HK1198565B - Methods to combine stateless and stateful server load balancing - Google Patents

Description

Method for combined stateless and stateful server load balancing

Technical Field

The present invention relates generally to data communications, and more particularly to serving gateways.

Background

Consumer and enterprise computing devices are rapidly expanding on demand for data communication services. Service providers deploy service gateways, such as server load balancers or traffic managers, that bridge host computers or computing devices with servers that provide data services.

The service gateway provides services using either a stateful processing method or a stateless processing method. Generally, in a stateful processing method, packets are processed into a stream of packets, and each packet in the stream is processed in the same manner. In a stateless processing approach, packets are processed discretely, with each packet being accessed separately. Stateful approaches may be preferred over stateless approaches due to the security and control features that may be implemented, however, the resource requirements of such features may make scaling of services difficult. Stateless processing methods may be preferred over stateful processing methods due to their scalability, however, at the expense of security and control.

The traffic managed by the serving gateway is hardly uniform, since the conditions on the network often fluctuate widely from time to time. Currently, a system administrator is required to weight the cost of each method and to select either a stateful processing method or a stateless processing method for a particular service address. The system administrator cannot realize the advantages of both processing methods for such non-uniform services.

Disclosure of Invention

According to one embodiment of the invention, a method for processing data packets sent over a communication session between a host and a server by a serving gateway comprises: processing, by the serving gateway, the data packet using a hybrid-stateful processing method; checking, by the serving gateway, whether a hybrid-stateless condition is satisfied; changing, by the serving gateway, to a hybrid-stateless processing method for subsequently received data packets in response to a determination that the hybrid-stateless condition is satisfied; and in response to a determination that the hybrid-stateless condition is not satisfied, processing, by the serving gateway, a subsequently received data packet using a hybrid-stateful processing method.

In another embodiment of the present invention, a method of processing data packets sent over a communication session between a host and a server by a serving gateway comprises: processing, by the service gateway, the data packet using a hybrid stateless processing method, wherein the hybrid stateless processing method processes the data packet using a stateless processing method unless a service address or a server address of the data packet matches a session entry in a session table; checking, by the serving gateway, whether a mixed stateful condition is satisfied; in response to a determination that a mixed-stateful condition is satisfied, changing, by the serving gateway, to a mixed-stateful processing method for the subsequently received data packet, wherein the mixed-stateful processing method processes the subsequently received data packet using the mixed-stateful processing method unless the subsequently received data packet does not contain a service request or the subsequently received data packet is received from a server; processing, by the serving gateway, subsequently received data packets using a hybrid stateless processing method in response to a determination that the hybrid stateful condition is not satisfied; the mixed state processing method comprises the following steps: receiving, by the serving gateway, a data packet; determining, by the service gateway, whether the data packet was received by the service gateway from the host or the server; determining, by the service gateway, whether the data packet contains a service request in response to a determination that the data packet is received from the host; processing, by the serving gateway, the data packet using a stateful processing method in response to a determination that the data packet contains a service request; processing, by the serving gateway, the data packet using a hybrid stateless processing method in response to a determination that the data packet is received from the host and does not contain a service request; and processing, by the serving gateway, the data packet using a hybrid stateless processing method in response to a determination that the data packet is received from the server.

In one aspect of the invention, the hybrid stateless processing method comprises: receiving, by the service gateway, a subsequently received data packet from the host; obtaining, by the service gateway, a service address from a subsequently received data packet; comparing, by the service gateway, the service address of the subsequently received data packet with the service address in the session entry stored in the session table; in response to a determination that the session table contains a session entry matching the service address of the subsequently received data packet, processing, by the service gateway, the subsequently received data packet in accordance with information stored in the matching session entry using a stateful processing method. In response to a determination that the session table does not contain any session entries that match the service address of subsequently received data packets: comparing, by the service gateway, the service address of the subsequently received data packet with the service address in the mapping entry stored in the mapping table; finding, by the service gateway, a mapping entry that matches a service address of a subsequently received data packet; and processing, by the service gateway, subsequently received data packets according to the information stored in the matching mapping entry using a stateless processing method.

Systems and computer program products corresponding to the above-described methods are also described and claimed herein.

Drawings

FIG. 1 illustrates a service gateway handling communication sessions between a host and a plurality of servers;

FIG. 2 illustrates a stateful processing method;

FIG. 3 illustrates a stateless processing method;

FIG. 4 illustrates an embodiment of a service gateway performing a hybrid stateless processing method combining a stateful processing method and a stateless processing method in accordance with the present invention;

FIG. 5 illustrates an embodiment of a service gateway performing a hybrid stateful processing method combining a stateful processing method and a stateless processing method in accordance with the present invention;

FIG. 6 illustrates an embodiment of a service gateway changing from a hybrid stateful processing method to a hybrid stateless processing method in response to a hybrid stateless condition being satisfied in accordance with the present invention;

FIG. 7 illustrates an embodiment of a service gateway changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to a hybrid-stateful condition being satisfied in accordance with the present invention;

FIG. 8 is a flow diagram illustrating an embodiment of a hybrid stateless processing method in accordance with the present invention;

FIG. 9 is a flow diagram illustrating an embodiment of a hybrid-stateful processing method in accordance with the present invention;

FIG. 10 is a flow diagram illustrating an embodiment of a method for changing from a hybrid-stateful processing method to a hybrid-stateless processing method in response to satisfaction of a hybrid-stateless condition in accordance with the present invention; and

FIG. 11 is a flow diagram illustrating an embodiment of a method for changing from a hybrid-stateless processing method to a hybrid-stateful processing method in response to satisfaction of a hybrid-stateful condition in accordance with the present invention.

Detailed Description

The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Various modifications to the embodiments will be readily apparent to those skilled in the art, and the generic principles herein may be applied to other embodiments. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features described herein.

The invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.

Furthermore, the invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a Random Access Memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk read only memory (CD-ROM), compact disk read/write (CD-R/W), and DVD.

A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.

Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers.

Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified partial function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or illustrative flow diagrams, and combinations of blocks in the block diagrams and/or illustrative flow diagrams, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and/or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. Embodiments of the present invention provide a security gateway with the ability to process packets using either a hybrid stateless processing method or a hybrid stateful processing method, and the ability to evaluate the condition of determining whether to switch from using the hybrid stateless processing method to using the hybrid stateless processing method, or vice versa. Before describing various embodiments of the present invention, a stateless and stateless-only approach is first described with reference to fig. 1-3.

Fig. 1 illustrates a service gateway 110 handling a communication session 300 between a host 100 and a server 200. A plurality of data packets are sent between host 100 and server 200 over communication session 300. Service gateway 110 receives data packets of service request 301 from host 100 in order to establish communication session 300. The service request 301 is transported over the data network 153. The service request 301 may be a web service request such as an HTTP (hypertext transfer protocol) request, a secure HTTP request, an FTP (file transfer protocol) request, a file transfer request, an SIP (session initiation protocol) session request, a web technology based request, a video or audio streaming request, a web conference session request, or any request on the internet, an enterprise network, a data center network, or a network cloud. The service request 301 may be a request for a mobile application download, an advertisement delivery request, an e-book delivery request, a collaboration session request, or an online newspaper or magazine delivery request.

Host 100 is a computing device with network access capabilities. The host 100 may be a workstation, a desktop personal computer, or a laptop computer. In one embodiment, host 100 is a Personal Digital Assistant (PDA), a tablet, a smart phone, or a cellular phone. For other examples, host 100 may be a set-top box, an internet media browser, an internet media player, a smart sensor, a smart medical device, an internet box, a networked television, a networked DVR, a networked blu-ray player, or a media center.

Service gateway 110 is a computing device operably coupled to processor 113 and computer readable medium 114 storing computer readable program code to be executed by processor 113. The service gateway 110 may be implemented as a server load balancer, an application delivery controller, a service delivery platform, a traffic manager, a security gateway, a component of a firewall system, a component of a Virtual Private Network (VPN), a load balancer for a video server, or a gateway that distributes load to one or more servers.

The server 200 is a computing device operably coupled to a processor 213 and a computer readable medium 214 storing computer readable program code to be executed by the processor 213. The computer readable program code may implement the server 200 as a web server, file server, video server, database server, application server, voice system, conference server, media gateway, SIP server, remote access server, VPN server, media center, app server, or web server providing web or application services to the host 100.

The data network 153 may include an Internet Protocol (IP) network. The data network 153 may include an enterprise data network or a regional enterprise data network, an internet service provider network, a residential data network, a wired network such as an ethernet network, a wireless network such as a WiFi network, or a cellular network. The data network 153 may reside in a data center or be connected to a network or application network cloud.

The service request 301 from the host 100 includes a service address 331 such as an IP address. The service address 331 includes an application layer address or a transport layer port number such as a Transmission Control Protocol (TCP) port number or a User Datagram Protocol (UDP) port number. The service address 331 is associated with the service gateway 110 for the service gateway 110 to process the service request 301. The service address 331 may include the destination IP address of the service request 301 and, optionally, the destination transport layer port number of the service request 301.

The service request 301 may comprise a TCP session request data packet, or a UDP data packet. The service address 331 is included in the data packet of the service request 301.

The service gateway 110 determines the server address 321 from the service address 331 obtained from the service request 301. Server address 321 is associated with server 200 and may include a network address or IP address of server 200. The service address 321 may include an application layer address such as a TCP port number or a UDP port number of the server 200.

Based on the server address 321, the service gateway 110 sends a service session request 306 to the server 200. The service gateway 110 then receives a response to the session request 306 from the server 200, establishing a server-side service session 305 with the server 200. Based on the response to session request 306, service gateway 110 sends a response to service request 301 to host 100, establishing host-side service session 302 with host 100 for service request 301.

The communication session 300 includes a host-side service session 302 and a server-side service session 305. Service session 302 includes one or more data packets from host 100 for communication session 300. Service session 305 includes one or more data packets from server 200 for communication session 300. Service session 302 may include service request 301.

Once service session 302 and service session 305 are established, service gateway 110 then processes data packets 304 of service session 302 received from host 100. Data packet 304 includes service address 331. Service gateway 110 modifies data packet 304 by replacing service address 331 with server address 321. Service gateway 110 sends modified data packet 304 to server 200.

When service gateway 110 receives data packet 307 of service session 305 from server 200, service gateway 110 processes data packet 307. The data packet 307 of the service session 305 may include the server address 321. The service gateway 110 modifies the data packet 307 by replacing the server address 321 with the service address 331. Service gateway 110 sends modified data packet 307 to host 100.

There are two common approaches in handling service session 302 and service session 305: stateful processing methods and stateless processing methods. Fig. 2 illustrates a stateful processing method. In fig. 2, service gateway 110 maintains a service session table 412. Session table 412 stores one or more service session entries. Service gateway 110 creates a session entry 420 for service session 302. The session entry 420 stores the service address 331 and the server address 321 to associate the service address 331 and the server address 321 together. The service gateway 110 may create the session entry 420 after establishing the host-side service session 302 and the server-side service session 306. Service gateway 110 may create session entry 420 after receiving service request 301. The service gateway 110 stores the service address 331 and the server address 321 in the session entry 420 after the service gateway 110 determines the address. Service gateway 110 stores session entry 420 in session table 412.

Service gateway 110 includes a memory bank 400 and stores a session table 412 in memory bank 400. Memory bank 400 is a memory module that resides in service gateway 110. The service gateway 110 includes a network processing module (not shown) containing a Field Programmable Gate Array (FPGA), a network processor, and an Application Specific Integrated Circuit (ASIC). Memory bank 400 is associated with a network processing module. Examples of the memory bank 400 include a Content Addressable Memory (CAM), a Ternary Content Addressable Memory (TCAM), a Static Random Access Memory (SRAM), or a Dynamic Random Access Memory (DRAM).

Service gateway 110 obtains service address 331 from service request 301. Service gateway 110 maintains service policies 417 and determines server address 321 according to service policies 471. The service policy 471 may be based on a relationship between the server 200 and the service address 331. Service policy 471 includes service address 331 and server address 321. Service gateway 110 selects service policy 471 based on a match between service address 331 obtained from service request 301 and a service address in service policy 471. Service gateway 110 applies service policies 471 to service request 301. The service policies 471 may include security policies 482 that may send the non-secure service request 301 to the server 200. Service policies 471 may include a traffic policy 483 that server 200 services service request 301 when the traffic load to server 200 is low. Service request 301 may be received from a predetermined network interface of service gateway 110, and service policy 483 indicates whether service request 301 from the network interface should be sent to server 200.

Server 240 also services service request 301. The service policies 471 may include a server load policy 484 indicating that the service request 301 is to be sent to the server 200 when the server load of the server 240 is high. In one example, service policies 471 include a server availability policy 485 that indicates that service request 301 is to be sent to server 200 if server 200 is a backup server for server 240 and server 240 is unavailable. Service policies 471 may include load balancing policies 486 between server 200 and server 240. Service gateway 110 selects server 200 using load balancing policy 486, which may include round-robin or other load balancing schemes. Service policies 471 may include host policy 487 indicating that service request 301 is to be sent to server 200 when host 100 satisfies host policy 487.

After service gateway 110 applies service policy 471 to service request 301, service gateway 110 retrieves server address 321 from service policy 471. The service gateway 110 creates a session entry 420 using the service address 331 and the server address 321, linking the service address 331 and the server address 321 together. Service gateway 110 stores session entry 420 in session table 412.

Service gateway 110 uses session table 412 to process data packet 304 received from host 100 and data packet 307 received from server 200. When service gateway 110 receives data packet 304 from host 100, service gateway 110 obtains service address 331 from data packet 304. The service gateway 110 compares the obtained service address 331 with the service addresses stored in the session table 412. When service gateway 110 determines that there is a match between the obtained service address 331 and a session entry 420 in session table 412, service gateway 110 processes data packet 304 using the information stored in session entry 420. In the case of obtaining the server address 321 from the matching session entry 412, the service gateway 110 modifies the data packet 304 by replacing the service address 331 with the server address 321. Service gateway 110 sends modified data packet 304 to server 200.

Service request 301 may include host address 104 associated with host 100. Service gateway 110 retrieves host address 104 from service request 301. Service gateway 110 may use the retrieved host address 104 when applying service policies 417. Service gateway 110 stores host address 104 in service session entry 420. Data packet 304 may include host address 104. Service gateway 110 obtains host address 104 from data packet 304 and compares the obtained host address 104 with addresses stored in session table 412 and session entry 420.

When the service gateway 110 receives the data packet 307 of the server-side service session 305 from the server 200, the service gateway 110 retrieves the server address 321 from the data packet 307. The service gateway 110 compares the obtained server address 321 with addresses stored in the session table 412 and determines whether there is a match with the session entry 420. In response to a determination that there is a match, service gateway 110 processes data packet 307 using session entry 420. The service gateway 331 modifies the data packet 307 by replacing the server address 321 with the service address 331 retrieved from the matching session entry 420. Service gateway 110 sends modified data packet 307 to host 100.

The data packet 307 may include the host address 104. Service gateway 110 obtains host address 104 from data packet 307 and uses the obtained host address 104 in a comparison with addresses stored in session table 412 and session entry 420.

The data packet 304 received from the service session 302 may indicate a session termination request. For example, the data packet 304 is a TCP FIN packet, a TCP RESET packet. Service gateway 110 examines the contents of data packet 304 and determines that data packet 304 includes a session termination request. In response, service gateway 110 removes session entry 420 from session table 412. Service gateway 110 may remove session item 420 after processing data packet 304 or wait a predetermined period of time before removing session item 420.

The processing method illustrated in fig. 2 is often referred to as a stateful processing method. The stateful approach allows service gateway 110 to apply one or more service policies to select server 200. The service policies may include security policies and other policies that protect server 200. If a security concern is detected, the security policy 482 may cause the service request 301 to be denied. Such safety considerations are well known to those of ordinary skill in the art and are not described in this application. Application traffic policy 483 or server load policy 483 may also prevent server 200 from being overloaded. Enforcing service policies tends to improve the service response time of server 200 for servicing host 100.

However, applying service policy 471 to service request 301 requires computing resources of service gateway 110 like CPU cycles. Such computational requirements may limit the ability of service gateway 110 to provide services when service gateway 110 receives and processes a large number of service requests over a short period of time.

For example, the session table 412 has some capacity limit like 4GB, 2000 entries, up to 10000 entries, or 200 MB. The greater the number of service sessions serviced by service gateway 110 using the stateful processing method, the greater the number of session entries stored in session table 412. The capacity of session table 412 may place severe limitations on the service capabilities of service gateway 110.

Fig. 3 illustrates a stateless processing method. In this approach, service gateway 110 does not use session table 412. Instead, service gateway 110 maintains and uses service mapping table 452. The service mapping table 452 is stored in the memory bank 400. The service mapping table 452 includes service mapping entries 460. Mapping entry 460 may include service address 330 and server address 321, linking service address 330 and server address 321 together. According to the service mapping entry 460, the server 200 having the server address 321 serves the host 100 for the service address 331.

When service gateway 110 receives data packet 304 from host 100, service gateway 110 obtains service address 331 from data packet 304 and compares service address 331 with service addresses stored in service mapping table 452. When service gateway 110 determines that there is a match with mapping entry 460, service gateway 110 retrieves server address 321 from mapping entry 460. Service gateway 110 modifies data packet 304 by replacing service address 331 with server address 321. Service gateway 110 sends modified data packet 304 to server 200.

When service gateway 110 receives data packet 307 from server 200, service gateway 110 processes data packet 307 using service mapping table 452. The service gateway 110 obtains the server address 3321 from the data packet 307. Service gateway 110 compares server address 321 with server addresses stored in service mapping table 452. When service gateway 110 determines that there is a match with mapping entry 460, service gateway 110 retrieves service address 331 from mapping entry 460 and modifies data packet 307 by replacing server address 321 with service address 331. Service gateway 110 then sends modified data packet 307 to host 100.

The service gateway 110 may use a hashing method to match the service address 331 or the server address 321 with the service mapping table 452. The service mapping table 452 includes a hash table using a hash function (HashFunc) 571. The map entry 460 is associated with a hash value (HashValue) 581.

HashValue581 includes the result of applying HashFunc571 to service address 331. HashValue581 may include the result of applying HashFunc571 to server address 321.

HashValue581 can include an index of the mapping entry 460 in the service mapping table 452. The map entry 460 occupies an entry in the service map 452 indexed by HashValue 581. For example, the service mapping table 452 contains 1000 entries with indices of 1-1000, and the mapping entry 460 has an index of 894. In another example, the service mapping table 452 contains 16 entries and the mapping entry 460 has an index of 7.

The service gateway 110 applies HashFunc571 to the service address 331 of the data packet 304 to obtain HashValue 581. Assume that service gateway 110 searches service mapping table 452 for an entry with index HashValue581 and finds mapping entry 460. For data packet 307, service gateway 110 applies HashFunc571 to server address 321 of data packet 307 to obtain HashValue 581. The service gateway 110 searches the service mapping table 452 for an entry with the index HashValue581 and finds the mapping entry 460.

The map entry 460 may include HashValue 581. After the service gateway 110 applies the hash function HashFunc571 to obtain HashValue581, the service gateway 110 searches the service mapping table 452 and finds a mapping entry 460 containing an index matching the HashValue 581.

Examples of hash functions HashFunc571 include CRC checksum functions and other checksum functions; a hash function using a combination of bitwise operators such as a bitwise AND operator, a bitwise OR operator, a bitwise NAND operator, AND a bitwise XOR operator; MD5 hash functions and other secure hash functions; jenkins hash functions and other insecure hash functions; a hardware-based hash function implemented in an FPGA, ASIC, or integrated circuit board of the service gateway 110; as well as other types of hash functions or table lookup functions. Typically, such a hash function is simple and can be quickly calculated by serving gateway 110.

Data packet 304 includes host address 104 associated with host 100. Service gateway 110 obtains host address 104 from data packet 304 and uses the obtained host address 104 in the processing of data packet 304.

The data packet 307 includes the host address 104. Service gateway 110 obtains host address 304 from data packet 307 and uses the obtained host address 104 in the processing of data packet 307.

Typically, the mapping item 460 is configured by the service provider or an administrator of the service provider. The mapping entry 460 may be configured when the server 200 becomes available, or when the server address 321 or the service address 331 becomes available. The server address 321 or the service address 331 may be configured by the service provider to become available.

In this stateless approach, service mapping table 452 is independent of the number of service sessions handled by service gateway 110. The capacity of the service mapping table 452 is related to the number of available service addresses and server addresses. Such capacity is typically small. The service mapping table 452 may contain tens or thousands of entries.

Advantages of the stateless approach include little resource requirements of the service mapping table 452, little or no computational requirements to manage the service request 301, or no requirements to apply the service policy 471. The stateless approach is generally preferred over the stateful approach when the service gateway 110 receives a large number of service session requests over a short period of time, or under heavy loading of service requests. The stateless approach is also preferred when the storage capacity of the session table for the new session becomes low, say below 10% of the session table 412. The stateless approach prevents service gateway 110 resources from being overloaded and thus maintains quality of service that contributes to host 100 in an emergency.

However, due to security concerns, a stateless processing method may not be as desirable as a stateful processing method because security gateway 110 does not apply security policy 482. Similarly, security gateway 110 does not apply any other of security policies 471, affecting the security of server 200, the security of data network 153, the traffic conditions of data network 153, and the quality of service reflected on host 100. The stateful approach is also preferred over the stateless approach when the service gateway 110 can select a server address 321 from a plurality of server addresses. For example, a service provider may configure multiple servers to serve service address 331 in a load balanced manner. The service provider may configure the backup server for service address 331.

In a typical deployment scenario, a service provider may use a stateful processing method for a first service address and a stateless processing method for a second, different service address. The service provider does not expect the first service to have a significant amount of traffic or usage. The service provider may desire that the second service have no security concerns. In fact, due to unforeseen conditions, the first service may see a sudden surge of traffic, while the second service may be subject to security attacks. When using the hybrid processing method according to the present invention, as described below, a service provider can combine the stateful processing method of the first service when the load is light and change to the stateless processing method when the load becomes heavy; and a hybrid processing method may be deployed to combine the stateless processing methods of the second service under normal circumstances and immediately switch to a stateful processing method when a security alert is detected for the second service.

Various embodiments of the present invention will now be described with reference to fig. 4 to 11.

Fig. 4 illustrates an embodiment of a service gateway 110 performing a hybrid stateless processing method combining a stateful processing method and a stateless processing method according to the present invention. Fig. 8 is a flow diagram illustrating an embodiment of a hybrid stateless processing method in accordance with the present invention. In this embodiment, the computer readable medium 114 of the service gateway 110 stores computer readable program code that, when executed by the processor 113, implements various embodiments of the present invention. Service gateway 110 stores session table 412 and service mapping table 452 in storage 400. In this embodiment of the hybrid stateless processing method, service gateway 110 processes the received data packet 304 using service mapping table 452 and using a stateless method when the service address of the received data packet 304 does not match any of the service addresses stored in session table 412.

The service gateway 100 is connected to the server 200 and the server 240. The server 200 is associated with a server address 321. Server 240 is associated with server address 324. Service gateway 110 is associated with service address 331 and service address 334.

In one embodiment, session table 412 includes a session entry 420 that stores service address 331 and server address 321, linking service address 331 and server address 321 together. The service mapping table 452 includes mapping entries 462 that store the service addresses 334 and the server addresses 324, linking the service addresses 334 and the server addresses 324 together.

In this embodiment, server 200 may be the same as server 240. Server address 321 may be the same as server address 324. Service address 331 may be the same as service address 334.

Referring to both fig. 4 and 8, service gateway 110 receives data packet 304(801) from host 100. Service gateway 110 obtains service address 336(802) from data packet 304. Service gateway 110 compares service address 336 of data packet 304 with the service addresses stored in session table 412 (803).

In one embodiment, service gateway 110 finds a match in session entry 420, where service address 336 matches service address 331 of session entry 420 (804). In response to finding a match, service gateway 110 processes data packet 304(805) according to the information stored in session entry 420 using a stateful processing method such as that described above with reference to fig. 2.

In one embodiment, service gateway 110 finds no match in session table 412 (804). In response, service gateway 110 compares 806 the service address 336 of data packet 304 to the service addresses in service mapping table 452. In one embodiment, service gateway 110 finds a match in mapping entry 462 of service mapping table 452, where service address 336 matches service address 324 of mapping entry 462 (807). Service gateway 110 processes data packet 304 according to the information stored in mapping entry 462 using a stateless processing method such as that described above with reference to figure 3.

In one embodiment, service gateway 110 receives data packet 307(830) from server 200. Service gateway 110 extracts server address 321(831) from data packet 307. Service gateway 110 compares server address 321 of data packet 307 with server addresses stored in session table 412 (832). In one embodiment, service gateway 110 finds a match in session entry 420, where server address 31 of data packet 307 matches server address 321 of session entry 420 (833). Service gateway 110 processes data packet 308(805) using a stateful processing method as described above with reference to figure 2.

In one embodiment, service gateway 110 receives data packet 308 from server 240 (830). Service gateway 110 extracts server address 324(831) from data packet 308. Service gateway 110 compares server address 324 of data packet 308 with the server addresses stored in session table 412 (832). In one embodiment, service gateway 110 does not find a match (833). In response, service gateway 110 compares (834) server address 324 of data packet 308 with the server addresses stored in service mapping table 452 and finds a match in mapping entry 462, where server address 324 of data packet 308 matches server address 324 of mapping entry 462 (807). In response, service gateway 110 modifies data packet 308(808) according to the information stored in mapping entry 462 using a stateless processing method. Service gateway 110 transmits modified data packet 308.

Fig. 5 illustrates an embodiment of the service gateway 110 performing a hybrid stateful processing method combining a stateful processing method and a stateless processing method according to the present invention. Fig. 9 is a flowchart illustrating an embodiment of a hybrid-stateful processing method according to the present invention. Referring to both fig. 5 and 9, service gateway 110 receives data packet 304(901) from host 100. In one embodiment, service gateway 110 determines that data packet 304 includes a service request 301 from host 100 (902). In response, service gateway 110 applies a stateful processing method to service request 301 (903). Service gateway 110 performs a stateful processing method as described above with reference to fig. 2, including applying service policies 471 to session request 301 and creating session entry 420 using service address 331 of service request 301 and server address 321 of service policies 471.

In one embodiment, service gateway 110 determines that data packet 304 does not include a service request (902). In response, serving gateway 110 processes data packet 304 using a hybrid stateless processing method as described above with reference to fig. 4.

In one embodiment, service gateway 110 receives data packet 307(901) from server 200. In this embodiment of the hybrid stateful processing method, serving gateway 110 applies the hybrid stateless processing method to data packet 307(904) as described above with reference to fig. 4.

Figures 6 and 10 illustrate embodiments of a service gateway and method, respectively, for changing from a hybrid-stateful processing method to a hybrid-stateless processing method in response to a hybrid-stateless condition being satisfied, in accordance with the present invention. Referring to both fig. 6 and 10, service gateway 110 is using a hybrid-stateful processing method (1001). Service gateway 110 maintains hybrid stateless condition 810. Service gateway 110 checks whether a hybrid-stateless condition 810(1002) is satisfied. In response to a determination (1003) that the hybrid-stateless condition 810 is satisfied, the service gateway 110 changes to a hybrid-stateless processing method (1004). Serving gateway 110 processes the next data packet received using a hybrid stateless processing method as described above with reference to fig. 4 and 8. In response to determining (1003) that the hybrid-stateless condition 810 is not satisfied, the service gateway 110 continues to use the hybrid-stateful processing method (1005), as described above with reference to fig. 5 and 9.

In one embodiment, the hybrid stateless condition 810 includes a session rate 811. For example, the session rate 811 is 1 ten thousand sessions per second, 5 thousand active sessions per second, or 1 hundred sessions per 10 milliseconds.

In one embodiment, service gateway 110 calculates session rate 821. In one embodiment, session rate 821 is calculated based on a count of active host-side service sessions over a period of time. In one embodiment, a service session is active when the service session is associated with a session entry in session table 412. In one embodiment, session rate 821 calculates a difference between a count of received service requests and a count of received service termination requests over a period of time. In one embodiment, session rate 821 calculates a count of service requests received over a period of time.

In one embodiment, service gateway 110 calculates session rate 821 for a predetermined period of time, such as once per second, once every 250 milliseconds, once every 3 seconds, or once every 10 seconds. In one embodiment, service gateway 110 calculates session rate 821 at variable times. For example, when a data packet is received from a host; when a service request is received; when a service termination request is received; or service gateway 110 calculates session rate 821 when receiving data packets from server 200. Service gateway 110 compares session rate 821 with session rate 811 of hybrid stateless condition 810. In one embodiment, service gateway 110 determines that hybrid stateless condition 810 is met and satisfied when session rate 821 exceeds or equals session rate 811.

In one embodiment, the hybrid-stateless condition 810 includes a session table utilization 814. Session table utilization is a parameter that gives a percentage of the session table capacity in which session entries are stored. If the count of stored session entries of the session table 412 exceeds the session table utilization 814, then the hybrid-stateless condition 810 is satisfied. For example, session table utilization 814 is 90%, 85%, or 95%. Service gateway 110 calculates session table utilization 824 from time to time by calculating a count of the stored session entries of session table 412. In one embodiment, service gateway 110 periodically calculates session table utilization 824 as once every second, once every 20 milliseconds, once every 500 milliseconds, or once every 2 seconds. In one embodiment, when service gateway 110 processes a service request, service termination request, or data packet, service gateway 110 calculates session table utilization 824.

The service gateway 110 compares the session table utilization 824 with the session table utilization 814 for the hybrid stateless condition 810. In one embodiment, when session table utilization 824 exceeds or equals session table utilization 814, serving gateway 110 determines that hybrid stateless condition 810 is reached and satisfied.

In one embodiment, the hybrid-stateless condition 810 further includes a duration 816, wherein the hybrid-stateless condition 810 must be considered to be reached at least for the duration 816 in order for the hybrid-stateless condition 810 to be satisfied. Examples of duration 816 include 120 seconds, 30 seconds, and 5 seconds. As previously described, from time to time, serving gateway 110 checks whether hybrid-stateless condition 810 is reached. In one embodiment, service gateway 110 further includes a duration 826 stored in memory. Initially, service gateway 110 specifies a value of 0 for duration 826. From time to time, serving gateway 110 checks whether hybrid stateless condition 810 is reached. If the hybrid-stateless condition 810 is reached, the service gateway 110 increases the duration 826 by the amount of time that has elapsed since the hybrid-stateless condition 810 was last checked. In one embodiment, after modifying duration 826, serving gateway 110 checks whether duration 826 exceeds duration 816. If duration 826 exceeds duration 816, service gateway 110 determines that hybrid stateless condition 810 is satisfied. Serving gateway 110 then changes to apply the hybrid stateless approach to subsequently received data packets.

In one embodiment, service gateway 110 determines that hybrid stateless condition 810 is not satisfied. In response, service gateway 110 modifies duration 826 to a value of 0.

In one embodiment, the service gateway 110 receives the hybrid-stateless condition 810 from an operator or administrator 130. The administrator 130 may be an operator who provides the hybrid-stateless condition 810 to the service gateway 110. The administrator 130 may be a network management system that sends the hybrid stateless condition 810 to the service gateway 110. The administrator 130 may include a storage medium storing a hybrid stateless condition 810. Service gateway 110 retrieves hybrid stateless condition 810 from the storage of administrator 130.

Figures 7 and 11 illustrate embodiments of a service gateway and method, respectively, for changing from a hybrid stateless processing method to a hybrid stateful processing method in response to a hybrid stateful condition being satisfied in accordance with the present invention. Referring to both fig. 7 and 11, in one embodiment, service gateway 110 employs a hybrid stateless processing method (1101). Service gateway 110 maintains mixed-state condition 910. Service gateway 110 checks whether a mixed-state condition is satisfied 910 (1102). In response to determining (1103) that the mixed-state condition 910 is satisfied, the serving gateway 110 changes to the mixed-state processing method (1104) and processes the next data packet using the mixed-state processing method as described above with reference to fig. 5 and 9. In response to determining (1103) that the mixed-stateful condition 910 is not satisfied, the service gateway 110 continues to use the mixed-stateless processing method (1105) and processes the next data packet using the mixed-stateless processing method as described above with reference to fig. 4 and 8.

In one embodiment, the mixed-stateful condition 910 includes a session rate 911. For example, session rate 911 is 1 thousand sessions per second, 500 active sessions per second, or 10 sessions per 10 milliseconds.

In one embodiment, service gateway 110 calculates a session rate 921. In one embodiment, session rate 921 calculates a difference between a count of received session requests and a count of received service termination requests over a period of time. In one embodiment, session rate 921 calculates a count of service requests received over a period of time. In one example, service gateway 110 determines whether a data packet received from a host includes a service request before applying the hybrid stateless processing method to the received data packet. In one embodiment, service gateway 100 determines whether a data packet received from a host or server includes a service termination request before applying the hybrid stateless processing method to the received data packet.

In one embodiment, serving gateway 110 calculates session rate 921 for a predetermined period of time, such as once per second, once every 100 milliseconds, once every 3 seconds, or once every 5 seconds. In one embodiment, service gateway 110 calculates session rate 921 at variable times. For example, when a data packet is received from a host; when a service request is received; when a service termination request is received; or service gateway 110 calculates session rate 921 when receiving data packets from the server. Serving gateway 110 compares session rate 921 with session rate 911. In one embodiment, serving gateway 110 determines that hybrid-stateful condition 910 is reached and satisfied when session rate 921 is lower or less than session rate 911.

In one embodiment, the mixed-stateful conditions 910 include a session table utilization 914. The mixed-stateful condition 910 is satisfied if the count of stored session entries of the session table 412 does not exceed the session table utilization 914. For example, session table utilization 914 is 60%, 75%, or 45%. Service gateway 110 calculates session table utilization 924 from time to time by calculating a count of stored session entries of session table 412. In one embodiment, service gateway 110 periodically calculates session table utilization 924 such as once every second, once every 20 milliseconds, once every 500 milliseconds, or once every 2 seconds. In one embodiment, service gateway 110 calculates session table utilization 924 when service gateway 110 processes a service request, service termination request, or data packet.

Service gateway 110 compares session table utilization 924 to session table utilization 914 of mixed-stateful condition 910. In one embodiment, when session table utilization 924 is less than session table utilization 914, serving gateway 110 determines that hybrid stateful condition 910 is reached and satisfied.

In one embodiment, the mixed-stateful condition 910 further includes a duration 916, where the mixed-stateful condition 910 must be considered to be reached at least for the duration 916 in order for the mixed-stateful condition 910 to be satisfied. Examples of duration 916 include 100 seconds, 40 seconds, and 5 seconds. As previously described, from time to time, the serving gateway 110 checks whether the mixed-stateful condition 910 is reached. In one embodiment, service gateway 110 further includes duration 926 stored in memory. Initially, service gateway 110 specifies a value of 0 for duration 926. From time to time, service gateway 110 determines whether a mixed stateful condition 910 is reached. If the mixed-stateful condition 910 is reached, the service gateway 110 increases the duration 926 by the amount of time that has elapsed since the last check for the mixed-stateful condition 910. In one embodiment, after modifying duration 926, serving gateway 110 checks whether duration 926 exceeds duration 916. If duration 926 exceeds duration 916, serving gateway 110 determines that mixed-stateful condition 910 is satisfied. Service gateway 110 then changes to apply the hybrid stateful method to subsequently received data packets.

In one embodiment, service gateway 110 receives a hybrid stateful condition 910 from an operator or administrator 130. The administrator 130 may be an operator that provides the hybrid stateful condition 910 to the service gateway 110. Administrator 130 may be a network management system that sends mixed stateful conditions 910 to service gateway 110. The administrator 130 may include a storage medium that stores the mixed-stateful condition 910. Service gateway 110 retrieves mixed-state condition 910 from the storage of administrator 130.

Returning to fig. 8, fig. 8 shows that while serving gateway 110 is processing data packets using a stateful processing method (805), serving gateway 110 checks whether a hybrid stateless condition 810 (see fig. 10) is reached. Figure 8 also shows that while serving gateway 110 is processing data packets using a stateless processing method (808), serving gateway 110 checks whether a mixed-stateful condition 910 (see figure 11) is reached. However, the reference numerals (C and D) to fig. 10 and 11 are not intended to convey any order of steps. The checking of the condition 810 or 910 may be performed simultaneously with the processing of the data packet as described above with reference to fig. 4 and 8.

Returning to fig. 9, fig. 9 shows that while serving gateway 110 is processing data packets using a stateful processing method (903), serving gateway 110 checks whether a hybrid stateless condition 810 (see fig. 10) is reached. Fig. 9 also shows that when serving gateway 110 is processing a data packet using the hybrid-stateless processing method (904), serving gateway 110 checks whether hybrid-stateless condition 810 or hybrid-stateful condition 910 (see fig. 10 and 11) is reached, depending on the processing during the hybrid-stateless processing method according to fig. 4 and 8. However, the reference numerals to FIGS. 10(C) and 11(D) are not intended to convey any order of steps. The checking of the condition 810 or 910 may be performed simultaneously with the processing of the data packet as illustrated in fig. 5 and 9.

Although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.

Claims (12)

1. A method of processing data packets sent over a communication session between a host and a server by a serving gateway, comprising:

processing, by the serving gateway, the data packet using a hybrid-stateful processing method;

checking, by the serving gateway, whether a hybrid-stateless condition is satisfied;

changing, by the serving gateway, to a hybrid-stateless processing method for subsequently received data packets in response to a determination that the hybrid-stateless condition is satisfied; and

processing, by the serving gateway, subsequently received data packets using a hybrid-stateful processing method in response to a determination that the hybrid-stateless condition is not satisfied, wherein

The checking by the serving gateway whether a hybrid-stateless condition is satisfied comprises:

determining, by the serving gateway, whether a hybrid-stateless condition is reached within a predetermined duration;

determining, by the serving gateway, that a hybrid-stateless condition is satisfied in response to a determination that the hybrid-stateless condition is reached within a predetermined duration; and

in response to a determination that the hybrid-stateless condition has not been met for the predetermined duration, determining, by the service gateway, that the hybrid-stateless condition is not met.

2. The method of claim 1, wherein the hybrid-stateful processing method comprises:

receiving, by the serving gateway, a data packet;

determining, by the service gateway, whether the data packet was received by the service gateway from the host or the server;

determining, by the service gateway, whether the data packet contains a service request in response to a determination that the data packet is received from the host;

processing, by the serving gateway, the data packet using a stateful processing method in response to a determination that the data packet contains a service request;

processing, by the serving gateway, the data packet using a hybrid stateless processing method in response to a determination that the data packet is received from the host and does not contain a service request; and

processing, by the serving gateway, the data packet using a hybrid stateless processing method in response to a determination that the data packet is received from a server;

the mixed stateless processing method comprises the following steps:

receiving, by the service gateway, a subsequently received data packet from the host;

obtaining, by the service gateway, a service address from a subsequently received data packet;

comparing, by the service gateway, the service address of the subsequently received data packet with the service address in the session entry stored in the session table;

processing, by the service gateway, the subsequently received data packet in accordance with the information stored in the matching session entry using a stateful processing method in response to a determination that the session table contains a session entry matching the service address of the subsequently received data packet; and

in response to a determination that the session table does not contain any session entries that match the service address of subsequently received data packets:

comparing, by the service gateway, the service address of the subsequently received data packet with the service address in the mapping entry stored in the mapping table;

finding, by the service gateway, a mapping entry that matches a service address of a subsequently received data packet; and

processing, by the service gateway, subsequently received data packets according to the information stored in the matching mapping entry using a stateless processing method.

3. The method of claim 1, wherein the hybrid-stateless condition comprises a predetermined session rate, wherein verifying by the serving gateway whether the hybrid-stateless condition is satisfied comprises:

calculating session rates for a plurality of communication sessions received by the serving gateway;

determining, by the serving gateway, whether the calculated session rate is greater than or equal to a predetermined session rate;

determining, by the serving gateway, that a hybrid-stateless condition is satisfied in response to a determination that the calculated session rate is greater than or equal to a predetermined session rate; and

responsive to a determination that the calculated session rate is less than the predetermined session rate, determining, by the serving gateway, that the hybrid-stateless condition is not satisfied.

4. The method of claim 3, wherein the calculated session rate comprises:

a count of active host-side service sessions over a predetermined period of time;

a difference between the count of received service requests and the count of received service termination requests over a predetermined period of time; or

A count of service requests over a predetermined period of time.

5. The method of claim 1, wherein the hybrid-stateless condition comprises a predetermined session table utilization, wherein verifying by the serving gateway whether the hybrid-stateless condition is satisfied comprises:

counting, by the serving gateway, a number of session entries stored in a session table;

determining, by the service gateway, whether the number of stored session items exceeds a predetermined session table utilization;

determining, by the serving gateway, that a hybrid-stateless condition is satisfied in response to a determination that the number of stored session entries exceeds a predetermined session table utilization; and

in response to a determination that the number of stored session entries does not exceed the predetermined session table utilization, determining, by the service gateway, that the hybrid-stateless condition is not satisfied.

6. A system for processing data packets sent over a communication session between a host and a server, comprising:

a services gateway comprising a processor and a computer readable storage medium having computer readable program code embodied therewith, the services gateway configured to:

processing the data packet using a hybrid stateful processing method;

checking whether a hybrid stateless condition is met;

in response to a determination that the hybrid-stateless condition is satisfied, changing to a hybrid-stateless processing method for subsequently received data packets; and

in response to a determination that the hybrid-stateless condition is not satisfied, processing a subsequently received data packet using a hybrid-stateful processing method, wherein

The checking whether the hybrid-stateless condition is satisfied comprises:

determining whether a hybrid-stateless condition is reached within a predetermined duration;

determining that a hybrid-stateless condition is satisfied in response to a determination that the hybrid-stateless condition is reached within a predetermined duration; and

in response to a determination that the hybrid-stateless condition has not been met for the predetermined duration, determining that the hybrid-stateless condition is not met.

7. The system of claim 6, wherein the hybrid-stateful processing method comprises:

receiving a data packet;

determining whether the data packet was received from a host or a server;

determining, in response to a determination that the data packet is received from the host, whether the data packet contains a service request;

in response to a determination that the data packet contains a service request, processing the data packet using a stateful processing method;

in response to a determination that the data packet is received from the host and does not contain a service request, processing the data packet using a hybrid stateless processing method; and

in response to a determination that the data packet is received from the server, processing the data packet using a hybrid stateless processing method;

the mixed stateless processing method comprises the following steps:

receiving a subsequently received data packet from the host;

obtaining a service address from a subsequently received data packet;

comparing the service address of the subsequently received data packet with the service address in the session entry stored in the session table;

in response to a determination that the session table contains a session entry matching the service address of the subsequently received data packet, processing the subsequently received data packet using a stateful processing method in accordance with information stored in the matching session entry; and

in response to a determination that the session table does not contain any session entries that match the service address of subsequently received data packets:

comparing the service address of the subsequently received data packet with the service address in the mapping entry stored in the mapping table;

finding a mapping entry matching a service address of a subsequently received data packet; and

subsequently received data packets are processed according to the information stored in the matching mapping entry using a stateless processing method.

8. The system of claim 6, wherein the hybrid-stateless condition comprises a predetermined session rate, wherein checking whether the hybrid-stateless condition is satisfied comprises:

calculating session rates of a plurality of communication sessions received by a serving gateway;

determining whether the calculated session rate is greater than or equal to a predetermined session rate;

determining that a hybrid stateless condition is satisfied in response to a determination that the calculated session rate is greater than or equal to the predetermined session rate; and

in response to a determination that the calculated session rate is less than the predetermined session rate, it is determined that the hybrid-stateless condition is not satisfied.

9. The system of claim 6, wherein the hybrid-stateless condition comprises a predetermined session table utilization, wherein checking whether the hybrid-stateless condition is satisfied comprises:

counting the number of session items stored in the session table;

determining whether the number of stored session items exceeds a predetermined session table utilization;

determining that a hybrid stateless condition is satisfied in response to a determination that the number of stored session items exceeds a predetermined session table utilization; and

in response to a determination that the number of stored session items does not exceed the predetermined session table utilization, determining that the hybrid-stateless condition is not satisfied.

10. A method of processing data packets sent over a communication session between a host and a server by a serving gateway, comprising:

processing, by the serving gateway, the data packet using a hybrid stateless processing method;

checking, by the serving gateway, whether a mixed stateful condition is satisfied;

in response to a determination that a mixed-stateful condition is satisfied, changing, by the serving gateway, to a mixed-stateful processing method for subsequently received data packets; and

processing, by the serving gateway, subsequently received data packets using a hybrid stateless processing method in response to a determination that the hybrid stateful condition is not satisfied, wherein

The checking by the serving gateway whether a hybrid stateful condition is satisfied comprises:

determining, by the serving gateway, whether a mixed-stateful condition is reached within a predetermined duration;

determining, by the serving gateway, that a mixed stateful condition is satisfied in response to a determination that the mixed stateful condition is reached within a predetermined duration; and

in response to a determination that the mixed-stateful condition has not been met for the predetermined duration, determining, by the service gateway, that the mixed-stateful condition is not met.

11. The method of claim 10, wherein the hybrid stateless processing method comprises:

receiving, by the service gateway, a data packet from the host;

obtaining, by the service gateway, a service address from the data packet;

comparing, by the service gateway, the service address of the data packet with service addresses in session entries stored in a session table;

in response to a determination that the session table contains a session entry matching the service address of the data packet, processing, by the service gateway, the data packet according to information stored in the matching session entry using a stateful processing method; and

in response to a determination that the session table does not contain any session entries that match the service address of the data packet:

comparing, by the service gateway, the service address of the data packet with the service address in the mapping entry stored in the mapping table;

finding, by the service gateway, a mapping entry matching the service address of the data packet; and

processing, by the service gateway, the data packet according to the information stored in the matching mapping entry using a stateless processing method;

the mixed stateless processing method comprises the following steps:

receiving, by the serving gateway, a data packet from a server;

obtaining, by the serving gateway, a server address from the data packet;

comparing, by the service gateway, the server address of the data packet with the service address in the session entry stored in the session table;

in response to a determination that the session table contains a session entry matching the server address of the data packet, processing, by the service gateway, the data packet according to information stored in the matching session entry using a stateful processing method; and

in response to a determination that the session table does not contain any session entries that match the server address of the data packet:

comparing, by the service gateway, the server address of the data packet with the service address in the mapping entry stored in the mapping table;

finding, by the service gateway, a mapping entry matching the server address of the data packet; and

processing, by the service gateway, the data packet according to the information stored in the matching mapping entry using a stateless processing method.

12. The method of claim 10, wherein the mixed-stateful condition comprises a predetermined session rate or a predetermined session table utilization.