Network Security Device Fastpath Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for packet inspection on accelerated platforms are non-standard, costly, and inefficient, particularly when dealing with encrypted payloads and multiple vendors, and they often bypass network stack inspection, limiting throughput and compatibility.
Innovation Solution
A network security device with a LAN and WAN interface capable of routing packets along a fast path that bypasses the network stack, using a virtual network interface for inspection and switching to a fast path after sufficient packet inspection, allowing for efficient packet routing and compliance with network policies without relying on vendor-specific APIs or proxies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packets are routed through the network stack for inspection, then packet inspection can be performed, but routing speed deteriorates
Solution Approach 1:
The patent segments packet handling into two paths: a fast path for routine packet forwarding that bypasses the network stack, and a slow path through the network stack for packets requiring inspection. This segmentation allows most packets to maintain high speed while enabling inspection capability when needed.
Solution Approach 2:
The patent introduces a Fastpath module as an intermediary that sits between the network interface and the network stack. This mediator captures packets before they enter the slow network stack path, enabling fast forwarding of uninspected packets while still allowing inspected packets to be processed by the packet inspector through controlled handoff.
2Speed
If Fastpath is used to accelerate packet routing, then routing speed improves, but packet inspection capability deteriorates
Solution Approach 1:
The patent implements dynamic path selection where packets can switch between fast path and slow path based on inspection needs. The system dynamically determines which packets require inspection and routes them appropriately, allowing the majority of packets to use the fast path while maintaining inspection capability for specific packets when security policies require it.
Solution Approach 2:
The Fastpath module acts as an intermediary that captures packets before they enter the slow network stack path, enabling fast forwarding of uninspected packets while still allowing inspected packets to be processed by the packet inspector through controlled handoff.
3Productivity
If vendor-specific APIs are used to control Fastpath, then Fastpath functionality is available, but device complexity and maintenance cost increase
Solution Approach 1:
The patent creates a universal Fastpath module that provides standardized packet capture and forwarding functionality independent of specific hardware vendors. This universal interface layer abstracts away vendor-specific APIs, allowing the same packet inspection logic to work across different network interface cards and hardware platforms without requiring vendor-specific implementations.
Solution Approach 2:
The patent implements a software-based Fastpath module that replicates the functionality of hardware Fastpath capabilities in a vendor-agnostic manner. By copying the essential packet capture and forwarding functions in software, the system avoids dependency on proprietary vendor APIs while maintaining the performance benefits of fast pathing.
4Measurement precision
If proxy servers are used for packet redirection, then packet inspection is possible, but throughput deteriorates
Solution Approach 1:
The patent extracts the packet inspection function from the main packet forwarding path by using Fastpath to capture packets at the network interface level. This extraction allows inspection to occur on a subset of packets without forcing all traffic through a proxy server, thereby maintaining high throughput for the majority of traffic while still enabling inspection where needed.
Solution Approach 2:
The Fastpath module acts as an intermediary that captures packets before they enter the slow network stack path, enabling fast forwarding of uninspected packets while still allowing inspected packets to be processed by the packet inspector through controlled handoff.
Data Source
AI summary
A network security device has a local area network (LAN) interface and a wide area network (WAN) interface, with a capability to route packets of a network connection along a fast path that bypasses a network stack of an operating system of the network security device. A packet of a network connection that is received at the LAN interface is routed to a virtual network interface. A packet inspector reads the packet from the virtual network interface, inspects the packet, and writes the packet back to the virtual network interface after inspection. The packet is routed from the virtual network interface to the WAN interface, and exits the WAN interface towards the destination network address of the packet. After inspecting one or more packets of the network connection, subsequently received packets of the network connection are routed along the fast path.