Flow Table Entry Management for Express Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security systems, such as firewalls, face challenges in efficiently managing flow table entries for express packet processing, leading to latency, reduced throughput, and resource consumption due to overloading of the express processing device with entry management messages and occupancy by low priority flows.
Innovation Solution
Implementing a system where processors determine capacity and service indicators for flow tables, allowing selective storage of entries in an express flow table based on priority, reducing the need for entry management messages and conserving resources by prioritizing higher priority flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If flow-based packet processing is implemented in security systems, then packet processing efficiency is improved, but the express flow table becomes overloaded with low priority flows causing latency and reduced throughput
Solution Approach 1:
The patent applies local quality by differentiating treatment of flows based on their priority characteristics. High priority flows receive express processing with dedicated flow table entries, while low priority flows are handled through normal processing. This selective quality assignment resolves the contradiction by ensuring that time-critical high priority packets are processed quickly without being blocked by low priority traffic.
Solution Approach 2:
The patent segments the flow table management by separating high priority and low priority flow entries. The express flow table is selectively populated only with high priority flow entries, while low priority flows are excluded. This segmentation prevents the express processing path from being overloaded by non-critical traffic, thereby reducing latency for important packets while maintaining overall processing efficiency.
2Productivity
If express processing is implemented for all flows, then throughput is improved, but processor and memory resources are consumed due to managing excessive entry management messages
Solution Approach 1:
The patent extracts only the essential high priority flows from the complete set of flows and places them in the express flow table. By taking out only those flows that require express processing, the system achieves high throughput for critical traffic without the resource overhead of managing express entries for all flows. This selective extraction reduces the number of entry management messages and conserves processor and memory resources.
3Quantity of substance
If the flow table capacity is increased to accommodate more flows, then more flows can be processed, but the express flow table becomes overloaded with low priority flows reducing overall performance
Solution Approach 1:
The patent implements dynamic flow table management where the express flow table is selectively populated based on flow priority rather than being statically allocated. The system dynamically determines which flows qualify for express processing and adjusts the express flow table contents accordingly. This dynamic approach ensures that the express table maintains optimal size and composition, preventing overload while accommodating necessary high priority flows.
Data Source
AI summary
A device may receive a packet associated with a flow and may identify a capacity indicator associated with a flow table. The capacity indicator may indicate an available storage capacity associated with the flow table. The flow table may be stored by another device and may include entries for one or more flows and one or more corresponding actions to be taken in association with the one or more flows. The device may determine a service indicator that indicates a priority associated with the flow and may compare the capacity indicator and the service indicator. The device may selectively provide a message to the other device based on comparing the capacity indicator and the service indicator. The message may include an instruction for the other device to store an entry, associated with the flow, in the flow table.