Distributed WAN Compression for Encrypted Traffic Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current WAN acceleration solutions are incompatible with end-to-end data integrity protocols like IPsec and SMB signing, leading to security vulnerabilities and inefficiencies in WAN bandwidth utilization, which compromises user experience and increases costs.
Innovation Solution
Distributing WAN compression between endpoints and a WAN compression server, using dictionary-based techniques to compress and decompress traffic before encryption, maintaining end-to-end security with IPsec while optimizing bandwidth without additional intermediate devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If WAN acceleration solutions are implemented to maximize WAN utilization, then bandwidth efficiency is improved, but compatibility with end-to-end data integrity protocols like IPsec is lost
Solution Approach 1:
The system segments the WAN optimization function into distributed endpoint components that operate independently on each device. Each endpoint maintains local compression dictionaries and performs compression locally, eliminating the need for centralized interception devices that would break end-to-end encryption. This segmentation allows both WAN acceleration and IPsec compatibility to coexist.
Solution Approach 2:
Endpoints perform self-service by maintaining local compression dictionaries and executing compression algorithms independently without requiring external optimization devices. The endpoints autonomously manage their own compression state and dictionary caching, enabling WAN optimization while preserving the integrity of end-to-end encrypted communication channels.
2Reliability
If SSL encryption with private keys in intermediate devices is used to provide end-to-end security, then security is improved, but vulnerability to man in the middle attacks increases
Solution Approach 1:
The solution extracts the compression functionality from intermediate devices and places it directly at the endpoints. By removing the intermediate optimization device from the communication path, the system eliminates the security vulnerability associated with private key storage in intermediate devices while maintaining compression capabilities through endpoint-based dictionary caching and local compression execution.
3Speed
If additional WAN bandwidth is added to improve performance, then user experience is improved, but cost increases disproportionately
Solution Approach 1:
The system changes the parameter of data representation by applying compression algorithms that reduce the size of transmitted data. By transforming data into a more compact form using dictionary-based compression at endpoints, the system effectively increases throughput and improves user experience without requiring additional physical bandwidth infrastructure, thereby avoiding disproportionate cost increases.
Data Source
AI summary
Optimization of encrypted traffic flowing over a WAN is provided by an arrangement in which WAN compression is distributed between endpoints (i.e., client machines or servers) in a subnet of a hub and branch network and a WAN compression server in the subnet. A client portion of the WAN compression running on each of one or more endpoints interfaces with a disposable local cache of data seen by endpoints in the subnet that is used for compressing and decompressing traffic using dictionary-based compression techniques. The local WAN compression server in a subnet stores a shared central database of all the WAN traffic in the subnet which is used to populate local disposable caches in the endpoints.