Distributed Deep Packet Inspection in Virtual Datacenters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep packet inspection at line rates poses a challenge due to latency issues and high capital investment in custom hardware, and remote packet inspection introduces undesirable delays in network traffic.
Innovation Solution
Distributed deep packet inspection across a cluster of host devices in a virtual datacenter, where packets are copied and inspected after forwarding, allowing for policy responses to be triggered without delaying packet transmission, utilizing a map of available devices to optimize computational resources and reduce latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If deep packet inspection is performed at line rate using physical DPI equipment, then packet inspection capability is improved, but capital investment increases and latency increases
Solution Approach 1:
The patent segments the deep packet inspection function by distributing it across multiple host devices in a virtual datacenter cluster rather than concentrating it in a single physical DPI equipment. This segmentation allows parallel processing of packets across multiple nodes, maintaining line rate capability while reducing per-node complexity and avoiding the latency associated with centralized inspection points.
Solution Approach 2:
The patent employs packet copying by receiving a copy of packets flowing between source and destination, then forwarding the original packet while inspecting the copy. This copying mechanism enables inspection without blocking the original packet flow, thereby maintaining low latency while preserving full inspection capability.
2Productivity
If physical DPI equipment is deployed, then packet inspection capability is improved, but capital investment increases
Solution Approach 1:
The patent uses virtual machine instances that copy and replicate inspection functionality across multiple host devices, eliminating the need for expensive specialized physical DPI hardware. The inspection logic is copied into software running on standard server hardware, dramatically reducing capital investment while maintaining inspection capability.
Solution Approach 2:
The patent replaces physical DPI equipment with a virtualized system using standard host devices and virtual machine instances. This substitution eliminates the need for custom hardware investments by implementing packet inspection through software virtualization on commodity hardware.
3Productivity
If remote packet inspection is used, then packet inspection capability is improved, but network traffic delays increase
Solution Approach 1:
The patent segments packet inspection across multiple local host devices within the virtual datacenter cluster, allowing each node to inspect packets locally before they traverse the network. This distributed local inspection eliminates the need for remote inspection round trips, reducing network traffic delays while maintaining inspection capability.
Solution Approach 2:
The patent performs packet inspection as a preliminary action before packets are fully transmitted through the network by inspecting copies of packets at the source or at intermediate host devices. This preliminary inspection allows the system to identify and handle problematic packets early, preventing unnecessary network traffic and reducing delays.
Data Source
AI summary
Exemplary methods, apparatuses, and systems receive a copy of or make a copy of one or more packets of a flow of packets between a source and a destination. While or after the one or more packets are forwarded to the destination, the content of the one or more packets is compared to a policy to determine if the flow of packets triggers a policy response. A map of devices within a datacenter cluster of devices is maintained and used to select one or more available devices when packet inspection is distributed.