DTLS Connection Demux for Multi-Daemon Edge Controllers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently managing and synchronizing controller connections with multiple daemon instances in overlay networks, leading to unclear distribution of DTLS sessions and requiring software changes, which hinders scalability and compatibility.
Innovation Solution
Implementing a data plane development kit (DPDK) to demux packets based on packet hashes, using a TUNTAP interface to inject packets into the network kernel, and synchronizing state information between daemon instances to maintain a sham perception of a single DTLS connection without software changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If multiple daemon instances are used to handle controller connections, then the number of concurrent DTLS sessions can be increased, but the complexity of managing and synchronizing connections between controllers and daemon instances increases
Solution Approach 1:
The patent introduces a networking layer (DPDK) as an intermediary between edge devices and multiple daemon instances. This intermediary handles packet demultiplexing based on destination ports, abstracting away the complexity of connection management from the daemon instances. The networking layer acts as a mediator that distributes packets to appropriate daemon instances without requiring them to directly manage connection state synchronization.
Solution Approach 2:
The system segments the handling of DTLS sessions by introducing multiple daemon instances, each capable of handling a portion of the connections. The networking layer segments the packet flow by destination port, directing packets to specific daemon instances. This segmentation allows the system to scale the number of concurrent sessions by adding more daemon instances without requiring each instance to manage all connections.
2Productivity
If software changes are made to controllers and edge devices to support multiple daemon instances, then connection distribution can be improved, but compatibility with existing systems is compromised
Solution Approach 1:
The patent extracts the connection distribution logic from the controllers and edge devices and places it in the networking layer using DPDK. By taking out the demultiplexing functionality from the existing systems, the patent allows multiple daemon instances to be introduced without requiring changes to controllers or edge devices. The networking layer independently handles packet distribution based on destination ports, maintaining compatibility while improving connection distribution efficiency.
Solution Approach 2:
The networking layer serves as an intermediary that sits between existing controllers/edge devices and new daemon instances. This intermediary handles all the complexity of multi-instance communication, allowing existing systems to continue operating unchanged while benefiting from the improved connection distribution capabilities of multiple daemon instances.
3Ease of operation
If a single destination port is used for all controller connections, then edge devices can connect without configuration changes, but the system cannot efficiently distribute connections to multiple daemon instances
Solution Approach 1:
The networking layer performs self-service by automatically demultiplexing packets based on their destination ports. Instead of requiring edge devices to be configured with multiple ports or instance identifiers, the system allows them to use a single destination port, and the networking layer autonomously distributes packets to the appropriate daemon instances based on port hashing. This self-service approach maintains ease of operation while enabling efficient distribution.
Solution Approach 2:
The patent changes the parameter used for connection distribution from requiring multiple destination ports (which would complicate edge device configuration) to using hash-based distribution from a single destination port. By changing the distribution parameter from port number to hash of packet characteristics, the system maintains simple connectivity for edge devices while achieving efficient load distribution across multiple daemon instances.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of creating a connection between a controller and plurality of edge devices may include reading, by a data plane development kit (DPDK) of the controller, a plurality of packets having a common destination port from the plurality of edge devices, and demuxing, by the DPDK, a number of frames of the plurality of packets based on a hash of the plurality of packets, the hash altering the common destination port of the plurality of packets with a corresponding number of sham destination ports. The method may also include, with a TUNTAP interface, injecting the plurality of packets into a network kernel, and with the network kernel, delivering the plurality of packets to a respective one of a plurality of daemon instances.