Dynamic Flow Ownership in Security Device Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed security device clusters, the existing methods for assigning and managing flow ownership lead to inefficient network resource utilization due to excessive packet redirection, especially in asymmetric traffic scenarios, resulting in suboptimal performance and increased costs.
Innovation Solution
A mechanism is introduced to dynamically assign and transfer flow ownership within a security device cluster, where the security device receiving the TCP SYN-ACK segment assumes ownership, reducing unnecessary packet forwarding and optimizing network resource utilization by selecting the most suitable device for processing based on traffic patterns and topology changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the first security device that receives a segment of a flow asserts ownership over the flow, then flow ownership is easily assigned, but excessive packet redirection occurs in asymmetric traffic scenarios leading to inefficient network resource utilization
Solution Approach 1:
The patent implements dynamic flow ownership assignment where the security device receiving the TCP SYN-ACK segment (rather than the first segment) becomes the flow owner. This dynamic approach adapts to asymmetric traffic patterns by allowing the device that will handle the majority of traffic (the SYN-ACK receiver in asymmetric scenarios) to claim ownership, thereby minimizing subsequent packet redirection and optimizing network resource utilization.
2Reliability
If security devices in a cluster process all packets for stateful connections, then connection security is maintained, but network bandwidth is wasted due to unnecessary packet forwarding between devices
Solution Approach 1:
The patent applies local quality by assigning specific flows to specific security devices based on which device receives the SYN-ACK segment. Once assigned, only that designated security device processes packets for that particular flow, while other devices in the cluster ignore packets from that flow. This localized processing approach maintains stateful connection security through proper ownership tracking while eliminating unnecessary packet forwarding and conserving network bandwidth.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A method operable in a security device cluster (500) having a plurality of security devices (110,112,114) each configured to receive respective data flows. The method includes receiving a first segment of a flow at a first security device (114) of the plurality of security devices (110,112,114) , sending the first segment of the flow toward a destination node (170) without the first security device (114) of the plurality of security devices (110,112,114) asserting ownership over the flow, receiving, from the destination node (170), a second segment of the flow at a second security device (110) of the plurality of security devices (110,112,114), the second segment of the flow being responsive to the first segment, asserting, by the second security device (110) of the plurality of security devices (110,112,114), ownership over the flow, and forwarding, from the first security device (114), packets of the flow subsequently received by the first security device (114) to the second security device (110).