Distributed VPN Access Point Cluster Load Balancing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network clusters, the master network device often becomes a bottleneck due to its overload in performing functions such as authentication and encryption for each packet, leading to reduced packet throughput.
Innovation Solution
The system distributes the VPN functionality of the master network device among slave network devices by offloading tasks such as sequence number generation, encryption, and Integrity Check Value calculation in the upstream direction, and decryption and ICV verification in the downstream direction, reducing the workload on the master device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the master network device performs authentication and encryption functions on each packet, then security and VPN functionality are ensured, but the master device becomes overloaded and packet throughput decreases
Solution Approach 1:
The patent segments the VPN processing workload by dividing the cluster into one master network device and multiple slave network devices. The master device handles control plane functions and selective packet processing, while slave devices handle data plane functions including authentication and encryption for packets from their connected client devices. This segmentation distributes the processing load across multiple devices, preventing the master device from becoming a bottleneck while maintaining VPN security functionality.
2Reliability
If the master network device processes every packet, then complete control and security verification are achieved, but device complexity and processing overhead increase
Solution Approach 1:
The patent implements segmentation by assigning different processing responsibilities to master and slave network devices. Slave devices perform initial authentication and encryption verification on packets from their connected clients, reducing the burden on the master device. The master device focuses on control plane operations and handles packets requiring complex security verification. This segmentation maintains comprehensive security verification while reducing overall processing overhead.
Solution Approach 2:
The patent enables self-service by allowing slave network devices to autonomously perform authentication and encryption verification on packets from their connected client devices without requiring master device intervention for each packet. The slave devices maintain local security credentials and can independently verify packet authenticity and integrity, reducing the master device's processing overhead while maintaining security standards.
Data Source
AI summary
A system includes: multiple access points, the multiple access points including at least a first access point and a second access point; the system performs operations including: receiving, by the second access point from a client device, a data packet to be transmitted to a device outside of the system; forwarding the data packet by the second access point to the first access point; assigning, by the first access point, a first sequence number to the data packet to be used for transmitting the data packet outside of the system; transmitting the data packet with the first sequence number to the device outside of the system.