Firewall Cluster Application State Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls distributed across multiple computer systems in a cluster face limitations in managing connections due to knowledge of a connection being stored only in the system handling it, which hinders efficient load balancing and failover capabilities.
Innovation Solution
A mechanism for sharing application state data across nodes in a firewall cluster, allowing nodes to monitor packets, determine application state data, and redistribute connections based on shared information for load balancing and failover.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall connections are handled by individual nodes independently, then each node can process connections with full local knowledge, but load balancing and failover capabilities are limited
Solution Approach 1:
The patent merges connection state information across multiple firewall nodes by implementing a shared data structure (hash table) that stores application state data accessible by all nodes in the cluster. This allows any node to access connection state information originally created by another node, enabling seamless failover and load balancing while maintaining complete connection knowledge.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a shared memory structure (hash table) that acts as a mediator between firewall nodes. This intermediary stores and manages application state data, allowing nodes to retrieve connection information without direct peer-to-peer communication, thus enabling reliable failover and load balancing.
2Productivity
If connection state data is stored locally in each node, then processing is fast with no inter-node communication overhead, but load balancing and failover are hindered
Solution Approach 1:
The patent combines connection state data from all nodes into a single shared hash table structure that resides in the memory space of each node. This allows fast local access to connection state information while simultaneously enabling any node to handle any connection in the cluster, thus achieving both high processing speed and load balancing capability.
Solution Approach 2:
The shared hash table structure serves multiple functions: it acts as a local cache for fast connection state retrieval, a distributed database for cluster-wide connection information, and a coordination mechanism for load balancing and failover. This multi-functional design enables both fast processing and adaptability.
3Ease of manufacture
If firewall rules are applied at the socket/port level only, then filtering is simple and fast, but application-based filtering capabilities are limited
Solution Approach 1:
The patent performs preliminary action by capturing and storing application state data (including application identification, source/destination ports, and connection state) when a connection is first established. This pre-captured information is stored in the shared hash table, enabling application-based filtering rules to be applied quickly without requiring complex real-time analysis of traffic patterns.
Solution Approach 2:
The patent creates a copy of essential connection information (application state data) and stores it in a standardized format in the shared hash table. This copied data structure simplifies the implementation of application-based filtering by providing ready-to-use attributes that can be directly evaluated against filtering rules, rather than requiring complex packet analysis.
Data Source
AI summary
A firewall cluster system comprises a first node operable to receive a connection in a firewall cluster having three or more nodes, monitor packets of the received connection and determining application state data associated with the connection from the monitored packets in the first node, and share application state data with at least another node in the firewall cluster.