Dynamic Network Function Placement for Distributed Security Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems lack efficient methods for placing network functions and security services among the nodes of a network, particularly in distributed firewall systems, which can lead to suboptimal protection and computational resource inefficiencies.
Innovation Solution
A method for selecting optimal locations within a network to place security services and network functions using performance and network-function metrics, enabling serverless network functions to be provisioned directly on hardware components like DPUs, ASICs, or FPGAs through a serverless API call, optimizing computational resource utilization and threat mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network functions are placed using traditional methods, then security services can be provided, but computational resource utilization is inefficient and placement is suboptimal
Solution Approach 1:
The patent implements dynamic placement of network functions by continuously monitoring network conditions, computational resource availability, and security threat profiles. The system automatically adjusts the placement of security services based on real-time data, transitioning from static to dynamic resource allocation to optimize both efficiency and adaptability
Solution Approach 2:
The system changes placement parameters based on multiple metrics including computational resource availability, network traffic patterns, and security threat severity. By adjusting these parameters dynamically, the system achieves optimal resource utilization while maintaining the ability to adapt to changing network conditions
2Reliability
If more security services are deployed to enhance protection, then threat mitigation improves, but system complexity increases
Solution Approach 1:
The system automatically selects and places security services based on predefined metrics and algorithms. The placement decisions are made autonomously by analyzing network conditions and threat profiles, eliminating the need for manual configuration and reducing operational complexity while maintaining effective security protection
Solution Approach 2:
The patent implements feedback mechanisms that continuously monitor the effectiveness of deployed security services and adjust placements accordingly. By using performance data and threat intelligence as feedback, the system optimizes security protection while managing complexity through automated adjustments
3Ease of operation
If security services are placed at fixed locations, then deployment is simple, but network flexibility and adaptability are reduced
Solution Approach 1:
The system pre-establishes multiple potential placement locations for security services and pre-evaluates them based on computational resource availability and network conditions. When deployment is needed, the system selects from pre-identified optimal locations, maintaining ease of operation while enabling flexible, adaptive placement decisions
Data Source
AI summary
A system and method are provided for placing network functions among respective locations in a network. The locations at which the network functions are placed can be nodes and network devices within the network. These nodes can be selected, e.g., based on which network devices have available capacity and or specialized hardware (e.g., accelerator sin a data processing units (DPUs)) that is optimized for particular network functions. The network functions can include an inline network function that is provisioned directly in a data plane of one of the network devices (e.g., in-lined directly in a hardware offload device without a virtual machine and without a container). The decision of where to place the network functions can be based on a performance metric (e.g., representing available computational/memory resources at the network nodes) and/or a network-function metric (e.g., representing consumed computational/memory resources by the network functions) to improve system performance.