Firewall Mobile Entity State Synchronization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Stateful firewalls face challenges in maintaining connection information when mobile entities move between networks, leading to dropped connections due to lack of synchronized state information across firewalls, especially in scenarios involving mobile IP users.

Innovation Solution

A method to synchronize high-level information about active mobile entities between firewalls, where accurate state information is fetched from the originating firewall when a mobile entity moves, using identifiers like IP addresses or subscriber numbers, and maintaining tables to track active mobile entities across firewalls to ensure seamless connection roaming.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If stateful firewalls maintain connection information locally without synchronization, then processing speed is improved, but connection reliability deteriorates when mobile entities move between firewalls

Engineering Contradiction:

Improveconnection processing speedVSAvoidconnection reliability

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The invention segments connection state information into two parts: high-level mobile entity information (synchronized between firewalls) and detailed connection state information (maintained locally). This segmentation allows fast local processing while ensuring reliability through synchronization of essential mobile entity identifiers across firewalls.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The invention performs preliminary synchronization of high-level mobile entity information between firewalls before actual connection state transfer is needed. This preliminary action ensures that when a mobile entity moves, the destination firewall already has the necessary identifiers to efficiently retrieve and continue connection state information.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If all connection state information is synchronized between firewalls, then connection reliability is improved, but information transfer volume increases

Engineering Contradiction:

Improveconnection reliabilityVSAvoidinformation transfer volume

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The invention extracts only the essential high-level mobile entity information (identifiers) from the complete connection state information and synchronizes only this extracted subset between firewalls. The detailed connection state information remains local, significantly reducing information transfer volume while maintaining sufficient reliability for connection roaming.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The invention applies partial synchronization by transferring only the necessary portion of connection information (high-level mobile entity identifiers) rather than complete connection state data. This partial action achieves the minimum required reliability for connection continuity while minimizing information transfer overhead.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If complete connection state information is transferred when mobile entities move, then connection continuity is improved, but processing time increases

Engineering Contradiction:

Improveconnection continuityVSAvoidconnection setup time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The invention performs preliminary synchronization of high-level mobile entity information between firewalls in advance, so when a mobile entity moves, the destination firewall already has the necessary identifiers cached. This preliminary action eliminates the need for time-consuming information retrieval during connection handoff, maintaining both continuity and speed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention segments information transfer into two stages: fast transfer of high-level mobile entity identifiers (pre-synchronized) and selective retrieval of detailed connection state information only when needed. This segmentation minimizes processing time by avoiding complete information transfer while ensuring connection continuity.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS8085752B2Handling connections moving between firewalls

Publication Date: 2011.12.27 FORCEPOINT LLC

AI summary

A method of handling mobile entities in a firewall, wherein a first mobile entity table comprising identifiers of mobile entities, which are active in a firewall, and a second mobile entity table comprising identifiers of mobile entities, which are active in a predefined set of other firewalls and identifiers of corresponding other firewalls, are maintained in the firewall. A new mobile entity, which is not currently active in the firewall, is detected, after which it is found on the basis of the second mobile entity table, if the new mobile entity is currently active in another firewall. If the mobile entity is currently active in another firewall, state information related to the new mobile entity is queried from the another firewall, and stored in the firewall to be used for processing data packets from/to the new mobile entity.