Network Flow Prediction for Security Device Scalability

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional security devices face scalability issues with increased data packets and struggle to effectively manage flow assignment and event statistics in distributed systems, leading to performance challenges in enforcing complex security policies.

Innovation Solution

A distributed processing system architecture with a packet processing manager that centralizes flow ownership assignment and maintains global flow ownership information, using a hardware component with a global flow table and software component to efficiently manage flow and session ownership across multiple packet processing cards, and implements a predict flow table and global event counters for effective event statistics tracking.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a centralized control scheme is used where one processor is designated as the management processor, then flow assignment can be managed, but the system does not scale to handle an increased number of data packets

Engineering Contradiction:

Improveflow assignment managementVSAvoiddata packet handling capacity

Core Design Contradiction:

Ease of operationVSProductivity

Solution Approach 1:

The system divides the centralized management processor into multiple distributed packet processing cards, each capable of autonomous flow assignment decisions. The global flow table is segmented and distributed across multiple cards, allowing parallel processing of data packets while maintaining consistent flow assignment state through the segmented architecture.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent transitions from a single-dimensional centralized control model to a multi-dimensional distributed architecture where flow assignment occurs across multiple spatial dimensions (different packet processing cards) and temporal dimensions (synchronized state updates). This dimensional expansion enables scalable handling of increased data packet volumes.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

2Productivity

If a distributed system architecture is used, then scalability is improved, but management of flow assignment becomes complex across independent computing resources

Engineering Contradiction:

Improvesystem scalabilityVSAvoidflow assignment management complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent implements homogeneous flow table structures across all packet processing cards, where each card maintains an identical copy of the global flow table. This homogeneity simplifies distributed flow assignment management by ensuring consistent state representation across all nodes, eliminating the need for complex synchronization protocols while maintaining scalability.

Inventive Principle:

Principle #33Homogeneity

Solution Approach 2:

Each packet processing card is equipped with autonomous capability to perform flow assignment decisions using its local copy of the global flow table, without requiring centralized coordination for each decision. This self-service approach reduces management complexity by distributing intelligence to individual nodes while maintaining system-wide consistency.

Inventive Principle:

Principle #25Self-service

3Reliability

If software messaging is used to synchronize event statistics across distributed computing resources, then event tracking is maintained, but performance and scalability are degraded

Engineering Contradiction:

Improveevent statistics consistencyVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent replaces the mechanical software messaging system with a hardware-based event counter aggregation mechanism. Dedicated hardware counters on each packet processing card independently track events, and aggregation is performed through hardware-efficient mechanisms rather than software messaging, eliminating the performance overhead while maintaining statistical consistency across the distributed system.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10050936B2Security device implementing network flow prediction

Publication Date: 2018.08.14 PALO ALTO NETWORKS INC

AI summary

A security device for processing network flows is described, including: one or more packet processors configured to receive incoming data packets associated with network flows where a packet processor is assigned as an owner of network flows and each packet processor processes data packets associated with flows for which it is the assigned owner; and a packet processing manager configured to assign ownership of network flows to the packet processors where the packet processing manager includes a global flow table containing global flow table entries mapping network flows to packet processor ownership assignments and a predict flow table containing predict flow entries mapping predicted network flows to packet processor ownership assignments. A predict flow entry includes a predict key and associated packet processor ownership assignment. The predict key includes multiple data fields identifying a predicted network flow where one or more of the data fields have a wildcard value.