Distributed Firewall Remapping for Low-Latency Interconnect Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large computer systems with hundreds or thousands of initiators and targets, centralized firewalls become a bottleneck, leading to reduced bandwidth, increased latency, and reduced compute power, resulting in significantly reduced performance.
Innovation Solution
Implement a distributed firewall system where each initiator is associated with a separate initiator firewall and each target is associated with a target firewall, routing transactions directly between them, and utilize a firewall remapper to provide a unified software view by remapping memory addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized firewall is used to monitor and control all transactions, then security control is improved, but system performance deteriorates due to bottleneck effects in large computer systems
Solution Approach 1:
The patent divides the centralized firewall into multiple distributed firewalls, with each initiator having its own firewall instance. This segmentation allows transactions to be processed locally at each initiator rather than funneling all transactions through a single centralized point, thereby maintaining security control while eliminating the bottleneck that degraded system performance in large computer systems.
Solution Approach 2:
The patent introduces a remapper as an intermediary component that mediates between the unified software address space view and the physically distributed firewall instances. The remapper translates unified addresses to physically distributed locations, enabling seamless access to distributed firewalls while preserving the simplified software interface and maintaining both security and performance.
2Reliability
If all transactions are routed through a centralized firewall, then security monitoring is improved, but latency increases and bandwidth is reduced
Solution Approach 1:
By segmenting the centralized firewall into distributed instances located at each initiator, the patent enables transactions to be processed locally without routing through a distant centralized point. This proximity-based segmentation significantly reduces transaction latency while maintaining comprehensive security monitoring through the distributed firewall network.
3Ease of operation
If a unified software view of firewalls is provided, then ease of operation is improved, but device complexity increases due to physical distribution
Solution Approach 1:
The remapper serves as an intermediary layer that hides the physical distribution complexity from users. It translates unified software addresses into physically distributed locations automatically, allowing users to interact with firewalls through a simple unified interface while the underlying physical distribution remains transparent. This mediator approach maintains ease of operation despite the complex distributed architecture.
Solution Approach 2:
The unified software address space provides a universal interface that works regardless of the physical distribution topology. Users access firewalls through a consistent, standardized address space that abstracts away the physical distribution details, making the system easy to operate while the multi-functional remapper handles the complexity of mapping to physical locations.
Data Source
AI summary
Various embodiments include techniques for processing transactions via a computer system interconnect with a distributed firewall. The distributed firewall includes separate firewalls for various initiators of transactions and separate firewalls for various targets of those transactions. As a result, transactions proceed, for example, along the shortest path from the initiator to the target, rather than being routed through a centralized firewall. In addition, firewall transactions, for example, may be remapped such that initiators address the initiator firewalls and target firewalls via a unified address space, without having to maintain separate base addresses for each initiator firewall and target firewall. As a result, application programs, for example, can execute transactions with increased performance on a computer system as compared to prior approaches.