Distributed Security Cluster for Network Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems in hosting systems are performance-intensive and introduce latency due to the reliance on a single security VM for network traffic checks, especially under heavy loads, and require separate security VMs for each host machine with identical security rules.
Innovation Solution
A distributed network security system with security agents operating alongside forwarding elements and security controllers that store and distribute security rules, offloading processing-intensive operations and using a sharding mechanism to assign rules to controllers based on hash values for efficient packet inspection and processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single security VM performs security checks on all network traffic, then security coverage is maintained, but network latency increases and performance degrades under heavy traffic loads
Solution Approach 1:
The patent segments the security check function by distributing security VMs across multiple host machines instead of concentrating all security checks on a single security VM. Each host machine has its own security VM that performs security checks locally, eliminating the bottleneck of centralized processing and reducing network latency while maintaining comprehensive security coverage.
2Productivity
If separate security VMs are deployed on each host machine, then processing capacity is distributed, but device complexity increases and resource consumption grows
Solution Approach 1:
The patent makes the security VM a universal component that can be deployed on any host machine regardless of its specific role or traffic characteristics. The security VM uses a unified architecture with standardized interfaces, allowing it to function across different host machines without requiring custom configurations or increasing overall system complexity, while still providing distributed processing capacity.
3Productivity
If multiple security VMs with identical security rules are deployed, then distributed processing is achieved, but resource waste increases due to redundant rule storage
Solution Approach 1:
The patent merges the security rules into a centralized database that is shared across all security VMs. Instead of each security VM storing and maintaining identical rule sets independently, all security VMs access a unified rule database, eliminating redundant rule storage while preserving distributed processing capabilities. This reduces resource consumption significantly while maintaining the benefits of distributed architecture.
Data Source
AI summary
Some embodiments of the invention provide a method for a first security controller that performs security operations on the packets that are transmitted within a network. The method of some embodiments receives a packet from a forwarding element in the network based on a decision made by a security agent that operates along with the forwarding element. When the first security controller stores a security rule for the packet, the method processes the packet according to the stored security rule. When the first security controller does not store a security rule for the packet, the method (i) determines that a second security controller stores a security rule for the packet based on a set of header values of the packet, and (ii) sends the packet to the second security controller for security processing according to the security rule for the packet stored on the second security controller.