Hitless Rollback Mechanism for Network Appliance Firmware Upgrades

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Upgrading network appliances in data centers often results in packet loss and service disruptions due to interference with network traffic, and rolling back upgrades can further disrupt services, highlighting the need for a mechanism to maintain continuous service during firmware upgrades and rollbacks.

Innovation Solution

Implementing a hitless rollback mechanism that allows the network appliance to run both the old and new firmware in parallel, with the new firmware assuming responsibility for services only after successful transition, enabling seamless rollback without halting the system and minimizing service disruptions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the network appliance upgrades from first firmware to second firmware, then the network appliance can provide updated services, but packet loss and service disruptions occur during the upgrade process

Engineering Contradiction:

Improveservice continuityVSAvoidpacket loss

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The patent applies preliminary action by stopping communication to the first process before the upgrade begins, and by preparing the second firmware in advance. The configuration state of the first process is captured before the upgrade, and the second process is spawned in a consistent state based on this pre-captured configuration, preventing packet loss during the transition.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses an intermediary approach by introducing a second firmware instance that runs concurrently with the first firmware during the upgrade process. This second firmware acts as a mediator that can take over service provision without disrupting the existing first firmware, thereby preventing packet loss and service disruptions.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the upgrade process is rolled back to the first firmware, then the service disruption is mitigated, but communication via the network service port must be stopped again causing additional interference

Engineering Contradiction:

Improveservice availabilityVSAvoidservice interruption time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by capturing the configuration state of the first process before the upgrade begins. This pre-captured configuration allows the system to quickly restore the first process to its previous state during a rollback, without needing to stop communication again, thereby reducing service interruption time.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent maintains continuity of useful action by ensuring that communication via the network service port continues uninterrupted throughout the upgrade and rollback process. The first process remains active and capable of handling traffic, and the rollback simply switches the active firmware without requiring communication to be stopped again.

Inventive Principle:

Principle #20Continuity of useful action

3Reliability

If the network appliance runs both first firmware and second firmware concurrently, then seamless rollback is enabled, but device complexity increases

Engineering Contradiction:

Improverollback capabilityVSAvoidfirmware management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies segmentation by dividing the firmware into distinct, isolated instances - the first firmware and the second firmware run as separate processes with separate memory spaces. This segmentation allows each firmware to be managed independently, simplifying the overall management despite having multiple firmware versions concurrent.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent uses copying by creating a second process that is a copy of the first process but running under the second firmware. The configuration state of the first process is copied to initialize the second process, allowing the system to maintain both firmware versions with minimal additional complexity.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS11281453B1Methods and systems for a hitless rollback mechanism during software upgrade of a network appliance

Publication Date: 2022.03.22 PENSANDO SYSTEMS INC

AI summary

A network appliance running a first firmware may roll back to that first firmware in a hitless manner during an unsuccessful upgrade to a second firmware. Before the attempted upgrade, a first process in the first firmware is providing a service. The upgrade process is initiated to upgrade the network appliance from the first firmware to a second firmware. The upgrade process can include stopping communication via a data plane of the network appliance to the first process, and detecting an upgrade failure. The upgrade process is hitless because rolling back the upgrade process occurs without halting the first firmware. Rolling back the upgrade includes restoring communications via the data plane to the first process.