Distributed Inline Proxy for Seamless Workload Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized man-in-the-middle proxy solutions face scaling issues as the number of computing devices increases and encounter challenges during workload migration, leading to potential packet loss or redirection errors.
Innovation Solution
Implementing a distributed inline proxy on each host, where a hypervisor intercepts packets, extracts state information, and migrates it to a new host during workload migration, allowing seamless session continuation without reconfiguring the edge server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized proxy is used at the edge of the network, then security functions such as deep packet inspection and intrusion prevention can be provided, but scaling issues arise as the number of computing devices increases and the load on the proxy increases
Solution Approach 1:
The centralized proxy is segmented into multiple distributed inline proxies, with each proxy instance running on a separate host within the network. This segmentation distributes the processing load across multiple nodes, eliminating the bottleneck of a single centralized proxy while maintaining security functions. Each inline proxy handles traffic for workloads on its host independently, enabling horizontal scaling as computing devices are added to the network.
2Reliability
If a centralized proxy is used, then security inspection can be performed, but during workload migration traffic redirection causes packet loss or requires reconfiguration
Solution Approach 1:
The inline proxy is merged with the host infrastructure, with each host running its own proxy instance. During workload migration, the proxy state is migrated along with the workload to the new host, eliminating the need for separate traffic redirection. This integration ensures seamless session continuity because the proxy maintains local state and directly handles traffic on the host where the workload resides, avoiding complex redirection requirements.
3Productivity
If workloads are migrated from one host to another, then resource utilization can be optimized, but the centralized proxy requires flow changes and may lose packets in process
Solution Approach 1:
The proxy state, including session information and connection context, is extracted and migrated preliminarily along with the workload before the migration is complete. This preliminary action ensures that when the workload arrives at the new host, the inline proxy on that host already has the necessary state to immediately resume handling traffic without interruption. This prevents packet loss by ensuring the proxy is ready to receive and process packets from the moment the workload is relocated.
Data Source
AI summary
In some embodiments, a method instantiates a proxy that stores first state information for first workloads running on a first computing device. The first computing device receives a migrated workload from a second computing device and second state information for a session associated with the migrated workload. The second state information is generated by a proxy on the second computing device that processed one or more packets for the migrated workload on the second computing device. The method stories the second state information for the proxy on the first computing device and resumes the session associated with the migrated workload using the proxy on the first computing device.