ECMP Load Balancing for Consistent TLS and DTLS Termination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In networked computing environments, VPN traffic termination is unpredictable due to software resources being moved between devices, leading to inefficiencies in routing TLS and DTLS sessions using ECMP routing, as there's no guarantee that traffic will land on the same computing device, necessitating inefficient edge router capabilities to associate sessions with the correct client node.
Innovation Solution
Implement load balancing techniques using ECMP routing and host-local Server Name Identification (SNI) by establishing communication sessions with computing resources, storing mapping data in a data store, and redirecting packets to the correct resource based on identifiers like SNI and 5-tuple identifiers, ensuring consistent termination of TLS and DTLS sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If ECMP routing is used to distribute VPN traffic across multiple computing devices, then load balancing and resource utilization are improved, but the reliability of session termination is worsened because there is no guarantee that traffic will land on the same computing device
Solution Approach 1:
The system performs preliminary actions by establishing session state tracking mechanisms before traffic routing issues problems. The load balancer proactively maintains session state information and establishes packet redirect rules in advance, so when ECMP routing distributes traffic to different computing devices, the system already has the necessary information to correctly redirect packets to the appropriate session endpoint, ensuring reliable session termination while maintaining load balancing benefits
2Adaptability or versatility
If software resources are moved between computing devices to satisfy current demands, then system adaptability and resource efficiency are improved, but session continuity is worsened because VPN traffic may not terminate on the same software unit
Solution Approach 1:
The system implements feedback mechanisms by continuously tracking session state information across computing devices. When software resources are moved between devices, the load balancer receives feedback about session state changes and dynamically updates packet redirect rules. This feedback loop ensures that even as resources are dynamically allocated and moved to satisfy demands, the system maintains awareness of session locations and can correctly route traffic to maintain session continuity
Solution Approach 2:
The load balancer acts as an intermediary between ECMP routing and session endpoints. It maintains session state information and establishes packet redirect rules that mediate between the distributed nature of ECMP routing and the need for consistent session termination. This intermediary layer allows software resources to be freely moved while the load balancer ensures traffic is correctly directed to the current location of session endpoints
3Reliability
If packet redirects are established to ensure correct session termination, then session reliability is improved, but network latency and complexity increase
Solution Approach 1:
The system performs preliminary actions by pre-establishing packet redirect rules based on session state information before traffic routing issues problems. The load balancer proactively configures redirect rules when sessions are established or when resource locations change, so that subsequent traffic can be correctly routed without real-time computation or additional lookup delays. This preliminary configuration minimizes network latency while ensuring reliable session termination
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Techniques for load balancing communication sessions in a networked computing environment are described herein. The techniques may include establishing a first communication session between a client device and a first computing resource of a networked computing environment. Additionally, the techniques may include storing, in a data store, data indicating that the first communication session is associated with the first computing resource. The techniques may further include receiving, at a second computing resource of the networked computing environment, traffic associated with a second communication session that was sent by the client device, and based at least in part on accessing the data stored in the data store, establishing a traffic redirect such that the traffic and additional traffic associated with the second communication session is sent from the second computing resource to the first computing resource.