Firewall Cluster Connection Hash Table
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls distributed across multiple nodes in a cluster face challenges in managing connections due to limited knowledge sharing of connection information, such as user data and IP addresses, which hinders load balancing and node failure management.
Innovation Solution
Implementing a mechanism to share user passport information and connection data across nodes in a firewall cluster, allowing nodes to process the same connection and redistribute responsibilities, using methods like multicasting or sending data to a master node for distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall connections are distributed across multiple nodes in a cluster, then system reliability and throughput are improved, but connection information sharing between nodes is limited, hindering load balancing and failover management
Solution Approach 1:
The patent merges connection information from multiple firewall nodes into a shared data structure called a connection hash table. Each node contributes its known connections to this shared structure, enabling all nodes to access comprehensive connection information regardless of which node originally established the connection. This resolving the information silo problem while maintaining distributed architecture benefits.
Solution Approach 2:
The patent introduces a connection information sharing mechanism as an intermediary between distributed firewall nodes. This intermediary collects, consolidates, and distributes connection information to all nodes in the cluster, enabling seamless load balancing and failover without requiring direct peer-to-peer communication between nodes about connection states.
2Adaptability or versatility
If connection information is shared across all nodes in the firewall cluster, then load balancing and failover are enabled, but system complexity increases
Solution Approach 1:
The patent segments connection information into discrete, structured records within a connection hash table. Each connection is represented as an independent data entry with specific fields (source IP, destination IP, ports, protocol, etc.), allowing nodes to efficiently query and manipulate individual connection records without processing entire connection states. This segmentation reduces the complexity of information sharing while enabling sophisticated load balancing decisions.
3Productivity
If user passport information is shared across nodes, then user-based filtering and connection management are improved, but data transmission overhead increases
Solution Approach 1:
The patent performs preliminary consolidation of user passport information and connection data into the connection hash table before load balancing decisions are made. When a connection is established or user authentication occurs, the information is immediately recorded in the shared structure, making it instantly available to all nodes without requiring real-time data requests during connection processing. This eliminates repeated data transmission overhead while maintaining accurate user-based filtering.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A firewall cluster system comprises a first node operable to receive a connection in a firewall cluster having three or more nodes, determine user data associated with the connection, and share the user data with at least another node in the firewall cluster.