Flow Manager Rule Conflict Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network flow policy enforcement systems face inefficiencies, complexities, and increased costs due to conflicts between multiple administrative domains in large-scale data center networks, leading to inefficient resource utilization, complicated management, and wasteful packet dropping.
Innovation Solution
A flow manager uses the 'ordered precedence and longest prefix rule cruncher' algorithm to detect and resolve rule conflicts by collapsing conflicting data traffic flow rules into a consistent set, prioritizing rules, and generating a unified rule set that can be enforced by network processors or flow enforcement devices, allowing for efficient integration of policies from different administrative scopes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple flow enforcement policies from multiple administrative scopes are implemented, then network resource management capability is improved, but system complexity and operational difficulty increase
Solution Approach 1:
The patent merges multiple flow enforcement policies from different administrative scopes into a unified policy representation. The system combines rules from multiple sources (VRF instances, global policies, route maps) into a single consolidated rule set that can be efficiently processed by flow enforcement devices, thereby maintaining multi-domain management capability while reducing system complexity.
Solution Approach 2:
The invention creates a universal policy representation framework that can handle multiple types of policies from different administrative domains through a common data structure and processing mechanism. This multi-functional approach allows the system to manage diverse policy sources uniformly, reducing the need for separate handling mechanisms for each policy type.
2Reliability
If flow enforcement policies are enforced at the server's edge, then security control is improved, but network resource utilization efficiency deteriorates
Solution Approach 1:
The system performs preliminary action by installing flow enforcement policies at the network edge (VRF instances) before traffic enters the core network. This allows security controls to be applied at the point of entry, preventing unwanted traffic from consuming network resources in the first place, thereby simultaneously achieving security control and resource efficiency.
Solution Approach 2:
The invention extracts and removes unwanted traffic at the network edge through flow enforcement policies. By taking out malicious or unnecessary packets before they enter the core network, the system protects network resources from being wasted on processing and forwarding such traffic, thus improving both security and resource utilization efficiency.
3Adaptability or versatility
If conflicting flow rules are created to handle multiple policies, then policy coverage is improved, but rule table space requirements increase exponentially
Solution Approach 1:
The patent merges conflicting flow rules by consolidating multiple policies into a unified rule set. Instead of creating separate rules for each policy combination, the system combines overlapping rules and eliminates redundancies, thereby maintaining comprehensive policy coverage while significantly reducing the total number of rules required in the table.
Solution Approach 2:
The invention converts the potential harm of rule conflicts into a benefit by using conflict resolution algorithms that identify and resolve overlapping rules. By treating conflicts as opportunities to optimize the rule set, the system reduces the overall rule count while maintaining or improving policy coverage, transforming a problematic situation into an optimization opportunity.
4Reliability
If existing conflict detection algorithms are used, then rule conflict detection capability is improved, but processing time increases significantly
Solution Approach 1:
The system performs preliminary action by pre-processing and organizing flow rules into a structured representation before conflict detection. By preparing the rule set in advance (grouping by destination prefix, organizing by administrative scope), the conflict detection algorithm can operate more efficiently, reducing processing time while maintaining comprehensive detection capability.
Solution Approach 2:
The patent segments the flow rule processing into distinct phases: rule collection, policy assignment, conflict detection, and rule generation. By segmenting the complex conflict detection task into manageable steps and using data structures optimized for each phase, the system achieves reliable conflict detection with reduced processing time compared to monolithic approaches.
Data Source
AI summary
A flow manager may receive prioritized packet flow rules from multiple prioritized network services where each flow rule may comprise a packet filter and a prioritized action list. The priority for the flow rules from each network service may be expressed as either longest prefix or ordered precedence. The flow manager may generate a unified rule set according to the received packet flow rules by identifying conflict between pairs of rules and resolving the identified conflicts according the priority relationship two rules of each pair. When resolving conflicts between rules, the flow manager may append the action list of one rule to the action list of another rule, and may also create a new rule by combining the packet filters and actions lists of the conflicting rules.