL POLICY TO FILTER INCOMING TRAFFIC IN PACKET SWITCHED NETWORKS USING CLASSIFICATION METHODS", CIÊNCIA E NATURA, 1 February 2014 (2014-02-01), Santa Maria, pages 821, XP055475900, Retrieved from the Internet <URL:http://ijcsns.com/february.2014-volume.2-no.2//article01.pdf> [retrieved on 20180516]
ref_type: npl
severity: background
ref_id: US2014101656
ref_type: patent
severity: obviousness
ref_id: EP2797295
ref_type: patent
severity: obviousness
ref_id: US2017230333
ref_type: patent
severity: obviousness
ref_id: - CHEN XIANQIN ET AL, Seamless virtual machine live migration on network security enhanced hypervisor, BROADBAND NETWORK&MULTIMEDIA TECHNOLOGY, 2009. IC-BNMT '09. 2ND IEEE INTERNATIONAL CONFERENCE ON, IEEE, PISCATAWAY, NJ, USA, PAGE(S) 847 - 853, (20091018), ISBN 978-1-4244-4590-5, XP031576211 [X] 1-6,8,10-15 * figures 1,2 * * page 849, section 3, Step1-Step5 * * page 847, right column, 3rd paragraph, last paragraph * * page 849, left column, section 3 * * page 848, right column, section 2.2 * * page 849, right column, 3rd bullet-point * [Y] 9 [I] 7
ref_type: npl
severity: novelty_destroying
ref_id: - Shirin Bateni ET AL, "DESIGN A SECURITY FIREWALL POLICY TO FILTER INCOMING TRAFFIC IN PACKET SWITCHED NETWORKS USING CLASSIFICATION METHODS", Ciência e Natura, Santa Maria, (20140201), page 821, URL: http://ijcsns.com/february.2014-volume.2-no.2//article01.pdf, (20180516), XP055475900 [A] 1-15 * page 6, section Firewall logs *
ref_type: npl
severity: background
Final disposition: pending (2019-06-05)