Concurrent Network Packet Security Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network packet communication systems face significant latency issues due to the serial processing of packets through multiple in-line network security tools, which can degrade performance as the number and complexity of security tools increase.
Innovation Solution
Implementing a network packet forwarding system that concurrently sends input packets to multiple security tools for parallel processing, allowing each tool to process the packet independently without waiting for others, and then combines the results to forward a secure packet to the destination, with features like hash value generation and timeout management to handle unresponsive tools.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packets are processed serially through multiple security tools, then each tool can process packets independently, but overall latency increases significantly
Solution Approach 1:
The patent segments the packet processing task by dividing packets into different groups and assigning them to different security tools simultaneously. Each packet group is processed by a specific tool in parallel, eliminating the sequential bottleneck while maintaining comprehensive security coverage through multiple tools.
Solution Approach 2:
The patent introduces a time dimension to packet processing by enabling concurrent processing across multiple security tools. Instead of processing packets sequentially through time (tool 1 then tool 2 then tool 3), the system processes different packet groups simultaneously across different tools, reducing total processing time while maintaining security completeness.
2Adaptability or versatility
If more security tools are added to increase monitoring capabilities, then security coverage improves, but processing latency increases
Solution Approach 1:
The patent segments packets into different groups and distributes them to different security tools simultaneously. This allows the system to handle an increased number of security tools without proportionally increasing latency, as each tool processes its assigned packet group in parallel rather than sequentially.
Solution Approach 2:
The patent implements a mechanism where not all security tools must process every packet. Instead, packets are divided and sent to a subset of available tools, allowing the system to scale security monitoring capability by adding more tools while maintaining acceptable latency through selective parallel processing.
3Reliability
If packets wait for all security tools to complete processing, then security validation is complete, but throughput decreases
Solution Approach 1:
The patent segments the security validation process into parallel tracks, where different packet groups are validated by different security tools simultaneously. This allows the system to maintain complete security validation by ensuring all relevant tools process their assigned packets while enabling higher throughput through concurrent processing.
Solution Approach 2:
The patent transitions from a single-threaded validation approach (waiting for all tools sequentially) to a multi-dimensional parallel validation approach where multiple tools process packets simultaneously. This dimensional change enables the system to achieve both complete validation and high throughput by exploiting parallel processing capabilities.
Data Source
AI summary
Systems and methods provide concurrent security processing for multiple network security tools. An input packet is received at a network packet forwarding system from a network packet source, and the network packet forwarding system concurrently sends an output packet based upon the input packet to multiple security tools. Return packets are received based upon the output packet from the security tools after their respective security processing. Once return packets are received from each of the security tools, the network packet forwarding system forwards a secure packet to a packet destination. If a timeout occurs before all return packets are received, the network packet forwarding system can assume that the original packet was unsafe and discard information stored for the input packet. If security tools are configured to modify packets, these modifications can also be tracked.