Cyber-Security Aware Packet Forwarding with Lock-Free Flow Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network-based information systems, achieving optimal data forwarding policies that maximize throughput is challenging due to the need for balancing feedback between processors and forwarders, with existing methods either being sub-optimal without feedback or replicating processing functions, leading to inefficiencies.
Innovation Solution
The implementation of a fractal-like architecture with Tail Early Dropping (TED) queuing and a lock-free low false negatives (LF−) data structure, which allows for concurrent data processing and forwarding, optimizing the workflow by prioritizing high-information data and tolerating low false negatives, while adjusting loading parameters to manage congestion and information processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If feedback from processors to forwarders is increased to optimize forwarding decisions, then forwarding efficiency is improved, but system complexity and resource overhead increase
Solution Approach 1:
The patent extracts and separates the forwarding decision function from the processing function, placing forwarding decisions at forwarders based on local policy information rather than requiring continuous feedback from processors. This extraction eliminates the need for complex feedback mechanisms while maintaining efficient forwarding through pre-configured security policies and flow table lookups.
Solution Approach 2:
The system segments network functions into distinct forwarders and processors with clear separation of duties. Forwarders handle packet forwarding using simplified rules, while processors handle complex security analysis. This segmentation allows each component to operate independently with appropriate complexity levels, avoiding the need for complex inter-component feedback.
2Productivity
If all processing output is fed back to forwarders to replicate processing function, then forwarding decisions are optimized, but the network architecture efficiency is reduced
Solution Approach 1:
Instead of feeding back all processing output to forwarders, the system implements partial action by providing only essential security policy information and flow table updates. This selective feedback mechanism maintains accurate forwarding decisions while avoiding the overhead of replicating entire processing functions at forwarders.
Solution Approach 2:
The system creates simplified copies of security policies and flow table information at forwarders rather than replicating the entire processing function. This allows forwarders to make accurate forwarding decisions based on local information without requiring continuous communication with processors, thereby improving network efficiency.
3Device complexity
If static forwarding policies are used without feedback, then system complexity is reduced, but forwarding performance becomes sub-optimal
Solution Approach 1:
The system performs preliminary action by pre-configuring security policies and flow table information at forwarders before packets arrive. This allows forwarders to make optimized forwarding decisions using locally available information without requiring real-time feedback, achieving both low complexity and high performance through advance preparation.
Solution Approach 2:
Forwarders are equipped with self-service capabilities through local security policy information and flow tables, enabling them to make autonomous forwarding decisions without continuous external feedback. This self-service approach maintains simple system architecture while achieving optimal forwarding performance through locally cached security information.
Data Source
AI summary
For balancing load, a forwarder can selectively direct data from the forwarder to a processor according to a loading parameter. The selective direction includes forwarding the data to the processor for processing, transforming and/or forwarding the data to another node, and dropping the data. The forwarder can also adjust the loading parameter based on, at least in part, feedback received from the processor. One or more processing elements can store values associated with one or more flows into a structure without locking the structure. The stored values can be used to determine how to direct the flows, e.g., whether to process a flow or to drop it. The structure can be used within an information channel providing feedback to a processor.