Edge DPI Offloading With Predictive Signature Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network elements (NEs) face limitations due to resource constraints, leading to inadequate support for pattern-matching rules and signatures, isolated intelligence, and increased network downtime during signature updates, while moving DPI services to the cloud introduces latency issues.
Innovation Solution
A cloud-based application assurance system that allows NEs to access a cloud-based module for rule/signature databases, updating local caches and distributing mappings to neighboring NEs based on user behavior, using machine learning to predict probable user paths and minimize latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If DPI services are moved to the cloud, then resource constraints of edge devices are relieved, but network latency increases
Solution Approach 1:
The patent segments the DPI service into two parts: a cloud-based signature database for storage and updates, and an edge-based inference engine for real-time packet inspection. This segmentation allows the resource-intensive signature database to reside in the cloud while keeping the time-critical inspection function at the edge, thereby resolving the contradiction between relieving edge device resource constraints and minimizing network latency.
2Reliability
If signature updates are performed on all network elements, then application intelligence is kept current, but network downtime increases
Solution Approach 1:
The patent extracts the signature database from individual network elements and consolidates it into a centralized cloud-based repository. This extraction allows updates to be performed once in the cloud rather than synchronizing across all network elements, thereby maintaining current application intelligence while minimizing network downtime during updates.
Solution Approach 2:
The system performs preliminary actions by pre-loading and caching signature data in the cloud before it is needed at the edge devices. This allows network elements to quickly retrieve updated signatures without experiencing downtime, as the updates are prepared in advance and pushed to edge devices on demand.
3Speed
If pattern-matching rules are stored locally on network elements, then inspection speed is maintained, but device memory requirements increase
Solution Approach 1:
The patent segments the storage function from the processing function. The cloud-based system stores the comprehensive signature database, while edge devices maintain only the minimal cache needed for immediate inspection operations. This segmentation allows packet inspection speed to be maintained at the edge while the bulk of the signature data resides in cloud storage, thereby resolving the contradiction between inspection speed and memory capacity requirements.
Data Source
AI summary
A cloud-based application assurance service system and method using Deep Packet Inspection (DPI) enables Network Elements (NE) to access the cloud-based application assurance service to search a rules/signature database, without impacting latency on network-firewall decisions. Additionally, the application assurance service system distributes the associated mapping of the NE cache's latest contents to neighboring NEs, where a given user might next access the network. The system can recognize applications associated with network traffic and apply firewall rules. Further, the system tracks applications and uses this data to update NE caches periodically, such that NE caches are more likely to store the relevant application signatures in advance. Moreover, a historical user usage matrix is generated to track application use per user, which is used to detect a highly probable user path and transfer mapping to an associated NE.