Virtual Firewall Packet Flow Segmentation for Control Traffic Priority
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In ultra-high throughput computing environments, race conditions and hot spots in packet processing lead to processor overload, causing network interface card resets, delays in critical control packets, and disruptions in services, particularly in virtualized firewalls lacking physical ASIC support.
Innovation Solution
A virtual firewall system divides packet traffic into fast and slow paths, allocating dedicated resources and vCPUs to each path, ensuring timely processing of critical control packets while tolerating some data packet drops, using multi-stage parallel data plane development kit processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If packets are processed using receiver side scaling (RSS) with hashing traffic, then packet distribution across processors is improved, but hot spots and processor overload occur causing race conditions
Solution Approach 1:
The patent segments packet processing into two distinct paths: fast path for session-matched packets and slow path for packets requiring firewall stack processing. This segmentation prevents hot spots by distributing different packet types to different processing paths, eliminating the race conditions that occur when all packets compete for the same processor resources.
Solution Approach 2:
The patent applies local quality by assigning different processing qualities to different packet paths. The fast path receives prioritized processing with dedicated resources for time-sensitive control packets, while the slow path handles regular data packets with standard processing. This ensures critical packets get the quality of service they need without overwhelming the system.
2Reliability
If dedicated security processor and content processor are used for IPsec and IPS operations, then security processing capability is improved, but processor overhead increases in virtualized environments
Solution Approach 1:
The patent creates a virtual copy of the network security appliance functionality within the virtual machine environment. Instead of requiring physical dedicated security processors, the virtual firewall implements security processing functions (IPsec, IPS) as software components that run on standard virtualized processors, eliminating the need for complex hardware management in virtualized environments while maintaining security capabilities.
3Productivity
If receive queue (RXQ) is shared for all packets, then queue utilization is improved, but critical control packets are dropped when data traffic overflows
Solution Approach 1:
The patent segments the receive queue into separate queues for fast path packets and slow path packets. The fast path queue is dedicated to time-sensitive control packets and is protected from overflow by data traffic. The slow path queue handles regular data packets. This segmentation ensures that even when the system is under heavy load, critical control packets in the fast path queue are not dropped due to overflow of the shared queue.
4Measurement precision
If all packets are processed through the firewall software stack, then processing accuracy is improved, but processing latency increases and system throughput decreases
Solution Approach 1:
The patent implements preliminary action by pre-establishing session information in the session table before packets arrive. When packets arrive, the fast path can immediately match them against the pre-computed session information without requiring full firewall stack processing. This preliminary preparation allows the system to achieve high-speed processing for established connections while maintaining the accuracy of full processing when needed for new sessions or suspicious traffic.
Data Source
AI summary
Packet traffic flow control includes receiving a packet, by a first virtual machine network security appliance (VMNSA), and determining whether the packet is to be processed by a first path or a second path; in response to determining that the packet is to be processed by the first path, processing the packet by a first traffic flow controller (TFC) of the VMNSA, forwarding the packet by the first TFC to a first transmitter, and sending the packet by the first transmitter; and in response to determining that the packet is to be processed by the second path, processing the packet by the first TFC, forwarding the packet by the first TFC to a second TFC of the VMNSA, processing the packet by the second TFC, forwarding the packet by the second TFC to a second transmitter, and sending the packet by the second transmitter.