Gateway Router Offloading of Stateful Firewall Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewalls in cloud environments face inefficiencies in managing stateful sessions, leading to increased processing loads and potential bottlenecks, as they are designed to handle all traffic without differentiation based on session duration, size, or application type.
Innovation Solution
Offloading stateful sessions from virtual firewalls to gateway routers using Border Gateway Protocol (BGP) Flowspec, allowing the gateway router to perform firewall functions directly based on session criteria such as duration, size, application type, or time of day, thereby reducing the virtual firewall's load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the virtual firewall handles all traffic uniformly, then security coverage is comprehensive, but processing load increases and performance degrades
Solution Approach 1:
The patent segments traffic into different categories based on session characteristics (duration, size, application type) and applies different handling strategies to each segment. Stateful sessions are separated from stateless traffic, allowing the gateway router to handle stateful sessions directly while the virtual firewall focuses on stateless security functions, thereby reducing processing load while maintaining security coverage.
Solution Approach 2:
The patent applies local quality by treating different traffic types differently based on their specific characteristics. Instead of uniform processing, the system applies specialized handling to stateful sessions (offloaded to gateway router) versus stateless traffic (processed by virtual firewall), optimizing performance for each traffic type while maintaining overall security.
2Reliability
If the virtual firewall processes all stateful sessions, then security inspection is complete, but processing burden increases and throughput decreases
Solution Approach 1:
The patent extracts stateful session processing from the virtual firewall and transfers it to the gateway router. By taking out the stateful session handling function, the virtual firewall's processing burden is reduced, allowing it to focus on stateless security inspection while the gateway router handles the throughput-intensive stateful session processing locally.
Solution Approach 2:
The gateway router acts as an intermediary that receives stateful session information from the virtual firewall and processes it independently. This intermediary approach allows the virtual firewall to maintain security inspection capabilities while offloading the throughput burden to the gateway router, which has direct access to routing tables and can make forwarding decisions without constant virtual firewall intervention.
3Reliability
If the virtual firewall maintains all session states, then security control is precise, but resource consumption increases
Solution Approach 1:
The patent extracts stateful session state management from the virtual firewall and relocates it to the gateway router. The gateway router maintains session states locally using its routing tables and forwarding information base, eliminating the need for the virtual firewall to maintain all session states in memory, thereby reducing resource consumption while preserving security control capabilities.
Solution Approach 2:
The patent implements a copying mechanism where the virtual firewall copies relevant session information to the gateway router for local processing. Instead of the virtual firewall maintaining all session states itself, it copies the necessary state information to the gateway router, which then processes and forwards packets based on these copied states, reducing the virtual firewall's memory and processing resource requirements.
Data Source
AI summary
Aspects of the subject disclosure may include, for example, offloading one or more flows or stateful sessions from a firewall to a gateway router. The flows may be qualified for offloading using any criteria. The flows may be injected into the gateway router using border gateway protocol (BGP) Flowspec route over a BGP neighborship between the gateway router and the firewall. Other embodiments are disclosed.