Managing network services using multi-path protocols

Abstract

Techniques related to managing network services using a multipath protocol are disclosed. In one example, a method includes intercepting a multipath protocol request from a requesting host for a connection to a service. The multipath protocol request is intercepted by an intermediary server. A target host different from the intermediary server can be selected to provide the service. A multipath protocol packet can be sent from the intermediary server to the requesting host. The multipath protocol packet can add a subflow of the connection using an address of the target host. The subflow can cause a path between the requesting host and the target host to not traverse the intermediary server.

Description

Technical Field

[0001] This technology generally relates to network traffic management, and more specifically to managing network services when network traffic uses multipath protocols. Background Technology

[0002] Software applications can be distributed or partitioned across different computing devices. For example, a client-server architecture can partition tasks between client devices (such as laptops or mobile devices) and one or more application server computers connected via an interconnected network (such as the Internet) and managed by a provider of computing services and / or computing resources. The application server computers can execute software applications to provide virtual resources, software services, and / or content to the client devices. For example, a client device can initiate a communication session with an application server computer by sending a request over the interconnected network, and the server can respond to the request. As the number of client devices seeking access to the application server computers increases, intermediate computing devices, such as network traffic management computing devices, can be added between the client devices and the application server computers. Network traffic management computing devices can perform security, processing, and / or routing functions on the client-server architecture, such as encrypting and / or decrypting traffic between the client and the application server. For example, network traffic management computing devices can potentially improve the scalability, availability, security, and / or performance of the client-server architecture. However, with increasing application complexity and the number of interconnected devices, there may be many challenges in implementing a high-performance, highly available, and secure client-server architecture that includes intermediate computing devices. Summary of the Invention

[0003] Typically, a system of one or more computers can be configured to perform a specific operation or action by installing software, firmware, hardware, or a combination thereof on the system, which, in operation, causes the system to perform the action. One or more computer programs can be configured to perform a specific operation or action by including instructions that, when executed by a data processing device, cause the device to perform the action. One example includes a method implemented in conjunction with a network traffic management system, which includes one or more network traffic management modules, networking modules, or server modules, the method comprising: intercepting a multipath protocol request from a requesting host for a connection to a service, wherein the multipath protocol request is intercepted by an intermediate server. The method further includes selecting a target host different from the intermediate server to provide the service. The method further includes sending a multipath protocol data packet from the intermediate server to the requesting host. The multipath protocol data packet adds a sub-stream of the connection using the address of the target host. The sub-stream ensures that the path between the requesting host and the target host does not traverse the intermediate server.

[0004] Other embodiments including this example include corresponding computer systems, devices, and computer programs recorded on one or more non-transitory computer-readable media (e.g., computer storage devices), each configured to perform the actions of the method. An exemplary computer system includes: one or more network traffic management modules, networking modules, or server modules; a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to perform the actions of the method. An exemplary non-transitory computer-readable medium stores instructions for managing network services using a multipath protocol, the instructions including executable code that, when executed by one or more processors, causes the processors to perform the actions of the method. An exemplary network traffic management device includes a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to perform the actions of the method. Attached Figure Description

[0005] Figure 1 This is a block diagram of an exemplary client-server architecture that includes an intermediate server computer using a multipath protocol.

[0006] Figure 2 An exemplary network stack including a multipath protocol is shown.

[0007] Figure 3 An exemplary multipath protocol packet format is shown.

[0008] Figure 4 This is a block diagram of an exemplary service chain for providing network services.

[0009] Figure 5 It is a block diagram of an exemplary intermediate server computer that can be used to provide network services using a multipath protocol.

[0010] Figure 6 This is a flowchart of an exemplary method for managing network services using a multipath protocol.

[0011] Figure 7 This is a flowchart of an exemplary method for managing network services using multipath protocols, such as when implementing services using service chains.

[0012] Figure 8 It is a block diagram of an exemplary client-server architecture that includes logic for managing network services using multipath protocols.

[0013] Figure 9 It is a block diagram of an exemplary computing environment, such as that that can be used in a server computer. Detailed Implementation

[0014] introduce

[0015] As described above, software applications can be distributed or partitioned across different computing devices, such as through client-server, peer-to-peer, or other network computing architectures. Specifically, the computing, communication, and storage resources used to implement the application can be partitioned among different agents and / or devices. For example, the application's tasks can be divided into network services and distributed among different server computers communicating via an interconnected network. As an example, a network service can be a component of a distributed application that is accessible over a network and uses application-layer protocols. For example, a network service can be implemented in a client-server or peer-to-peer architecture and can provide computing and / or storage functionality in response to requests for the service. Furthermore, network services can perform tasks related to the maintenance, security, optimization, and other aspects of the network architecture. For example, network services can be used to encrypt and decrypt confidential information, prevent network attacks, maintain the proper operation of the network, and so on.

[0016] One network architecture is a client-server architecture. For example, a client device can provide a user interface for users of an application and allow them to interact with the software application. Using the user interface, users can input data and / or commands, which cause the client device to initiate a communication session with the application server computer, such as by sending a request over the network. The application server can respond to the request with content that can be presented on the user interface at the client device. As an example, a client device running a browser can request a web page from a web server and display the web page within a browser window on the client device's display. Another network architecture is a peer-to-peer architecture. In a peer-to-peer architecture, peers can have the same or similar permissions and can perform similar types of tasks. For example, an application for forecasting the weather can be partitioned among different peer computers, where each computer performs a portion of the computation. Each network architecture can also include an intermediary agent that performs tasks other than client, server, or peer functions. For example, an intermediary agent can include a network device for transmitting communication between peers, clients, and / or servers. Typically, an agent within a network architecture can be referred to as a node or a host. For example, a host can refer to a peer, client, server, or intermediary agent. One method for specifying a host is to provide one or more addresses that identify the host, where each address can be associated with a given network and / or protocol. A multi-homed host can have multiple addresses associated with it.

[0017] Intermediate server computers can perform various proxy and other services by processing data packets passing through them. For example, intermediate server computers can perform load balancing, rate monitoring, caching, encryption / decryption, session management (including key generation), address translation, denial-of-service (DoS) protection, and / or access control. Intermediate server computers can act as proxies for application servers. A proxy is a middleman (e.g., a computer) located in the communication path between a client and a server (e.g., an application server), which can intercept communication between the client and the server (e.g., network packets, frames, datagrams, fragments, and messages). Proxy can perform various services such as load balancing, rate monitoring, caching, encryption / decryption, address translation, and access control.

[0018] A proxy can act as a virtual server, presenting the proxy's network address as the server application's network address. For example, a client can request a service from a server by sending a request destined for the server application (e.g., using the virtual server's network address as the destination address). The virtual server's network address can also be called a virtual address. The proxy can intercept requests on behalf of the server application. If the client is authorized to access the server application, the proxy can forward the request to the server. Before forwarding, the proxy can modify the request from the client by changing the destination address to the server computer's network address. The application server computer can then respond to the client's request via the proxy. Specifically, the proxy can intercept responses from the server and modify the response by changing the source address of the response to the virtual server's network address. The response can then be forwarded to the client. In this way, the proxy can be relatively transparent to both the client and the server.

[0019] A proxy can add a layer of control between the client device and the server computer, potentially improving the availability, security, and / or performance of a client-server architecture. For example, a proxy can intercept all client traffic destined for the server computer and only allow traffic to be forwarded after the client has been authenticated and / or authorized to access the server. However, a proxy can add latency to transactions between the client and the server. Increased latency can cause web-based applications to run slowly, negatively impacting the user experience. For example, when the client is located in Seattle, the intermediary is located in Denver, and the server is located in Los Angeles, communication traversing the Seattle-Denver-Los Angeles path can cause unintended latency in web-based applications.

[0020] Multipath communication protocols are networking protocols whose properties enable network packets in a network flow to traverse multiple different paths across one or more networks for a given sender and receiver. A network flow is a set of related packets. Related packets may share a common sender and receiver and may share common values ​​in packet header fields such as source port, destination port, and / or protocol identifier. Multipath protocols can divide a network flow into different sub-flows that can traverse different network paths. As an example, a multipath protocol can send packets along different network paths using different addresses on a multihomed machine. Specifically, a receiver can have multiple addresses, and a sender can send a first multipath protocol packet along one network path to a first address of the receiver and a second multipath protocol packet along a different network path to a second address of the receiver.

[0021] Multipath protocols can be connectionless or connection-oriented communication protocols. An example of a non-multipath connection-oriented communication protocol is the Transmission Control Protocol (TCP). TCP can be used to establish a virtual connection between a source (e.g., a client) and a destination (e.g., a server) before data is sent between them. The connection is formed using a handshake of network packets between the source and destination, after which data can be sent. An example of a multipath protocol is the Multipath Transmission Control Protocol (MPTCP). MPTCP is described in Request for Comments (RFC) 6824 and RFC 6897, available from the Internet Engineering Task Force (IETF). MPTCP can use TCP as a lower layer in the multipath protocol stack. Specifically, an MPTCP network flow can be divided into different sub-flows by using different TCP connections between the sender and receiver, where each sub-flow uses a different TCP connection. An example of a non-multipath connectionless communication protocol is the User Datagram Protocol (UDP). UDP can be used to send data without establishing a connection. Similar to MPTCP, multipath protocols can use UDP or another connectionless protocol as a lower layer in the connectionless multipath protocol stack.

[0022] As described herein, intermediate servers and multipath protocols can be used to manage network traffic for network services. For example, an intermediate server can act as a virtual server, presenting the intermediate server's network address as the network address of the network service. A requesting host (e.g., a client device) can send a multipath protocol request to the virtual address of the network service to connect to the network service. The intermediate server can intercept multipath protocol requests and perform various functions for the network service. For example, the intermediate server can perform authentication, authorization, and accounting (AAA) functions for the service, such as verifying credentials from the requesting host and authorizing access to the network service. The intermediate server can perform a handshake with the requesting host to establish a multipath connection to the network service. The network service can be implemented using multiple server computers, such as for increasing the number of users of the service and / or for partitioning the service across different servers. The intermediate server can select one or more target hosts to perform the service. For example, the selection can be based on server load or on a service chain used to provide the service. The intermediate server can provide paths for substreams of data packets to be transmitted between the requesting host and the target hosts of the network service. The intermediate server can perform tasks on behalf of the network service, such as encryption / decryption, compression / decompression, and / or appending tasks. An intermediate server can send multipath protocol packets to the requesting host, which add sub-streams of the connection using the address of the destination host. Specifically, the intermediate server can send multipath protocol packets that allow sub-streams of the connection connecting the requesting host to the destination host to bypass the intermediate server. Both sub-streams passing through the intermediate server and sub-streams bypassing the intermediate server can be operational, allowing data packets transmitted between the requesting host and the destination host to take multiple paths. Multipath protocol packets can also be used to remove sub-streams passing through the intermediate server, eliminating the latency associated with traversing the intermediate server. Using the example above, with the client located in Seattle, the intermediary in Denver, and the server in Los Angeles, the latency associated with traversing the Seattle-Denver-Los Angeles path can be reduced by sending data packets between Seattle and Los Angeles and skipping the Denver intermediary. Therefore, intermediate servers can be used to offload tasks to free up resources on the destination server and / or bypass intermediate servers to reduce latency between the requesting host and the destination host. By managing different sub-streams using multipath protocol packets, a trade-off can be struck between distributing network service functionality across different computers and reducing latency.

[0023] An exemplary architecture for managing network services using multipath protocols.

[0024] Figure 1 This is a block diagram of an exemplary client-server architecture 100 including an intermediate server computer 110 using a multipath protocol. Specifically, Figure 1This illustrates how client device 140 can connect to network service 122 hosted on one or more application server computers 120A-N, and how multipath protocols can be used to manage network traffic between client device 140 and application server computers 120A-N. Client-server architecture 100 may include intermediate server computer 110, application servers 120A-N, a communication network (not shown), and client device 140. The communication network may include public and / or private networks. Information can be sent over the communication network using data packets, and the information may be categorized as requests, responses, and / or other types of messages. Client-server architecture 100 may use methods such as those described in reference [reference needed]. Figure 8 A more detailed description of the client-server architecture is provided for implementation, where the different components of the client-server architecture (110, 120, 140) can be implemented using, as shown in the reference. Figure 9 To implement this, a more detailed description of the computing environment is required.

[0025] Client device 140 can be a computing device capable of sending and receiving multipath protocol network traffic over a communication network. For example, client device 140 can be a mobile computing device, desktop computing device, laptop computing device, tablet computing device, virtual machine running in a cloud-based computing environment, etc. Client device 140 can execute a proxy (e.g., a browser or other software application) requesting network service 122 provided by application servers 120A-N. The proxy can generate requests transmitted by client device 140 using a multipath protocol. The multipath protocol can be a connectionless communication protocol or a connection-oriented communication protocol. (See reference...) Figure 2 In more detail, multipath protocols can be layered on top of single-path communication protocols such as UDP or TCP.

[0026] Application server computers 120A-N can provide a resource pool for implementing network service 122. Each of the application server computers 120A-N can be a computing device capable of sending network traffic over a communication network and processing requests from client devices (such as client device 140). Each of the application server computers 120A-N can be accessed using a corresponding address of each application server computer 120A-N. For example, application server computer 120A can be accessed using node address A124A, application server computer 120N can be accessed using node address N124N, and so on. Each of the application server computers 120A-N may include multiple hardware and / or software server resources, virtual machines running on a cloud-based computing environment, and so on. Each of the application server computers 120A-N can execute one or more instances of network service 122. For example, application server computer 120A can execute network service 122A, application server computer 120N can execute network service 122N, and so on. Different instances of a network service can execute the same software application, but may have different states associated with different clients accessing the service. Network service 122 can include various server software applications, such as, for example, HTTP server applications or Secure Shell (SSH) server applications.

[0027] Intermediate server computer 110 may be a computing device capable of sending network traffic over a communication network using multipath protocols. For example, intermediate server computer 110 may act as a proxy for a network traffic manager, application delivery controller (ADC), and / or application server computers 120A-N to make network service 122 available from a public network such as the Internet. Intermediate server computer 110 may be associated with a virtual address 112 of network service 122. Specifically, intermediate server computer 110 may intercept network traffic addressed to network service 122 using virtual address 112. Intermediate server computer 110 may perform various functions on behalf of network service 122 and / or in coordination with the network service. For example, intermediate server computer 110 may perform various proxy and other services such as rate monitoring, caching, denial-of-service protection, encryption / decryption, session management (including key generation), and / or address translation. As another example, intermediate server computer 110 may perform authentication, authorization, and / or accounting (AAA) functions for network service 122. As another example, intermediate server computer 110 can manage the resources of application server computers 120A-N, such as by balancing the computing and / or network load on each of the application server computers 120A-N.

[0028] Client device 140 and application server computers 120A-N can communicate via one or more communication networks and / or intermediate server computer 110. Requests from client device 140 can be processed by intermediate server computer 110 and / or forwarded by intermediate server computer to one or more of the application server computers 120A-N. For example, client device 140 can send a request by addressing a multipath request 160 for connection to network service 122 to a virtual address 112 of network service 122. Intermediate server computer 110 can intercept connection requests for network service 122 and can perform a handshake with client device 140 to establish a connection between client device 140 and network service 122. Intermediate server computer 110 can select one of the application server computers 120A-N to provide network service 122 to client 140. The initial connection may include a sub-stream via intermediate server computer 110; specifically, the sub-stream may include client device 140, intermediate server computer 110, and a node selected from application server computers 120A-N (e.g., application server computer 120A). Intermediate server computer 110 may provide connection information 162 to the selected application server computer 120A, which is determined during the handshake between intermediate server computer 110 and client device 140. This information 162 may include one or more encryption keys, shared secrets, tokens (also referred to as connection identifiers), etc. The selected node may send an acknowledgment 170 to intermediate server computer 110, indicating that the selected application server computer 120A has received the connection information 162. After the initial connection is established, intermediate server computer 110 may send a multipath packet 172 to client device 140, which adds another sub-stream between client device 140 and the selected application server computer 120A. Specifically, the added sub-stream may omit intermediate server computer 110, for example, by providing node address A 124A to client device 140. Client device 140 may send a multipath substream connection request 180 to a selected application server 120A. Client device 140 and the selected application server 120A may perform a handshake to complete the substream connection. When two substreams are established, client device 140 may send multipath protocol packets to the selected application server computer 120A through either substream. As an example, the initial substream including intermediate server computer 110 may be removed, allowing the latency associated with traversing intermediate server computer 110 to be removed from the path. As another example, substreams may be weighted such that the higher-latency path through intermediate server computer 110 is used less frequently than the lower-latency path omitting intermediate server computer 110.For example, weighting can be implemented by sending a TCP window advertisement from a selected application server computer 120A. As a specific example, omitting the sub-stream of the intermediate server computer can result in a TCP window advertisement that is ten times larger than the sub-stream including the intermediate server, causing approximately ten times more traffic to pass through the sub-stream of the omitted intermediate server computer 110. By allowing a small amount of traffic to pass through the intermediate server computer 110, the intermediate server computer 110 can calculate network traffic accounting, performance, or other metrics.

[0029] Multipath protocol communication can be specified using the network protocol stack and / or packet format used for multipath protocol communication. Figure 2 An exemplary network protocol stack is shown that can be used to implement multipath protocols, specifically multipath protocols implemented in the transport layer of the network stack. Figure 3 An exemplary multipath protocol packet format is illustrated. Typically, a network protocol stack specifies how information is conveyed between devices implementing the network protocol stack (e.g., across a network). A network protocol stack can be divided into different layers that specify different aspects of a communication system (e.g., communication protocols). Data can be sent between computing devices by encapsulating data in network packets and forwarding these network packets from one device to another over the network. Network traffic is one or more network packets flowing through a network. Network packets can be formatted according to one or more communication protocols that can be specified by the different layers of the network protocol stack.

[0030] As an example, the layers within a network packet can be described using the Open Systems Interconnection (OSI) model, which divides different functions of a communication system into corresponding abstract layers. Specifically, the OSI model divides a communication system into seven layers. A specific layer provides a communication path to the layers adjacent to it (e.g., the layers above and below it). The lowest layer is the physical layer (also called Layer 1 or L1), which defines the electrical and physical specifications for communication over a physical transmission medium. Specifically, the physical layer can define voltage levels, signal timing, transmission media (e.g., cables, fiber optic cables, radio frequency), and so on. The physical layer can provide a communication path to the data link layer or link layer (also called Layer 2 or L2). The link layer defines the protocols for transmitting data between two nodes. Additionally, the link layer can define protocols for establishing and terminating connections between nodes, managing flow control, and detecting and / or correcting errors occurring at the physical layer. Ethernet is an example of a link layer protocol. The link layer can provide a communication path to the network layer (also called Layer 3 or L3). An exemplary network layer protocol is the Internet Protocol (IP) (including IPv4 and IPv6). Other layers of the OSI model include the transport layer (also known as Layer 4 or L4), the session layer (also known as Layer 5 or L5), the presentation layer (also known as Layer 6 or L6), and the application layer (also known as Layer 7 or L7). It should be noted that network packets (or simply packets) typically include a header at the packet layer (e.g., another service, a remote node, or another agent) and a payload with discrete information. When the original packet passes through the communication layer, packets addressed to agents at that layer can be encapsulated within the payload of packets at lower layers. Data packets at the link layer can also be called frames. Data packets at the transport layer can also be called datagrams or fragments. The OSI model is a reference, and some networking protocols may not strictly adhere to the seven layers of the OSI model. For example, in some embodiments, the functionality of the link layer and the physical layer may be combined into a single link layer.

[0031] Figure 2 An exemplary network protocol stack 200 is shown, which can be used to implement a multipath protocol, specifically in the transport layer 270 of the network stack 200. The network protocol stack 200 includes an application layer 210 that specifies a protocol for communicating information between two different hosts that are executed at the application layer. For example, one host may be a client requesting data from a network service, while the other host may be a server of the network service responding to the request from the client.

[0032] Transport layer 270 can specify protocols to ensure quality of service and accurate data delivery between hosts. As shown, transport layer 270 may include a multipath transport layer 220 and one or more single-path transport layers 230A-B. For example, multipath transport layer 220 may implement the MPTCP protocol. An MPTCP connection can provide a bidirectional communication channel between two hosts. An MPTCP connection can divide the channel among multiple substreams. MPTCP can be used to manage MPTCP connections, such as by creating, removing, and utilizing different substreams of the MPTCP connection. As shown, an MPTCP connection is divided between two different substreams 230A-B, where each substream is implemented using TCP. In other examples, different numbers of substreams may be used, and the substreams may be implemented using different protocols. By using a TCP layer below the MPTCP layer, the lower layers of protocol stack 200 (e.g., 240A-B, 250A-B, and 260A-B) can be backward compatible with single-path communication protocols. MPTCP connections enable hosts to exchange data using different paths (e.g., substreams) and different network addresses (e.g., IP addresses). Each substream can use its own TCP connection to transmit data between hosts. See reference... Figure 3 In more detail, the option types in the TCP header can be used to identify each one in the substream.

[0033] It should be noted that although multipath protocols are shown as being in Figure 2 While multipath protocols are implemented in the transport layer, they can be implemented at different layers within the protocol stack. It should also be noted that although multipath protocols are implemented in... Figure 2 While it is presented as a connection-oriented protocol, multipath protocols can also be implemented as connectionless protocols.

[0034] Figure 3An exemplary multipath protocol packet format 300 is illustrated. Specifically, the multipath protocol packet format 300 illustrates the transport layer of a multipath protocol packet. Higher layers of the packet (e.g., the application layer) can be encapsulated within the packet payload 310. Lower layers of the packet can encapsulate header fields 320 and payload 310. Header fields 320 include TCP-compatible fields. Multipath protocol information can be provided in the MPTCP options field 330. The MPTCP options field 330 can be further divided into a category field 331, a length field 332, a subtype field 333, and subtype-specific data 334. The MPTCP options field 330 can be populated with values ​​indicating that packet 300 is an MPTCP packet. For example, the Internet Numbering Authority (IANA) has specified that value 30 in the category field 331 can be used to indicate that a packet is an MPTCP packet. The length field 332 can be used to indicate the length of the subtype-specific data 334. The subtype-specific data 334 can be used to provide supplemental multipath information that varies based on the values ​​in the subtype field 333.

[0035] Subtype field 333 can be used to indicate the functionality of a multipath protocol packet. For example, a value of 0 in subtype field 333 can indicate that the packet has multipath capability (such as when initiating a connection); a value of 1 in subtype field 333 can indicate that the packet is requesting to join a connection (such as when starting a new substream for a connection); a value of 2 in subtype field 333 can indicate that the packet includes a data sequence signal to allow data to be reliably and orderly reassembled (such as to combine data from multiple substreams into a single data stream); a value of 333 in subtype field 333 can indicate that the packet includes an address to be added to a host; a value of 4 in subtype field 333 can indicate that the packet includes an address to be removed from a host; a value of 5 in subtype field 333 can indicate that the packet includes a request to change the priority of a substream; a value of 6 in subtype field 333 can indicate that the packet includes a request to back off by removing a substream or falling back to TCP; and a value of 7 in subtype field 333 can indicate that the packet includes a request to close a substream within a multipath connection. Additional details regarding MPTCP are described in RFC 6824, which is available from the IETF. RFC 6824 is incorporated herein by reference in its entirety.

[0036] It should be noted that, for ease of illustration, the multipath protocol packet format 300 is not drawn strictly to scale. For example, the payload 310, MPTCP options 330, and subtype-specific data 334 may vary in length based on various packet attributes. Furthermore, while MPTCP has been used to illustrate a multipath protocol, it is only one example, and other multipath protocols can be used to implement the embodiments described herein.

[0037] Figure 4 This is a block diagram of an exemplary service chain 400 for providing network services to client device 140. The network service can be implemented using a preprocessor network service 420, a target network service 410, and a postprocessor network service 430. As an example, the three services 410, 420, and 430 can be pipelined so that all three services 410, 420, and 430 are active simultaneously. As another example, the three services 410, 420, and 430 can operate sequentially, such that a service begins after the previous service has finished. The preprocessor network service 420 and the postprocessor network service 430 can be transparent to client device 140. For example, client device 140 may be requesting the target network service 410, and the intermediate service chain manager 110 can determine whether to access the preprocessor network service 420 and / or the postprocessor network service 430 before and / or after the target network service 410, respectively. It should be understood that although service chain 400 is shown as using three services, the service chain may include more or fewer services.

[0038] The intermediate service chain manager 110 (also known as the service chain-only manager) can be used to coordinate communication between the client device 140 and three services 410, 420, and 430. Specifically, the service chain manager 110 can direct network traffic between the client device and different services 410, 420, and 430. The service chain manager 110 can be used to forward data between the different services 410, 420, and 430. For example, data can be forwarded between the preprocessor network service 420 and the target network service 410 by using the service chain manager 110 as a communication intermediary. Similarly, data can be forwarded between the target network service 410 and the postprocessor network service 430 by using the service chain manager 110 as a communication intermediary. The service chain manager 110 can present the virtual address of the network service, so that the client device 140 will initially connect to the network service via the service chain manager 110.

[0039] As an example, the three services 410, 420, and 430 can be pipelined so that all three services 410, 420, and 430 are active simultaneously. For example, the preprocessor network service 420 can provide firewall functionality, the target network service 410 can be a video server, and the postprocessor network service 430 can be a compression engine for compressing video. The client device 140 can request a multipath protocol connection to the network service by sending a request to the service chain manager 110 on communication channel 440. For example, the service chain manager 110 can manage the network addresses of the virtual servers of the network service, and requests to access the network service can be addressed to the virtual addresses of the network service. A multipath protocol connection (e.g., an MPTCP connection) can be formed between the client device 140 and the service chain manager 110. The service chain manager 110 can determine that the preprocessor network service 420 is the first service in the service chain to be accessed to provide network services to the client. Using channel 442, service chain manager 110 can create a multipath protocol connection between preprocessor network service 420 and service chain manager 110, allowing requests for the network service from client device 140 to be routed to preprocessor network service 420 via channels 440 and 442. Service chain manager 110 can provide preprocessor network service 420 with connection information (e.g., tokens, shared secrets, and / or encryption keys) associated with the multipath protocol connection between client device 140 and service chain manager 110. Service chain manager 110 can send multipath protocol packets to client device 140 to add the address of preprocessor network service 420. Client device 140 can request the network service to add a substream to the multipath protocol connection, wherein the substream creates a path on channel 444 between client device 140 and preprocessor network service 420, omitting service chain manager 110. Sub-streams, including those along the path through service chain manager 110, can be removed and / or de-prioritized, potentially reducing latency in network traffic between client device 140 and preprocessor network service 420.

[0040] Requests from client device 140 can be processed by preprocessor network service 420. Preprocessor network service 420 can generate data to be processed by target network service 410. Initially, preprocessor network service 420 may not have a direct communication channel to target network service 410. Preprocessor network service 420 can request a connection to target network service 410 by sending a request to intermediate service chain manager 110. A multipath protocol connection can be formed between preprocessor network service 420 and intermediate service chain manager 110 using channel 442. Service chain manager 110 can establish a connection with target network service 410 by sending a request to target network service 410 on channel 450. Data can be transmitted from preprocessor network service 420 to target network service 410 using the multipath protocol connection and channels 442 and 450. Intermediate service chain manager 110 can provide connection information to target network service 410. Intermediate service chain manager 110 can add the address of target network service 410 to the multipath protocol connection between preprocessor network service 420 and service chain manager 110. Preprocessor network service 420 can request target network service 410 to add a sub-flow via multipath protocol connection through channel 452, which omits service chain manager 110. Sub-flows including paths through service chain manager 110 can be removed and / or de-prioritized, potentially reducing latency in network traffic between preprocessor network service 420 and target network service 410.

[0041] Target network service 410 can generate data to be processed by post-processor network service 430. Initially, target network service 410 may not have a direct communication channel to post-processor network service 430. Target network service 410 can request a connection to post-processor network service 430 by sending a request to service chain manager 110. A multipath protocol connection can be formed between target network service 410 and service chain manager 110 using channel 450. Service chain manager 110 can create a connection with post-processor network service 430 by sending a request to post-processor network service 430 on channel 460. Data can be transmitted from target network service 410 to post-processor network service 430 using the multipath protocol connection and channels 450 and 460. Service chain manager 110 can provide connection information to post-processor network service 430. Service chain manager 110 can add the address of post-processor network service 430 to the multipath protocol connection between target network service 410 and service chain manager 110. The target network service 410 may request the post-processor network service 430 to add a sub-flow connected via a multipath protocol through channel 462, wherein the sub-flow omits the service chain manager 110. Sub-flows including paths through service chain manager 110 may be removed and / or de-prioritized, potentially reducing latency in network traffic between the target network service 410 and the post-processor network service 430.

[0042] Post-processor network service 430 can generate data to be sent to client device 140. Initially, post-processor network service 430 may not have a direct communication channel to client device 140. Post-processor network service 430 can request a connection to client device 140 by sending a request to service chain manager 110. A multipath protocol connection can be formed between post-processor network service 430 and service chain manager 110 using channel 460. Service chain manager 110 can establish a connection with client device 140 by sending a request to client device 140 on channel 440. Data can be transmitted from post-processor network service 430 to client device 140 using the multipath protocol connection and channels 460 and 440. Service chain manager 110 can provide connection information to client device 140. Service chain manager 110 can add the address of client device 140 to the multipath protocol connection between post-processor network service 430 and service chain manager 110. The post-processor network service 430 may request the client device 140 to add a sub-stream connected via a multipath protocol through channel 464, the sub-stream omitting the service chain manager 110. Sub-streams including paths through service chain manager 110 may be removed and / or de-prioritized, potentially reducing latency in network traffic between the post-processor network service 430 and the client device 140.

[0043] As another example, the three services 410, 420, and 430 can operate sequentially, such that a service begins after the previous service has finished. For example, preprocessor network service 420 can provide authentication and authorization services, target network service 410 can provide the primary service requested by client device 140, and postprocessor network service 430 can provide the accounting services of the primary service. Client device 140 can request a multipath protocol connection to the network service by sending a request to service chain manager 110 on communication channel 440. For example, service chain manager 110 can manage the network addresses of virtual servers for the network service, and requests to access the network service can be addressed to the virtual addresses of the network service. A multipath protocol connection (e.g., an MPTCP connection) can be formed between client device 140 and service chain manager 110. Service chain manager 110 can determine that preprocessor network service 420 is the first service in the service chain to be accessed to provide network services to the client. Using channel 442, service chain manager 110 can create a multipath protocol connection between preprocessor network service 420 and service chain manager 110, allowing requests for the network service from client device 140 to be routed to preprocessor network service 420 via channels 440 and 442. Service chain manager 110 can provide preprocessor network service 420 with connection information (e.g., tokens, shared secrets, and / or encryption keys) associated with the multipath protocol connection between client device 140 and service chain manager 110. Service chain manager 110 can send multipath protocol packets to client device 140 to add the address of preprocessor network service 420. Client device 140 can request the network service to add a substream to the multipath protocol connection, wherein the substream creates a path on channel 444 between client device 140 and preprocessor network service 420, omitting service chain manager 110. Sub-flows, including those along the path through service chain manager 110, can be removed and / or de-prioritized, potentially reducing latency in network traffic between client device 140 and preprocessor network service 420.

[0044] The preprocessor network service 420 can perform its functions and transfer control to the target network service 410. Specifically, the preprocessor network service 420 can notify the service chain manager 110 that control will be transferred to the target network service 410. The service chain manager 110 can establish a connection with the target network service 410 by sending a request to the target network service 410 on channel 450. Multipath protocol connections and channels 450 and 440 can be used to transmit data between the client device 140 and the target network service 410. The service chain manager 110 can provide connection information to the target network service 410. The service chain manager 110 can add the address of the target network service 410 to the multipath protocol connection between the client device 140 and the service chain manager 110. The client device 140 can request the target network service 410 to add a sub-stream of the multipath protocol connection via channel 454, which omits the service chain manager 110. Sub-flows, including those along the path through the service chain manager 110, can be removed and / or de-prioritized, potentially reducing latency in network traffic between the client device 140 and the target network service 410.

[0045] The target network service 410 can perform its functions and pass control to the post-processor network service 430. Specifically, the target network service 410 can notify the service chain manager 110 that control will be passed to the post-processor network service 430. Substreams including the path between the client device 140 and the service chain manager 110 can be re-added and / or re-prioritized to the multipath protocol connection. The service chain manager 110 can establish a connection with the post-processor network service 430 by sending a request to the post-processor network service 430 on channel 460. Data can be transmitted between the client device 140 and the post-processor network service 430 using the multipath protocol connection and channels 460 and 440. The service chain manager 110 can provide connection information to the post-processor network service 410. The network service 410 or the service chain manager 110 can remove a substream on channel 454 from the multipath protocol connection with the client device 140. The service chain manager 110 can add the address of the post-processor network service 430 to the multipath protocol connection between the client device 140 and the service chain manager 110. Client device 140 may request post-processor network service 430 to add a sub-flow connected via a multipath protocol through channel 464, the sub-flow omitting service chain manager 110. Sub-flows including paths through service chain manager 110 may be removed and / or de-prioritized, potentially reducing latency in network traffic between client device 140 and post-processor network service 430.

[0046] Figure 5This is a block diagram of an exemplary intermediate server computer 110 that can be used to provide network services using multipath protocols. For example, intermediate server computer device 110 may be a load balancer, application delivery controller, network traffic management system, or a client configured in a client-server architecture (e.g., ...). Figure 1 Client 140) and application server (e.g., Figure 1 Another component in the communication path between application servers 120A-N. The intermediate server computer device 110 can use a reference... Figure 9 To implement this, a more detailed description of the computing environment is required.

[0047] The intermediate server computer device 110 may include one or more processors 510, one or more communication interfaces 520, one or more optional peripheral interfaces 512, and memory 530. The processors 510, communication interfaces 520, peripheral interfaces 512, and memory 530 may be coupled together via interconnects (not shown), allowing components of the computer device 110 to communicate with each other using the interconnects. The communication interfaces 520 may be used to send and receive communications (e.g., network packets) with other computing devices (such as clients and application servers). The peripheral interfaces 512 may be used to communicate with local peripherals of the intermediate server computer device 110 (such as optional hardware security modules xxx). The processors 510 may be used to execute computer-executable instructions stored in memory 530 and / or storage resources (not shown). The computer-executable instructions may be organized into software routines (also called modules or components) including executable code to perform various computational tasks. It should be noted that, although... Figure 5 One organization of the routines is shown, but other organizations are also possible. For example, the shown routines can be subdivided into smaller routines and / or combined into larger routines. Memory 530 may also include structured and / or unstructured data used by software routines to perform computational tasks.

[0048] The operating system (OS) kernel 532 may include various software routines for managing different aspects of program execution and for hardware interfacing with the intermediate server computer device 110. For example, the OS kernel 532 may manage the loading and unloading of software applications and other routines into the memory 530 of the computer device 110; the OS kernel 532 may manage the storage resources of the computer device 110; the OS kernel 532 may manage processes and / or threads executing on the processor 510; the OS kernel 532 may manage the power state of the computer device 110; the OS kernel 532 may provide interfaces for applications and other routines to send and receive communications (e.g., network packets) using the communication interface 520; the OS kernel 532 may manage the transfer of information into and out of the peripheral interface 512; and the OS kernel 532 may enable inter-process communication between different routines executing on the computer device 110.

[0049] Traffic management logic 540 may include various software routines and / or hardware circuitry for controlling network traffic passing through intermediate server computer 110 by executing various agents and other services, such as load balancing, rate monitoring, caching, encryption / decryption, TLS session management (including key generation), address translation, traffic forwarding, traffic buffering, and / or access control. For example, traffic management logic 114 may buffer network traffic to be processed and / or forwarded over private or public networks to clients, servers, or other hosts (e.g., in packet data buffer 534). Traffic management logic 540 may include computer hardware, software, or a combination thereof. As shown, traffic management logic 540 is implemented as software (e.g., executable software stored wholly or partially in memory 530). As an example, traffic management logic 540 may include multi-threaded real-time software routines. For example, traffic management logic 540 may include a software daemon executed by the processor of intermediate server computer 110. A daemon is a software routine that runs as a background process. A real-time software routine is a routine that processes information with time constraints. Real-time systems can schedule tasks (e.g., threads) based on time constraints and can preempt or interrupt tasks based on their completion priority. As another example, traffic management logic 540 may include a hardware coprocessor tuned to perform packet processing operations as disclosed herein. Computer hardware may include circuitry and / or programmable configurable circuitry manufactured for a single purpose, such as field-programmable gate arrays (FPGAs).

[0050] Traffic management logic 540 can be organized in various ways. As shown in the figure, traffic management logic 540 may include proxy and load balancing logic 550, multipath protocol connection management logic 560, and optional service chain management logic 542, AAA logic 544, and encryption logic 546.

[0051] The proxy and load balancing logic 550 can perform operations on behalf of a network service. For example, the proxy logic 550 can present the virtual address 112 of the network service and can intercept requests for the network service. Specifically, requests for the network service can be addressed to virtual address 112, and the proxy logic 550 can receive and process the requests. The proxy and load balancing logic 550 can maintain and / or access a database tracking various performance metrics of the application servers performing the network service operations. For example, it can measure and track the number of client connections, the amount of processor load, the amount of available network bandwidth, and / or other performance metrics for each application server. The proxy and load balancing logic 550 can select one of the application servers for an incoming request. For example, the proxy and load balancing logic 550 can select an application server with a lighter load or a lower load than other application servers based on performance metrics. In other words, the selection of application servers can be based on performance metric measurements. The proxy and load balancing logic 550 can receive responses from the application servers and forward the responses to the client devices. The proxy and load balancing logic 550 can perform a variety of other tasks on behalf of application servers and / or clients, such as encryption and / or decryption, content caching, compression and / or decompression, access control, address translation, and so on.

[0052] Multipath protocol connection management logic 560 can be used to manage multipath protocol connections between hosts that request and provide network services and hosts that act as intermediaries between the requester and the provider. Typically, multipath protocol connection management logic 560 can be used to create and remove multipath protocol connections and can manage (e.g., add, remove, and modify) sub-streams within said connections. For example, multipath protocol connection management logic 560 can receive requests for connection creation and can perform a handshake with the requester to establish a connection. The initial connection may be between an intermediate server computer 110 and a client device. Multipath protocol connection management logic 560 can add an application server to said connection in a transparent and / or non-transparent manner. For example, all communication between the client and the server may initially pass through the intermediate server computer 110, so the client may not be aware of the identity of the application server providing the network services. Multipath protocol connection management logic 560 adds sub-streams to said connection, creating sub-streams between the client and the server that omit the intermediate server computer 110. The multipath protocol connection management logic 560 can remove sub-streams passing through the intermediate server computer 110 and / or reduce their priority, thereby reducing and / or eliminating latency associated with passing through the intermediate server computer 110.

[0053] Service chain management logic 542 can be used to orchestrate service chains that make up network services to create more comprehensive network services, such as those mentioned above. Figure 4To describe in more detail. Typically, service chain management logic 542 can maintain an address directory of the constituent services and can act as a proxy for each of the constituent services. Therefore, any constituent service can access different constituent services by sending a request to service chain management logic 542, and service chain management logic 542 can act as an intermediary between services. For example, service chain management logic 542 can also manage sub-streams between services, such as creating more direct paths between services when service chain management logic 542 is not in a sub-stream.

[0054] AAA logic 544 can perform authentication, authorization, and accounting functions for network services. Authentication is the process of verifying that an entity's identity is genuine. Authorization is the process of verifying whether an entity (e.g., an authenticated entity) has the right to access protected resources. Authentication and / or authorization can be performed using AAA logic 544 and / or additional services. For example, one way to perform authentication is to request credentials, such as a user identifier (e.g., a username or email address) and a password, from an entity seeking access to a computer system. AAA logic 544 can request credentials from a host and compare the credentials or a cryptographic transformation of the credentials (e.g., a cryptographic hash) with a list of legitimate credentials for the network service. As another example, AAA logic 544 can redirect a host to an identity provider service, which can perform authentication for the host. In one embodiment, AAA logic 544 can create a multipath protocol connection with the requesting host and then add a substream of that connection to the identity provider service. Accounting functionality can include limiting and / or recording the amount of bandwidth used by a host, the number of times a host accesses the system, and so on.

[0055] Encryption logic 546 may include logic for performing encryption operations. For example, encryption operations may be used for encryption, decryption, and key generation. Dedicated secure hardware circuitry can potentially improve the performance of computationally expensive encryption operations. As an example, encryption operations may be performed in conjunction with secure hardware circuitry such as a Hardware Security Module (HSM) 590. An HSM is computer hardware and / or software (e.g., a computing device) configured to store encryption keys, perform encryption operations (such as key generation, data encryption, and data decryption), and enforce security policies for the use and / or access of encryption keys. For example, an HSM may include electronic circuitry for pipelined and / or accelerated encryption algorithms. An HSM may include a physical enclosure that reduces the likelihood of observing and / or tampering with sensitive data (such as a server's private key). For example, the enclosure may cover potential electrical probe points and show visible damage if the enclosure is tampered with. An HSM may enable and / or deny access to keys according to security policies. For example, a security policy may specify that a particular key can only be used and / or accessed when authorized account credentials are presented to the HSM. Therefore, using an HSM can potentially improve the confidentiality and security of information stored on the HSM, and can potentially improve the performance of systems using HSMs. The intermediate server computer 110 can be the primary or sole interface to the HSM 590, allowing keys (e.g., keys 592A-N) and other encrypted data to be isolated, thus providing greater protection compared to distributing encrypted data throughout the distributed computing system.

[0056] Hardware security modules can be implemented using a variety of different computer architectures. For example, an HSM 590 can be implemented as a plug-in circuit card that interfaces with an input / output or peripheral interface 512 (such as a Peripheral Component Interconnect Fast (PCIe) interface) of an intermediate server computer 110 and may include connectors for connection to the backplane or other connectors of the intermediate server computer 110. As another example, an HSM can be implemented as a computer device connected via a computer network (a network-based HSM may also be called a netHSM). As yet another example, an HSM can be implemented as a virtualized resource within a cloud computing infrastructure (a cloud-based HSM may also be called a cloudHSM). HSMs can have different storage capacities and / or acceleration capabilities. For example, a physical HSM can be partitioned into multiple logical HSMs, each of which can have different capabilities and can be accessed using different account credentials. Logical HSMs can also be referred to as partitions or tokens of a physical HSM. HSM partitions can be isolated from each other, making keys and data on one partition invisible to different partitions. Partitions can share hardware and other resources, or partitions can use specific non-shared hardware and resources. HSMs can use various storage technologies, such as random access memory (RAM), non-volatile RAM, flash memory, hard disk drives, solid-state drives, or other storage implementations.

[0057] An exemplary method for managing network services using multipath protocols

[0058] Figure 6 This is a flowchart of an exemplary method 600 for managing network services using a multipath protocol. Method 600 can use methods such as those described above. Figures 1 to 5 The architecture 100 described is used for implementation. As an example, computer-executable instructions for performing method 600 may be stored in computer-readable storage (e.g., storage 530) and said instructions may be executed by one or more processors (e.g., processor 510) to perform method 600.

[0059] At point 610, multipath protocol requests for connections to a service can be intercepted from the requesting host. For example, a multipath protocol request can be intercepted by an intermediate server that has been assigned a virtual address to the service. The intermediate server can then perform a handshake with the requesting host to establish a connection to the service. During the handshake, various connection parameters can be negotiated, such as whether encryption should be used, what encryption key should be used (if encryption is used), shared secret values, session identifier values, and so on. By intercepting network traffic flowing between the requesting host and the service, the intermediate server can act as a proxy for the service.

[0060] At position 620, a different target host than the intermediate server can be selected to provide services. For example, a target host can be selected from a host pool. Host operating criteria, such as CPU load, network usage, number of client connections, etc., can be maintained. A target host can be selected from the host pool based on these operating criteria. For example, hosts can be selected to distribute load (e.g., CPU load, network load, or client load) across different hosts. The intermediate server can send connection information to the target host, enabling the target host to accept a sub-stream connection from the requesting host. The target host can acknowledge receipt of the connection information by sending an acknowledgment to the intermediate server. Additional servers can be configured to allow more direct connections between the requesting host and the target host. For example, a firewall server performing security operations on the host pool can be instructed to allow the requesting host to access one or more hosts (e.g., the target host) in the host pool without traversing the intermediate servers.

[0061] At position 630, a multipath protocol packet can be sent from the intermediate server to the requesting host. This multipath protocol packet can add a sub-stream to the connection using the address of the target host. Specifically, the sub-stream ensures that the path between the requesting host and the target host does not traverse intermediate servers. A handshake can be performed between the requesting host and the target host to add the sub-stream to the connection with the service.

[0062] At any of the 640 points, network traffic on a connection can be split between sub-streams that do not traverse intermediate servers and sub-streams that do traverse intermediate servers. Sub-streams can be weighted, allowing management of network traffic passing through each of the sub-streams. For example, sub-streams can be weighted such that the higher-latency path through intermediate servers is used less frequently than the lower-latency path that omits intermediate servers. As an example, when the multipathing protocol used is MPTCP, weighting can be implemented by sending TCP window advertisements from the target host. The window advertised for each sub-stream can be selected to create the desired traffic ratio through each sub-stream. Maintaining a predefined ratio of traffic passing through sub-streams that traverse intermediate servers can potentially aid billing based on the amount of network traffic from the service, while reducing service latency, since most traffic can flow through sub-streams that omit intermediate servers.

[0063] At any point 650, the virtual address of the service can be removed from the connection using another multipath protocol packet sent from the intermediate server to the requesting host. By removing the virtual address of the service from the connection, a sub-stream that traverses the intermediate servers can be removed from the connection. For example, this can leave only a more direct sub-stream between the requesting host and the target host, thereby reducing latency between the target host and the requesting host that is providing the service.

[0064] Figure 7 This is a flowchart of an exemplary method 700 for managing network services using multipath protocols, such as when implementing services using service chains. Method 700 may use methods such as those described in the above references. Figure 4 as well as Figures 1 to 3 , Figure 5 and Figure 6 The architecture 400 described is used for implementation. As an example, computer-executable instructions for performing method 700 may be stored in computer-readable storage (e.g., storage 530) and said instructions may be executed by one or more processors (e.g., processor 510) to perform method 700.

[0065] At 710, a multipath protocol request for a component service connected to a service chain can be intercepted from the requesting host. The service chain can include multiple component services that communicate with each other to implement higher-level services. For example, component services can be pipelined so that services operate concurrently. As another example, component services can be ordered so that one service begins after another has completed. The multipath protocol request can be intercepted by an intermediate server that has been assigned a virtual address to the component service. The intermediate server can perform a handshake with the requesting host to establish a connection with the component service. During the handshake, various connection parameters can be negotiated, such as whether encryption should be used, what encryption key should be used (if encryption is used), shared secret values, session identifier values, etc. By intercepting network traffic flowing between the requesting host and the component service, the intermediate server can act as a proxy for the component service.

[0066] At point 720, a different target host than the intermediate server can be selected to provide component services. For example, a target host can be selected from a host pool. Host operating criteria, such as CPU load, network usage, number of client connections, etc., can be maintained. Target hosts can be selected from the host pool based on these operating criteria. For example, hosts can be selected to distribute load (e.g., CPU load, network load, or client load) across different hosts. The intermediate server can send connection information to the target host, enabling the target host to accept substream connections from the requesting host. The target host can acknowledge receipt of the connection information by sending an acknowledgment to the intermediate server.

[0067] At point 730, a connection to a component service of a service chain can be created. For example, a connection to a component service can be created at the end of the handshake between the requesting host and an intermediate server. This connection can include sub-streams passing through the intermediate servers (e.g., using the virtual address of the component service). For example, when network traffic from the requesting host to the target host is sent using a sub-stream of the connection, the traffic can traverse the intermediate servers.

[0068] At point 740, a substream using the target host address can be added to the connection with the component service. For example, a multipath protocol packet adding the connection substream can be sent from an intermediate server to the requesting host. This substream ensures that the path between the requesting host and the target host does not traverse the intermediate server. A handshake can be performed between the requesting host and the target host to add the substream to the connection with the component service.

[0069] At any of the 750 points, network traffic on a connection can be split between sub-streams that do not traverse intermediate servers and sub-streams that do traverse intermediate servers. Sub-streams can be weighted, allowing management of network traffic passing through each of the sub-streams. For example, sub-streams can be weighted such that the higher-latency path through intermediate servers is used less frequently than the lower-latency path that omits intermediate servers. As an example, when the multipathing protocol used is MPTCP, weighting can be implemented by sending TCP window advertisements from the target host. The window advertised for each sub-stream can be selected to create the desired traffic ratio through each sub-stream. Preserving a predefined ratio of traffic passing through sub-streams that traverse intermediate servers can potentially aid billing based on the amount of network traffic from the constituent services, while reducing service latency, since most traffic can flow through sub-streams that omit intermediate servers.

[0070] At optional 760, the virtual address of the component service can be removed from the connection using another multipath protocol packet sent from the intermediate server to the requesting host. By removing the virtual address of the component service from the connection, the sub-stream of the connection that traverses the intermediate server can be removed from the connection. For example, this can leave only a more direct sub-stream between the requesting host and the target host, thereby reducing latency between the target host providing the component service and the requesting host.

[0071] Exemplary computing environment

[0072] Figure 8An exemplary client-server architecture 800 (also known as a network traffic management system) is illustrated, comprising a network traffic management device 810 that can be used to manage network services using multipath protocols. The client-server architecture 800 includes a network traffic management device 810 coupled via one or more communication networks (such as communication networks 840A and 840B) to one or more server computers (such as application server computers 820A-N and optional firewall server computer 850) and one or more client devices (such as client computing devices 830A-N). Server computers 820A-N and 850 can communicate with one or more additional server computers accessible via communication network 840A. As an example, communication network 840A may include a public network (e.g., the Internet) and devices attached to network 840A can be accessed using public network addresses; communication network 840B may include a private network and devices attached to network 840B can be accessed using private network addresses.

[0073] Communication network 840A-B may include various wired and / or wireless communication technologies, such as Local Area Network (LAN), Wide Area Network (WAN), Intranet, Internet, Public Switched Telephone Network (PSTN), etc. Devices connected to communication network 840A-B may communicate with each other using various communication protocols, such as Transmission Control Protocol over Ethernet (TCP / IP) and / or other custom or industry-standard protocols. Communication protocols may be used to transmit information on network 840A-B using packet-based messaging (e.g., Ethernet-based packet data networks) and / or other application programming interfaces (APIs). An API is a programming interface (e.g., a set of methods and / or protocols) used for communication between different modules. Communication network 840A-B may include various network devices, such as, for example, switches (multi-layer or single-layer), routers, repeaters, gateways, bridges, hubs, protocol converters, bridge routers, proxy servers, firewalls, network address translators, multiplexers, network interface controllers, wireless network interface controllers, modems, line drivers, and wireless access points. As shown in the figure, the network traffic management device 810 is embedded between client computing devices 830A-N and server computers 820A-N, enabling the network traffic management device 810 to intercept network traffic flowing between different networks 840A and 840B. In other examples, the network traffic management device 810, server computers 820A-N and 850, and client devices 830A-N may be coupled together via other topologies. As a specific example, server computers 820A-N may be integrated within the network traffic management system 800 (e.g., server computer functionality may be implemented in software within one or more devices of the network traffic management device 810). Those skilled in the art who benefit from this disclosure will understand that... Figure 8 The network topologies shown have been simplified and can utilize multiple networks and networking devices to interconnect the various computing systems disclosed herein. Furthermore, one or more of the client-server architecture devices 800 in these examples can be on the same or different communication networks, including, for example, one or more public, private, or cloud networks.

[0074] Typically, server computers 820A-N and 850, client devices 830A-N, and network traffic management systems 800 can perform operations using a computing environment (such as...). Figure 9A computing environment (detailed description of the computing environment) implements various computing tasks. A computing environment may include computer hardware, computer software, and combinations thereof. As a specific example, a computing environment may include general-purpose and / or special-purpose processors, configurable and / or hardwired electronic circuitry, communication interfaces, and computer-readable storage for storing computer-executable instructions that enable the processor to perform a given computing task. The logic for performing a given task may be specified in a single module or may be distributed across multiple modules. As used herein, the terms “module” and “component” may refer to an implementation within one or more special-purpose hardware devices or apparatuses (e.g., a computer), and / or an implementation within software hosted by one or more hardware devices or apparatuses that may host one or more other software applications or implementations.

[0075] Client devices 830A-N may include any type of computing device capable of exchanging network data, such as mobile communication devices, laptop computers, desktop computers, tablet computers, virtual machines running in a cloud-based computing environment, etc. Client devices 830A-N may run interface applications, such as web browsers or standalone client applications, which can provide an interface to communicate (e.g., request and receive content stored on said one or more) of server computers 820A-N and 850 via communication networks 840A and 840B. Client devices 830A-N may also include output devices (such as displays or touchscreens (not shown)) and / or input devices (such as keyboards (not shown)). Additionally, one or more of client devices 830A-N may be configured to execute software code (e.g., JavaScript code within a web browser) to record client-side data and provide the recorded data to network traffic management device 810 or server computers 820A-N.

[0076] Server computers 820A-N and 850 may include any type of computing device capable of exchanging network data. For example, server computers 820A-N and 850 may exchange network data with client device 830A-N and with each other. As another example, server computer 820A-N may exchange communication along a communication path specified by application logic to facilitate interaction between client-server applications and client device 830A-N. Examples of server computers 820A-N may include application servers, database servers, access control servers, and encryption servers. Thus, in some examples, one or more of server computers 820A-N handle login and other requests received from client device 830A-N via communication networks 840A and 840B according to Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) application layer protocols. Web applications can operate on one or more of the server computers 820A-N and transfer data (e.g., files or web pages) to the client device 830A-N (e.g., via network traffic management device 810) in response to requests from the client device 830A-N. The server computers 820A-N can be hardware and / or software and can represent a system with multiple servers in a pool that may include internal or external networks.

[0077] Optional firewall server computer 850 can execute firewall applications. A firewall is a network security system that implements security policies that specify how to monitor and / or control network traffic passing through the firewall. A firewall can analyze fields in network packets from different layers of the network stack and make access control decisions based on these fields. For example, a traditional firewall can analyze packet fields from the network and transport layers (Layers 3 and 4 of the Open Systems Interconnection (OSI) model), while a web application firewall (WAF) can analyze packet fields from the application layer (Layer 7 of the OSI model) and make access control decisions based on the analyzed fields. As an example, a firewall can control (e.g., allow or block) traffic based on policies and / or rules configured on the firewall. Specifically, a firewall can allow traffic that matches rules on a permit list and can block traffic that matches rules on a deny list.

[0078] Although server computers 820A-N and 850 are shown as a single device, one or more actions of each of server computers 820A-N and 850 can be distributed across one or more different network computing devices including one or more of server computers 820A-N and 850. Furthermore, server computers 820A-N and 850 are not limited to a particular configuration. Therefore, server computers 820A-N and 850 can include network computing devices operating using a coordination method, whereby one of the network computing devices of server computers 820A-N and 850 operates to manage or otherwise coordinate the operation of the other network computing device. Each of server computers 820A-N and 850 can operate as a networked computing device within a cluster architecture, a computing device within a peer-to-peer architecture, a virtual machine, or a resource within a cloud-based computing architecture. Therefore, the techniques disclosed herein should not be construed as limited to a single environment, and other configurations and architectures are also contemplated. For example, one or more of the server computers 820A-N and 850 may operate within the network traffic management device 810 itself, rather than as a separate server device communicating with the network traffic management device 810 via the communication network 840B. In this example, one or more of the server computers 820A-N and 850 operate within the memory of the network traffic management device 810.

[0079] Network traffic management device 810 may include any type of computing device that can be used to manage network traffic. Network traffic management device 810 may perform a variety of functions, including, for example, providing network security, access control, load balancing of network traffic on server computers 820A-N, and / or accelerating network traffic associated with applications hosted by one or more of the server computers 820A-N. Each of these functions may be performed by a service. Services may be incorporated into the workload performed by network traffic management device 810. For example, network traffic management device 810 may include workloads for performing proxy and other services on behalf of server 820A-N and managing traffic between client 830A-N and server 820A-N. Additionally, network traffic management device 810 may include other network devices, such as, for example, one or more routers or switches.

[0080] Network traffic management device 810 may include the above references Figure 5 as well as Figures 1 to 4 and Figures 6 to 7The description includes proxy and load balancing logic 550 and multipath protocol connection management logic 560. For example, multipath protocol connection management logic 560 can be used to manage multipath protocol connections between hosts requesting network services (e.g., client devices 830A-N), hosts providing network services (e.g., application server computers 820A-N), and hosts acting as intermediaries between the requester and provider (e.g., network traffic manager 810). Typically, multipath protocol connection management logic 560 can be used to create and remove multipath protocol connections and can manage (e.g., add, remove, and change) sub-flows within said connections.

[0081] As a specific example, client device 830A can address a request to the virtual address 112 of a network service, where the request is seeking a connection to the network service. Network traffic manager 810 can select application server computer 820N to provide the network service. Network traffic manager 810 can create a multipath connection between client device 830A and the network service using sub-flows that traverse network traffic manager 810. For example, the sub-flow can be associated with the virtual address 112 of the network service. Network traffic manager 810 can provide connection information to application server computer 820N and firewall server computer 850. For example, network traffic manager 810 can request that client device 830A be added to the permission list of firewall server computer 850, allowing client device 830A to communicate with servers 820A-N on the other side of the firewall. Network traffic manager 810 can add additional sub-flows to the multipath connection, where the additional sub-flows do not traverse network traffic manager 810. For example, the additional sub-flows can use the address of application server computer 820N to communicate more directly with client device 830A. The initial sub-stream passing through the network traffic manager 810 can be removed, leaving only the additional sub-stream, and the delay associated with traversing the network traffic manager 810 can be removed.

[0082] Although the network traffic management device 810 is shown as a single device in this example, in other examples, the network traffic management device 810 may include multiple devices or blades, each having one or more processors (each processor having one or more processing cores) implementing one or more components of the present technology. In these examples, one or more of the devices may have dedicated communication interfaces or memory. Alternatively, one or more of the devices may utilize memory, communication interfaces, or other hardware or software components of one or more other devices included in the network traffic management device 810. Furthermore, the network traffic management device 810 and / or the applications executed by the network traffic management device 810 may operate in a cloud-based computing environment. The applications may execute in or as virtual machines or virtual servers that can be managed in a cloud-based computing environment. For example, the applications, or even the network traffic management device 810 itself, may reside in a virtual server running in a cloud-based computing environment rather than being bound to one or more specific physical network computing devices. Moreover, the applications may run in one or more virtual machines (VMs) running on the network traffic management device 810. Additionally, in one or more examples of this technology, the virtual machine running on the network traffic management device 810 can be managed or supervised by a hypervisor. Furthermore, one or more of the components comprising the network traffic management device 810 can be a standalone device or integrated with one or more other devices or equipment, such as, for example, with one or more of the server computers 820A-N.

[0083] Furthermore, one or more of the components depicted in the client-server architecture 800 (such as, for example, network traffic management device 810, server computer 820A-N, firewall server computer 850, or client computing device 830A-N) can be configured to operate as virtual instances on the same physical machine. In other words, one or more of the network traffic management device 810, server computer 820A-N, firewall server computer 850, or client computing device 830A-N can operate on the same physical device, rather than as separate devices communicating via communication networks 840A and 840B. Additionally, there may be... Figure 8 The number of network traffic management devices, client computing devices, or server computers shown may be more or less.

[0084] Figure 9 A block diagram is shown illustrating a general example of a suitable computing environment 900 that can be used to implement the examples, techniques / technology described herein. For example, computing environment 900 can be used to implement a network traffic management device including an intermediate server that performs the disclosed techniques for managing network services using multipath communication protocols.

[0085] The computing environment 900 includes at least one processing unit 910 and a computer-readable storage device 920, which are coupled together via interconnect 930. The processing unit 910 executes computer-executable instructions. The processing unit 910 may include a general-purpose processor, a special-purpose processor, or a combination thereof. For example, the processing unit 910 may include a general-purpose central processing unit (CPU), a graphics processor, a processor in an application-specific integrated circuit (ASIC), a processor configured to operate using programmable logic (such as in a field-programmable gate array (FPGA),) and / or any other type of processor. In a multiprocessing system, multiple processing units can be used to execute computer-executable instructions to increase processing power.

[0086] Memory 920 stores software 940, which implements one or more innovations described herein in the form of computer-executable instructions suitable for execution by processing unit 910. Specifically, memory 920 may be used to store computer-executable instructions, data structures, input data, output data, and other information. Memory 920 may include volatile memory (e.g., registers, caches, random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable ROM (EEPROM), and flash memory), and / or combinations thereof. Memory 920 may include operating system software (not shown). The operating system software can provide an operating environment for other software executing in computing environment 900 and can coordinate the activities of components of computing environment 900.

[0087] Interconnector 930 is used to connect different components of computing environment 900 together, enabling processing unit 910 to communicate with different components and / or enabling different components to communicate with each other. For example, interconnector 930 may include a bus, controller, and / or network. As an example, interconnector 930 may include a host bridge (also called a northbridge) for connecting processing unit 910 to relatively high-speed components (such as memory 920) and an input / output bridge (also called a southbridge) for connecting processing unit 910 to relatively low-speed components (such as communication interface 950) within computing environment 900. In some examples, one or more components of computing environment 900 may be integrated within processing unit 910 or directly connected to said processing unit.

[0088] The computing environment 900 may include a communication interface 950 for communicating with another computing entity using a communication medium (e.g., the physical layer). The communication interface 950 may implement all or part of a network protocol stack. The network protocol stack defines the communication formats and rules used for communication between different devices connected to the network. For example, the network protocol stack may use the Open Systems Interconnection (OSI) model or another model to define modular layers for communication. The OSI model standardizes communication systems and divides them into seven layers, including a physical layer (referred to as Layer 1) and an application layer (referred to as Layer 7). The application layer may be used to define how applications access the communication subsystem. The physical layer defines the electrical and physical specifications for communication via a communication medium (also called a physical transmission medium). The communication medium may be used to transmit information, such as computer-executable instructions or other data, in modulated data signals. A modulated data signal is a signal whose characteristics are adjusted to encode information in the signal. The communication interface 950 may include electronic and / or optical circuitry to receive and transmit communication signals encoded using electrical, optical, radio frequency (RF), or other carrier signals (e.g., encoded according to the physical layer specifications of the network stack). Therefore, the communication interface 950 can be used for communication via wired connections (e.g., twisted-pair, coaxial cable, and fiber optic connections) and / or wireless technologies (e.g., Bluetooth, WiFi (IEEE 802.11), and cellular). For reference... Figure 8 In a specific example, the communication interface of the network traffic management device 810 is operatively coupled to and communicates with communication networks 840A and 840B, such that the network traffic management device 810 is coupled to and can communicate with server computers 820A-N and client computing devices 830A-N.

[0089] The computing environment 900 may include a storage device 960 for storing instructions, data structures, and data of software 940, which may be used to implement the techniques described herein. The storage device 960 may include electronic circuitry for reading and / or writing to removable or non-removable storage media using magnetic, optical, or other read and write systems coupled to a processor. The storage device 960 may include read-only storage media and / or read-and-write storage media, such as disks, solid-state drives, magnetic tapes or cassettes, CD-ROMs, CD-RWs, DVDs, or any other media that can be used to store information and is accessible within the computing environment 900.

[0090] The computing environment 900 may include an input device 970. For example, the input device 970 may provide an input interface for the user of the computing environment 900 and / or for receiving input from the physical environment. The input device 970 may include a tactile input device (e.g., a keyboard, mouse, or touchscreen), a microphone, a camera, a sensor, or another device for providing input to the computing environment 900.

[0091] The computing environment 900 may include an output device 980. For example, the output device 980 may provide an output interface for the user of the computing environment 900 and / or for generating output observable in the physical environment. The output device 980 may include a light-emitting diode, a display, a printer, a speaker, a CD writer, or another device that provides output from the computing environment 900. In some examples, the input device 970 and the output device 980 may be used together to provide a user interface to the user of the computing environment 900.

[0092] The computing environment 900 is not intended to limit the scope or functionality of the technology, as the technology can be implemented in various general-purpose and / or specialized computing environments. For example, the disclosed technology can be practiced in local, distributed, and / or network-enabled computing environments. In a distributed computing environment, tasks are performed by multiple processing devices. Therefore, the principles and advantages of distributed processing, such as redundancy, parallelization, and replication, can also be implemented as needed to improve the robustness and performance of the example apparatus and system. The example can also be implemented on computer systems using any suitable interface mechanism and traffic technology across any suitable network extension, including (by way of example only) wireless traffic networks, cellular traffic networks, packet data networks (PDNs), the Internet, intranets, and combinations thereof. As a specific example, the distributed computing environment may include a processing unit 910 and a network-accessible computing environment 890 linked via a communication network. In the distributed computing environment, program modules 840 (including executable instructions for managing network services using multipath communication protocols) may reside in both local and remote memory storage devices.

[0093] The term computer-readable medium includes non-transitory media for data storage, such as memory 920 and storage device 960, but excludes transmission media such as modulated data signals and carrier waves. Any disclosed method can be implemented as computer-executable instructions stored on one or more computer-readable media and executed on a computer (e.g., any commercially available computer). Any computer-executable instructions used to implement the disclosed technology, as well as any data structures and data created and used during the implementation of the disclosed embodiments, can be stored on one or more computer-readable storage media. For example, the computer-executable instructions may be part of a dedicated software application or a software application accessed or downloaded via a web browser or other software application (such as a remote computing application). For example, such software may be executed on a single local computer (e.g., any suitable commercially available computer) or in a networked environment (e.g., via the Internet, a wide area network, a local area network, a client-server network, or other such networks) using one or more network-attached computers.

[0094] This disclosure is set forth in the context of representative examples that are not intended to be limiting. Therefore, this disclosure is directed to all novel and non-obvious features and aspects of the various disclosed examples, both individually and in various combinations and sub-combinations of each other. Numerous variations of the specific hardware and software used to implement the examples are possible, as will be understood by those skilled in the art who benefit from this disclosure. The disclosed systems, methods, and apparatuses are not limited to any particular aspect or feature or combination thereof, nor is the disclosed technology required to have any one or more particular advantages or problems solved. The operational theories, scientific principles, or other theoretical descriptions provided herein with reference to the disclosed technology are for better explanation and are not intended to limit the scope. The apparatuses and methods in the appended claims are not limited to those that operate in a manner described by such operational theories.

[0095] As used herein, the singular forms “a / an” and “the” include the plural forms unless the context clearly indicates otherwise. The term “coupled” includes mechanical, electrical, magnetic, optical methods, and other practices that couple or link items together, and does not exclude the existence of intermediate elements between coupled items. The term “and / or” refers to any one item or combination of items in the phrase.

[0096] Therefore, the order of the listed processing elements or sequences, or the use of numbers, letters, or other names, is not intended to limit the claimed process to any particular order. While some operations of the disclosed methods are described in a specific, sequential order for ease of presentation, it should be understood that this descriptive method includes rearrangements unless the specific language of the claims set forth below requires a particular order. For example, the sequentially described operations may be rearranged or performed simultaneously in some cases. Furthermore, for simplicity, the accompanying drawings may not show all the various ways in which the disclosed methods can be combined with other methods.

[0097] It should also be fully understood that any software functionality described herein may be performed, at least in part, by one or more hardware logic components rather than software. Examples, but not limited to, illustrative types of hardware logic components that may be used include Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0098] For clarity, only certain selected aspects of the software-based implementation have been described. Other details well-known in the art have been omitted. For example, it should be understood that the disclosed technology is not limited to any particular computer language or program. For instance, the disclosed technology can be implemented using software written in C, C++, Java, or any other suitable programming language. Similarly, the disclosed technology is not limited to any particular computer or hardware type. Certain details of suitable computers and hardware are well-known and do not need to be elaborated in this disclosure.

[0099] Having thus described numerous possible embodiments to which the principles of the invention can be applied, those skilled in the art will recognize that the foregoing detailed disclosure is intended only by way of example and not as limiting. While not explicitly stated herein, various changes, modifications, and alterations will be possible and intended for use by those skilled in the art. These changes, modifications, and alterations are intended to be set forth herein and are within the spirit and scope of the invention. Therefore, the scope of the claimed subject matter is defined by the appended claims. We therefore claim that our invention falls entirely within the scope of these claims.

Claims

1. A method implemented by a network traffic management system, the network traffic management system comprising one or more network traffic management devices, server devices, or client devices, the method comprising: Intercept multipath protocol requests from the requesting host for connecting to the service, which are intercepted by intermediate servers; Select a target host that is different from the intermediate server to provide the service; A multipath protocol packet is sent from the intermediate server to the requesting host, the multipath protocol packet adding a sub-stream of the connection using the address of the target host, the sub-stream ensuring that the path between the requesting host and the target host does not traverse the intermediate server; and Network traffic on the connection is split between the sub-stream that does not traverse the intermediate server and the sub-stream that does traverse the intermediate server.

2. The method of claim 1, wherein the multipath protocol request is addressed to a virtual address of the service, the virtual address being associated with and managed by the intermediate server.

3. The method of claim 1, wherein the target host is selected from a plurality of hosts, and the selection is based on load balancing among the plurality of hosts.

4. The method of claim 1, further comprising removing the virtual address of the service from the connection using another multipath protocol packet sent from the intermediate server to the requesting host.

5. A network traffic management system, comprising: One or more network traffic management modules, networking modules, or server modules; A memory, the memory including programming instructions stored thereon; and one or more processors, said one or more processors being configured to execute stored programming instructions to: Intercept multipath protocol requests from the requesting host for connecting to the service, which are intercepted by intermediate servers; Select a target host that is different from the intermediate server to provide the service; A multipath protocol data packet is sent from the intermediate server to the requesting host. The multipath protocol data packet adds a sub-stream of the connection using the address of the target host. The sub-stream ensures that the path between the requesting host and the target host does not traverse the intermediate server. as well as Network traffic on the connection is split between the sub-stream that does not traverse the intermediate server and the sub-stream that does traverse the intermediate server.

6. The network traffic management system of claim 5, wherein the multipath protocol request is addressed to a virtual address of the service, the virtual address being associated with and managed by the intermediate server.

7. The network traffic management system of claim 5, wherein the target host is selected from a plurality of hosts, and the selection is based on load balancing among the plurality of hosts.

8. The network traffic management system of claim 5, wherein the one or more processors are configured to execute the stored programming instructions to: The virtual address of the service is removed from the connection using another multipath protocol packet sent from the intermediate server to the requesting host.

9. A non-transitory computer-readable medium having instructions stored thereon, the instructions including executable code, the executable code causing the processor, when executed by one or more processors, to: Intercept multipath protocol requests from the requesting host for connecting to the service, which are intercepted by intermediate servers; Select a target host that is different from the intermediate server to provide the service; A multipath protocol data packet is sent from the intermediate server to the requesting host. The multipath protocol data packet adds a sub-stream of the connection using the address of the target host. The sub-stream ensures that the path between the requesting host and the target host does not traverse the intermediate server. as well as Network traffic on the connection is split between the sub-stream that does not traverse the intermediate server and the sub-stream that does traverse the intermediate server.

10. The computer-readable medium of claim 9, wherein the multipath protocol request is addressed to a virtual address of the service, the virtual address being associated with and managed by the intermediate server.

11. The computer-readable medium of claim 9, wherein the target host is selected from a plurality of hosts, and the selection is based on load balancing among the plurality of hosts.

12. The computer-readable medium of claim 9, wherein the instructions further include executable code, which, when executed by one or more processors, causes the processor to: The virtual address of the service is removed from the connection using another multipath protocol packet sent from the intermediate server to the requesting host.

13. A network traffic management device, comprising: memory, The memory includes programming instructions stored thereon; and one or more processors, said one or more processors being configured to execute stored programming instructions to: Intercept multipath protocol requests from the requesting host for connecting to the service, which are intercepted by intermediate servers; Select a target host that is different from the intermediate server to provide the service; A multipath protocol data packet is sent from the intermediate server to the requesting host. The multipath protocol data packet adds a sub-stream of the connection using the address of the target host. The sub-stream ensures that the path between the requesting host and the target host does not traverse the intermediate server. as well as Network traffic on the connection is split between the sub-stream that does not traverse the intermediate server and the sub-stream that does traverse the intermediate server.

14. The network traffic management device of claim 13, wherein the multipath protocol request is addressed to a virtual address of the service, the virtual address being associated with and managed by the intermediate server.

15. The network traffic management device of claim 13, wherein the target host is selected from a plurality of hosts, and the selection is based on load balancing among the plurality of hosts.

16. The network traffic management device of claim 13, wherein the one or more processors are further configured to execute the stored programming instructions to: The virtual address of the service is removed from the connection using another multipath protocol packet sent from the intermediate server to the requesting host.

Images