Network Node Configuration Data Protection With Redundant Executers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The redis database used in SONIC systems for network nodes is not completely secure, leading to vulnerabilities like remote code/command execution (REC) that cause data disorder and abnormal switch functions.
Innovation Solution
An endogenous security protection method is implemented, involving encapsulating configuration commands into network message flows, backing up and parsing these flows, storing data in dynamic heterogeneous redundant executers, performing consistency judgments, and dynamically scheduling executers to ensure data integrity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If configuration data is stored in a single redis database, then the system structure is simple and easy to operate, but the security and reliability are insufficient allowing data tampering and REC vulnerabilities
Solution Approach 1:
The patent segments the configuration data storage by distributing data across multiple dynamic heterogeneous redundant executers instead of using a single redis database. Each executer stores a portion of the configuration data, and the system performs consistency judgments across all executers to ensure data integrity and security against tampering.
Solution Approach 2:
The patent implements beforehand cushioning by performing data backup before any potential data tampering occurs. The system backs up configuration data to multiple executers in advance, creating a cushion against future security threats such as REC vulnerabilities or data tampering attempts.
2Reliability
If multiple dynamic heterogeneous redundant executers are used for data storage, then data security and consistency are improved, but the system complexity and data management difficulty increase
Solution Approach 1:
The patent implements feedback mechanisms where the synchronization module continuously monitors data consistency across all dynamic heterogeneous redundant executers. When inconsistencies are detected, the system automatically triggers consistency judgments and performs online-offline scheduling to restore consistency, thereby managing complexity through automated feedback loops.
Solution Approach 2:
The system performs self-service by automatically managing its own consistency through internal consistency judgment mechanisms. The synchronization module autonomously detects data inconsistencies, identifies affected executers, and performs repairs without external intervention, reducing the operational burden of managing multiple redundant systems.
3Reliability
If dynamic heterogeneous redundant executers are used with consistency checks, then data integrity is protected against tampering, but the operational speed and data synchronization time increase
Solution Approach 1:
The patent applies dynamics by implementing dynamic online-offline scheduling of executers. The system can switch between different executers based on real-time conditions, allowing faster data synchronization by selecting optimal executers for read/write operations while maintaining redundancy for security purposes.
Solution Approach 2:
The system performs preliminary actions by pre-establishing multiple redundant executers with initial data copies before actual operations begin. This allows the system to immediately leverage existing data across executers during consistency checks rather than performing full synchronization from scratch, reducing operational latency.
Data Source
AI summary
An endogenous security protection method for configuration data in an operating system of a network node includes: when a data backup module receives a network message flow, target configuration data is backed up in the data backup module, a distribution module send the received network message flow to each dynamic heterogeneous redundant executer respectively, each dynamic heterogeneous redundant executer stores the target configuration data, a synchronization module read the target configuration data stored by each dynamic heterogeneous redundant executer respectively, a judgment module performs consistency judgment, the synchronization module performs online-offline scheduling on the executers based on a judgment result, a target executer with data disorder is taken offline, a candidate executer is brought online, and the candidate executer obtains the target configuration data from the data backup module.