US 12,739,169 B1Granted

Methods for facilitating dynamic service-oriented and software-defined hardware and devices thereof

AssigneeF5, Inc.

InventorsHao Cai, Timothy S. Michels, William R. Baumann, C Stuart Johnson

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, non-transitory computer readable media, network traffic management apparatuses, and network traffic management systems that configure one or more configurable hardware logic devices based on a current configuration comprising a set of features. Network traffic exchanged with or between one or more clients or one or more servers is monitored. A determination is made when a trigger condition has occurred based on the monitoring. One or more of the configurable hardware logic devices are reconfigured the detected trigger condition to enable hardware acceleration for a feature not included in the set of features, when the determining indicates that the trigger condition is detected. With this technology, hardware acceleration can be provided dynamically for different features, based on observed network conditions, in order to improve the performance of a network traffic management device.

Claims20

Dependent claims

A method for managing software-defined hardware implemented by a network traffic management system comprising one or more network traffic management apparatuses, server devices, or client devices, the method comprising:

monitoring network traffic exchanged with or between one or more clients or one or more servers using a first configurable hardware logic device configured to enable hardware acceleration for a first set of predetermined protection features comprising one or more features predicted to combat attacks above a set threshold;
determining, based on the monitored network traffic, that a trigger condition is satisfied when a network attack associated with a DOS attack vector is detected and when a predetermined protection scheme for defending against the detected network attack is absent from the first set of predetermined protection features;
responsive to determining the trigger condition is satisfied, routing the network traffic to a second configurable hardware logic device configured to enable hardware acceleration for a second set of predetermined protection features comprising the predetermined protection scheme for defending against the detected network attack;
determining whether the trigger condition is associated with automatic reconfiguration;
responsive to determining that the trigger condition is associated with automatic reconfiguration:
reconfiguring the first configurable hardware logic device to enable hardware acceleration for the predetermined protection scheme for defending against the detected network attack, when the determination indicates the trigger condition is satisfied, wherein the DOS attack vector comprises one or more attributes of one or more packets comprising at least a portion of the monitored network traffic associated with the network attack, and
processing additional network traffic corresponding to the detected network attack with the reconfigured first configurable hardware logic device;
and
responsive to determining the trigger condition is not associated with automatic reconfiguration:
outputting an indication related to the trigger condition.

7 more elements

A network traffic management apparatus, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

monitor network traffic exchanged with or between one or more clients or one or more servers using a first configurable hardware logic device configured to enable hardware acceleration for a first set of predetermined protection features comprising one or more features predicted to combat attacks above a set threshold;
determine, based on the monitored network traffic, that a trigger condition is satisfied when a network attack associated with a DOS attack vector is detected and when a predetermined protection scheme for defending against the detected network attack is absent from the first set of predetermined protection features;
responsive to determining the trigger condition is satisfied, route the network traffic to a second configurable hardware logic device configured to enable hardware acceleration for a second set of predetermined protection features comprising the predetermined protection scheme for defending against the detected network attack;
determine whether the trigger condition is associated with automatic reconfiguration;
responsive to determining that the trigger condition is associated with automatic reconfiguration:
reconfigure the first configurable hardware logic device to enable hardware acceleration for the predetermined protection scheme for defending against the detected network attack, when the determination indicates the trigger condition is satisfied, wherein the DOS attack vector comprises one or more attributes of one or more packets comprising at least a portion of the monitored network traffic associated with the network attack, and
process additional network traffic corresponding to the detected network attack with the reconfigured first configurable hardware logic device;
and
responsive to determining the trigger condition is not associated with automatic reconfiguration:
output an indication related to the trigger condition.

7 more elements

A non-transitory computer readable medium having stored thereon instructions for managing software-defined hardware comprising executable code that, when executed by one or more processors, causes the processors to:

monitor network traffic exchanged with or between one or more clients or one or more servers using a first configurable hardware logic device configured to enable hardware acceleration for a first set of predetermined protection features comprising one or more features predicted to combat attacks above a set threshold;
determine, based on the monitored network traffic, that a trigger condition is satisfied when a network attack associated with a DOS attack vector is detected and when a predetermined protection scheme for defending against the detected network attack is absent from the first set of predetermined protection features;
responsive to determining the trigger condition is satisfied, route the network traffic to a second configurable hardware logic device configured to enable hardware acceleration for a second set of predetermined protection features comprising the predetermined protection scheme for defending against the detected network attack;
determine whether the trigger condition is associated with automatic reconfiguration;
responsive to determining that the trigger condition is associated with automatic reconfiguration:
reconfigure the first configurable hardware logic device to enable hardware acceleration for protection against the detected network attack, when the determination indicates the trigger condition is satisfied, wherein the DOS attack vector comprises one or more attributes of one or more packets comprising at least a portion of the monitored network traffic associated with the network attack, and
process additional network traffic corresponding to the DOS attack vector with the reconfigured first configurable hardware logic device;
and
responsive to determining the trigger condition is not associated with automatic reconfiguration:
output an indication related to the trigger condition.

7 more elements

A network traffic management system, comprising one or more network traffic management apparatuses, server devices, or client devices with memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:

monitor network traffic exchanged with or between one or more clients or one or more servers using a first configurable hardware logic device configured to enable hardware acceleration for a first set of predetermined protection features comprising one or more features predicted to combat attacks above a set threshold;
determine, based on the monitored network traffic, that a trigger condition is satisfied when a network attack associated with a DOS attack vector is detected and when a predetermined protection scheme for defending against the detected network attack is absent from the first set of predetermined protection features;
responsive to determining the trigger condition is satisfied, route the network traffic to a second configurable hardware logic device configured to enable hardware acceleration for a second set of predetermined protection features comprising the predetermined protection scheme for defending against the detected network attack;
determine whether the trigger condition is associated with automatic reconfiguration;
responsive to determining that the trigger condition is associated with automatic reconfiguration:
reconfigure the first configurable hardware logic device to enable hardware acceleration for the predetermined protection scheme for defending against the detected network attack, when the determination indicates the trigger condition is satisfied, wherein the DOS attack vector comprises one or more attributes of one or more packets comprising at least a portion of the monitored network traffic associated with the network attack, and
process additional network traffic corresponding to the detected network attack with the reconfigured first configurable hardware logic device;
and
responsive to determining the trigger condition is not associated with automatic reconfiguration:
output an indication related to the trigger condition.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/980,489Filed 15 May 2018 · us provisional application
Priority: 8 Jun 2017
Granted: 15 Sep 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 41/0816
Characterised by the conditions triggering a change of settings: the condition being an adaptation, e.g. in response to network events
H04L 43/16
Arrangements for monitoring or testing data switching networks: threshold monitoring
H04L 61/4511
Using standardised directories; using standardised directory access protocols: using domain name system [DNS]
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection