Flow Ownership Assignment in Distributed Security Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security devices, especially those implemented as monolithic systems, face scalability issues in handling increased data packets and managing complex security policies across multiple computing resources, leading to inefficient event statistics management and policy enforcement in distributed systems.
Innovation Solution
A distributed processing system architecture with a packet processing manager that centralizes flow ownership assignment and maintains global flow ownership information, using hardware components to offload message processing and manage flow ownership across packet processors, ensuring that data packets belonging to the same flow or session are processed by the same packet processor, and implementing a predict flow table and global event counters for efficient event statistics tracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a centralized control scheme is used where one processor is designated as the management processor and processors cooperate through software messaging to determine flow ownership, then security policy enforcement can be implemented across multiple processors, but the system does not scale to handle increased numbers of data packets
Solution Approach 1:
The system segments the security device into multiple independent packet processing cards, each with its own processors that can autonomously handle data packets. This segmentation eliminates the centralized bottleneck by distributing packet processing across multiple independent units, allowing the system to scale with increased data packet loads while maintaining security policy enforcement capabilities.
Solution Approach 2:
The patent introduces a flow ownership assignment mechanism that acts as an intermediary between packet arrival and processing assignment. When a data packet arrives, the system uses flow ownership assignment to determine which processor should handle it, eliminating the need for processors to continuously communicate through software messaging and enabling more efficient parallel processing.
2Adaptability or versatility
If software messaging is used for processors to cooperate and determine flow ownership, then security policies can be enforced across distributed resources, but performance deteriorates and scalability is limited
Solution Approach 1:
The patent extracts the flow ownership determination logic from software-based inter-processor communication and implements it as a dedicated flow ownership assignment mechanism. This extraction removes the performance bottleneck caused by software messaging while preserving the ability to coordinate flow ownership across distributed processors, significantly improving processing performance.
Solution Approach 2:
The system replaces the software-based messaging mechanism with a more efficient flow ownership assignment approach that directly determines processor responsibility without requiring continuous software communication. This substitution reduces overhead and improves performance while maintaining distributed resource coordination capabilities.
3Loss of information
If software is used to send messages between computing resources to maintain synchronized event statistics, then event data can be tracked across distributed resources, but the solution has undesirable performance and does not scale well
Solution Approach 1:
The patent extracts event statistics maintenance from the software messaging layer and implements it as a dedicated hardware or firmware function within each packet processing card. Each card maintains local event statistics independently, eliminating the need for continuous software messaging for synchronization while ensuring accurate event tracking across distributed resources.
Solution Approach 2:
Each packet processing card autonomously maintains its own event statistics without requiring communication with other cards for synchronization. This self-service approach to event tracking eliminates performance bottlenecks associated with software messaging while ensuring that event data is accurately captured and maintained across all distributed computing resources.
Data Source
AI summary
A security device for processing network flows includes one or more packet processors configured to receive incoming data packets associated with one or more network flows where a packet processor is assigned as an owner of one or more network flows and each packet processor processes data packets associated with flows for which it is the assigned owner; and a packet processing manager configured to assign ownership of network flows to the one or more packet processors where the packet processing manager includes a global flow table containing entries mapping network flows to packet processor ownership assignments. The packet processing manager informs a packet processor of an ownership assignment after one or more packets are received, and the one or more packet processors learns of ownership assignments of network flows from the packet processing manager.