Gateway Firewall Service Segmentation for Scalable Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Combined gateway systems face challenges in managing firewall rules and scalability, leading to increased complexity and resource requirements as the number of users and gateways increases, resulting in performance losses and inefficient synchronization.
Innovation Solution
Implementing a separate firewall service with a distinct set of rules for each client and distributing firewall services across multiple processor cores, allowing for scalable and manageable network access while maintaining secure connections through network tunnels and stateful packet inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single gateway system manages firewall rules for all users, then network security is maintained, but device complexity and rule management difficulty increase with the number of users
Solution Approach 1:
The patent divides the gateway system into multiple independent gateway instances, each managing its own firewall rules and state lists. This segmentation allows the system to scale by adding more gateways without increasing the complexity burden on any single gateway, as each gateway only manages rules for its assigned users rather than all users globally.
2Reliability
If gateway information is constantly synchronized with redundant gateways for failover, then connection reliability is maintained, but bandwidth consumption increases exponentially with the number of gateways
Solution Approach 1:
The system segments the synchronization scope by having each gateway synchronize only its local state list and firewall rules with its specific redundant gateway partner, rather than all gateways synchronizing with each other. This reduces the total synchronization bandwidth from exponential growth to linear growth with the number of gateways.
Solution Approach 2:
Each gateway maintains a local copy of its state list and firewall rules, enabling failover without requiring continuous synchronization of all gateway information. The local copies allow rapid failover by simply switching to a different gateway instance that already has the necessary local state information.
3Reliability
If the state list is kept synchronized across all gateways, then failover is enabled, but processing power and memory space requirements increase linearly when scaling
Solution Approach 1:
The patent segments the state list management by having each gateway maintain its own local state list for its assigned users, rather than all gateways maintaining a synchronized copy of the entire state list. This segmentation reduces the memory and processing requirements at each gateway to a linear function of the number of users per gateway, rather than the total number of users across all gateways.
Data Source
AI summary
Systems and methods provide for scaling and management of a gateway. In one embodiment, a method includes: in response to a request from a client device, establishing, by a computer system implementing a gateway to a private network, a network tunnel between the client device and the gateway; and after establishing the network tunnel, starting a separate firewall service with a separate set of firewall rules on the computer system for selectively blocking and allowing network traffic between the client device and one or more network devices in the private network.