Cloud Multi-Perimeter Firewall Routing for Low-Latency Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network optimization technologies, such as WAN optimization and VPNs, often result in high latency and lack control over traffic flow, leading to poor user experience and increased costs due to reliance on fixed point-to-point connections or unstable internet routes, especially when connecting remote LANs to cloud-based servers.
Innovation Solution
A Global Virtual Network (GVN) utilizing a mesh of distributed firewall devices with advanced tunnels and automated routing to optimize secure data flow, providing secure, reliable, and fast connectivity over standard internet connections by dynamically selecting the best path for traffic through a network of strategically positioned firewalls and access points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If WAN optimization technology is used to compress and secure data flow, then data transmission speed is improved, but latency increases and connection control is lost
Solution Approach 1:
The patent introduces a content delivery network (CDN) as an intermediary between the origin server and end users. The CDN distributes and caches content across multiple geographically distributed servers, allowing users to access content from the nearest CDN node rather than routing through remote WAN optimization devices. This eliminates the latency caused by WAN optimization while maintaining secure data transmission through the CDN's infrastructure.
Solution Approach 2:
The patent segments the content delivery function from the origin server by deploying distributed CDN nodes across multiple locations. This segmentation allows content to be delivered locally from nearby CDN nodes rather than traveling through long-distance WAN connections, thereby reducing latency while maintaining the security and compression benefits at the origin.
2Reliability
If fixed point-to-point connections or dedicated circuits are used, then connection stability and QOS guarantees are improved, but installation time and cost increase significantly
Solution Approach 1:
The patent uses the CDN network as an intermediary that provides stable, reliable content delivery without requiring dedicated point-to-point connections between the origin server and each user. The CDN's established infrastructure of distributed nodes provides QOS guarantees through its controlled network, eliminating the need for time-consuming dedicated circuit installation while maintaining connection stability.
Solution Approach 2:
The CDN provides universal content delivery service to multiple users simultaneously across different locations through its distributed network. This multi-functional infrastructure replaces the need for individual dedicated connections for each user, providing reliable service to all users through a shared, pre-established network rather than requiring separate installation for each connection.
3Reliability
If traffic is routed through remote LAN gateway to access local servers, then network security is maintained, but global transit time doubles or triples
Solution Approach 1:
The patent introduces the CDN as an intermediary that serves as a local access point for users. Instead of routing traffic through remote LAN gateways, users access content directly from the nearest CDN node, which acts as a local intermediary. This maintains security through the CDN's controlled access while eliminating the need for traffic to travel to remote gateways and back, reducing global transit time significantly.
Solution Approach 2:
The patent changes the network topology from a centralized remote gateway model to a distributed local access model. By deploying CDN nodes at multiple geographic locations, the system adds a spatial dimension to content access, allowing users to connect to the nearest node rather than a single remote gateway. This dimensional change reduces travel distance and time while maintaining security through distributed access control.
Data Source
AI summary
Systems and methods for providing multi-perimeter firewalls via a virtual global network are disclosed. In one embodiment the network system may comprise an egress ingress point in communication with a first access point server, a second access point server in communication with the first access point server, an endpoint device in communication with the second access point server, a first firewall in communication with the first access point server, and a second firewall in communication with the second access point server. The first and second firewalls may prevent traffic from passing through their respective access point servers. The first and second may be in communication with each other and exchange threat information.