Consistent Hash Ring Flow Synchronization for Redundant Security Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security devices face scaling issues when providing stateful security with a large number of redundant devices due to excessive bandwidth and memory requirements for flow state synchronization among all peer devices, making it impractical to scale up the number of redundant security devices.
Innovation Solution
Implement a consistent hash ring algorithm to assign a primary and backup security device for each bidirectional flow, limiting synchronization to these devices only, reducing the scope of state synchronization to M devices out of a total of N, where M is less than N, and using the same algorithm for routers and security devices to ensure symmetric routing and efficient flow redirection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If flow state information is synchronized among all N peer security devices to ensure resiliency and availability, then security service reliability is improved, but bandwidth consumption and memory usage increase excessively
Solution Approach 1:
The patent segments the synchronization scope by dividing security devices into primary devices and backup devices for each flow. Instead of synchronizing with all N devices, each primary device only synchronizes with its designated backup devices (M < N), reducing bandwidth consumption while maintaining reliability through targeted redundancy.
Solution Approach 2:
The patent applies local quality by making different devices have different synchronization roles. Primary security devices maintain flow state information and synchronize with backup devices, while backup devices only receive synchronization for specific flows they are designated to back up, rather than all devices having equal synchronization responsibilities.
2Reliability
If flow state information is synchronized among all N peer security devices to ensure resiliency and availability, then security service reliability is improved, but memory usage increases excessively
Solution Approach 1:
The patent segments the memory burden by assigning specific backup responsibilities to each device. Each backup device only stores flow state information for the flows it is designated to back up (M flows), rather than storing states for all N flows, thus reducing memory usage while maintaining reliability through distributed segmentation.
Solution Approach 2:
The patent applies local quality by making different devices have different memory storage responsibilities. Primary devices store their own flow states, while backup devices store only the states of flows they are designated to back up, optimizing memory usage according to each device's local role in the system.
3Reliability
If the number of redundant security devices is increased to improve resiliency and availability, then security service reliability is improved, but the overhead of state synchronization increases
Solution Approach 1:
The patent segments the synchronization overhead by limiting each primary device to synchronize only with its designated M backup devices, where M < N. This segmentation reduces the complexity growth from O(N²) in full synchronization to O(MN) where M is a constant or grows much slower than N.
Solution Approach 2:
The patent applies partial action by implementing just enough synchronization (M backup devices) to achieve the required reliability level, rather than synchronizing with all N devices. This partial synchronization is sufficient for resiliency while avoiding the excessive overhead of complete synchronization.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example security systems for use between at least one upstream router and at least one downstream router, are described. A group or pool of security devices can be used to provide stateful security to bidirectional packet flows between upstream and downstream routers. The packets of the bidirectional flows are forwarded to particular security devices based on a consistent hash ring process. For a given flow, bidirectional state information is synchronized among some, but not all, of the security devices. The security devices among which such bidirectional flow state information is shared are determined using the same consistent hash ring process.