Elastic Security Service Provisioning for Dynamic Chain Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions struggle to efficiently apply security services to diverse customer traffic types, such as P2P, FTP, and multimedia sessions, while ensuring scalability, availability, and reducing latency in cloud-based environments, and they often require manual scaling and load balancing that is inefficient and prone to single points of failure.
Innovation Solution
A cloud access security broker (CASB) system that provides a dynamic service chain with horizontal scaling, customizable security policies, and failover mechanisms, utilizing a distributed load balancing system to manage traffic flows and synchronize state information across service instances, ensuring seamless recovery from failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual scaling and load balancing are used in existing security solutions, then deployment is straightforward, but scalability and availability are limited and single points of failure exist
Solution Approach 1:
The system segments security services into multiple independent service instances that can be distributed across different service nodes. Each instance handles specific traffic flows, eliminating single points of failure and enabling parallel processing of security checks across multiple nodes simultaneously.
Solution Approach 2:
A load balancer acts as an intermediary component that receives client requests and intelligently distributes them to appropriate service instances based on current system state, health status, and load conditions. This mediator enables seamless failover and load distribution without requiring changes to client or service instance configurations.
2Adaptability or versatility
If security services are applied to diverse customer traffic types, then security coverage is improved, but latency increases and processing efficiency decreases
Solution Approach 1:
The system dynamically adapts service chains based on traffic type, security policies, and real-time performance metrics. Different traffic types (P2P, FTP, multimedia) receive customized service chains with only the necessary security services, avoiding unnecessary processing steps and reducing latency while maintaining comprehensive security coverage.
Solution Approach 2:
Different service instances are optimized for specific traffic types with localized security service configurations. Each instance applies only the security services relevant to its designated traffic type, improving processing efficiency and reducing latency compared to a uniform security approach applied to all traffic.
3Productivity
If horizontal scaling is implemented in the CASB system, then scalability and load distribution are improved, but system complexity and state synchronization challenges increase
Solution Approach 1:
Service instances continuously exchange feedback information about their state, health, and performance metrics with the load balancer and each other. This feedback mechanism enables automatic load distribution, health monitoring, and failover decisions without centralized control, simplifying state synchronization across horizontally scaled instances.
Solution Approach 2:
Service instances are self-contained and autonomous, managing their own state and configuration. When new instances are added to the system, they automatically discover and integrate with the existing service chain without requiring manual configuration or complex state synchronization protocols, enabling easy horizontal scaling.
4Reliability
If failover mechanisms are added to improve recovery from failures, then reliability is improved, but system complexity and recovery time increase
Solution Approach 1:
Service instances maintain pre-configured backup relationships and state synchronization with potential failover targets before failures occur. When a service instance fails, the load balancer immediately redirects traffic to pre-identified backup instances that already have the necessary state information, enabling rapid failover without time-consuming state transfer or reconfiguration.
Data Source
AI summary
Disclosed is increasing available bandwidth for processing of packets by a security service in a dynamic service chain, monitoring available bandwidth of the security service, taking into account a number of instances of the security service currently running, detecting a traffic volume that has exceeded a configurable threshold, provisioning a new instance to increase the available bandwidth of the security service, putting the new instance into service including updating a constant hash table (CHT) used to implement distributed routing and load balancing and distributing the updated CHT to instances of an other service that is upstream in the dynamic service chain from the security service. The method can include assigning new streams to use the new instance.