Firewall Cluster Connection Hash Table

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Firewalls distributed across multiple nodes in a cluster face challenges in managing connections due to limited knowledge sharing of connection information, such as user data and IP addresses, which hinders load balancing and node failure management.

Innovation Solution

Implementing a mechanism to share user passport information and connection data across nodes in a firewall cluster, allowing nodes to process the same connection and redistribute responsibilities, using methods like multicasting or sending data to a master node for distribution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If firewall connections are distributed across multiple nodes in a cluster, then system reliability and throughput are improved, but connection information sharing between nodes is limited, hindering load balancing and failover management

Engineering Contradiction:
Improvefirewall cluster reliabilityVSAvoidconnection information sharing
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent merges connection information from multiple firewall nodes into a shared data structure called a connection hash table. Each node contributes its known connections to this shared structure, enabling all nodes to access comprehensive connection information regardless of which node originally established the connection. This resolving the information silo problem while maintaining distributed architecture benefits.

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The patent introduces a connection information sharing mechanism as an intermediary between distributed firewall nodes. This intermediary collects, consolidates, and distributes connection information to all nodes in the cluster, enabling seamless load balancing and failover without requiring direct peer-to-peer communication between nodes about connection states.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Adaptability or versatility

If connection information is shared across all nodes in the firewall cluster, then load balancing and failover are enabled, but system complexity increases

Engineering Contradiction:
Improveload balancing capabilityVSAvoidinformation sharing mechanism complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent segments connection information into discrete, structured records within a connection hash table. Each connection is represented as an independent data entry with specific fields (source IP, destination IP, ports, protocol, etc.), allowing nodes to efficiently query and manipulate individual connection records without processing entire connection states. This segmentation reduces the complexity of information sharing while enabling sophisticated load balancing decisions.

Inventive Principle:
Principle #1Segmentation

3Productivity

If user passport information is shared across nodes, then user-based filtering and connection management are improved, but data transmission overhead increases

Engineering Contradiction:
Improveconnection processing efficiencyVSAvoiddata transmission overhead
Core Design Contradiction:
ProductivityVSLoss of energy

Solution Approach 1:

The patent performs preliminary consolidation of user passport information and connection data into the connection hash table before load balancing decisions are made. When a connection is established or user authentication occurs, the information is immediately recorded in the shared structure, making it instantly available to all nodes without requiring real-time data requests during connection processing. This eliminates repeated data transmission overhead while maintaining accurate user-based filtering.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2991276B1Authentication sharing in a firewall cluster
Publication Date: 2022.04.06 MCAFEE LLC
  • EP2991276B1 patent drawingFigure 1
  • EP2991276B1 patent drawingFigure 2
  • EP2991276B1 patent drawingFigure 3

AI summary

A firewall cluster system comprises a first node operable to receive a connection in a firewall cluster having three or more nodes, determine user data associated with the connection, and share the user data with at least another node in the firewall cluster.