IDP State Synchronization for High Availability Failover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High availability computer network environments face challenges in maintaining continuous operation due to failures in security devices, particularly intrusion detection and prevention (IDP) devices, which struggle with stateful switchover and failover processes, leading to disruptions in network traffic.
Innovation Solution
The implementation of a method where a primary IDP device synchronizes application-layer IDP state with a backup IDP device for packet flows, allowing seamless failover and switchover by sending minimal state update messages, using deterministic finite automata to detect malicious traffic, and anchoring protocol decoders for continued stateful inspection after a switchover or failover.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a backup IDP device is implemented for high availability, then network traffic continuity is improved during failures, but the complexity of state synchronization and failover management increases
Solution Approach 1:
The patent extracts only the essential state information (sequence numbers, transaction lengths, delimiters) needed for IDP continuity rather than synchronizing complete packet flow states. This selective extraction reduces synchronization complexity while maintaining failover capability.
Solution Approach 2:
The primary IDP device preliminarily prepares state information by tracking sequence numbers, transaction lengths, and delimiters during normal operation. This preliminary state tracking enables rapid failover without requiring complex real-time synchronization during failure events.
2Reliability
If complete packet flow replication is performed for failover, then IDP service continuity is improved, but resource consumption increases
Solution Approach 1:
The patent extracts only critical state parameters (sequence numbers, transaction boundaries) from complete packet flows for synchronization. This selective data extraction significantly reduces the volume of state information that must be transmitted and stored, lowering resource consumption while maintaining IDP service continuity.
Solution Approach 2:
The patent implements partial action by synchronizing only the essential state information needed for IDP continuity rather than replicating complete packet flows. This partial synchronization approach reduces resource consumption while providing sufficient state information for the backup device to resume inspection after failover.
3Measurement precision
If stateful inspection is maintained after failover, then security detection accuracy is improved, but the difficulty of state synchronization increases
Solution Approach 1:
The patent extracts specific state synchronization elements (sequence numbers, transaction lengths, delimiters) that are sufficient to maintain security detection accuracy after failover. This selective extraction avoids the complexity of synchronizing complete application-layer states while preserving the ability to perform accurate stateful inspection.
Solution Approach 2:
The backup IDP device creates a simplified copy of the essential state information from the primary device. This copy includes only the critical elements needed for continued stateful inspection (sequence numbers, transaction boundaries) rather than duplicating the entire state, reducing synchronization complexity while maintaining detection accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one example, a backup intrusion detection and prevention (IDP) device includes one or more network interfaces to receive a state update message from a primary IDP device, wherein the state update message indicates a network session being inspected by the primary IDP device and an identified application-layer protocol for the device, to receive an indication that the primary device has switched over or failed over to the backup device, and to receive a plurality of packets of the network session after receiving the indication, each of the plurality of packets comprising a respective payload including application-layer data, a protocol decoder to detect a beginning of a new transaction from the application-layer data of one of the plurality of packets, and a control unit to statefully process only the application-layer data of the network session that include and follow the beginning of the new transaction.