IIP Address Management in Multi-Core SSL VPN Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and assigning intranet internet protocol (IIP) addresses in multi-core systems for SSL VPN users is challenging, particularly in environments with multiple remote users and concurrent sessions, as existing systems struggle to efficiently track and utilize IIP addresses across cores, leading to communication issues between clients and servers.
Innovation Solution
A multi-core system designates a controller core to manage IIP addresses, with other cores requesting and receiving IIP addresses for SSL VPN sessions, enabling efficient allocation and communication across the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If each core manages its own IIP addresses independently, then each core can operate autonomously, but IIP address management becomes complex and inefficient across multiple cores
Solution Approach 1:
The patent introduces a master packet engine as an intermediary that centralizes IIP address management. When a slave packet engine needs an IIP address, it requests from the master packet engine, which allocates and tracks the address centrally. This mediator approach simplifies address management while maintaining multi-core operational autonomy.
Solution Approach 2:
The patent merges the IIP address management function across all packet engines into a single centralized management entity (the master packet engine). Instead of each core managing addresses independently, the master packet engine consolidates this function, reducing complexity while enabling efficient address allocation across the multi-core system.
2Ease of operation
If a single packet engine manages all IIP addresses centrally, then address management becomes simplified, but the packet engine becomes a bottleneck reducing system throughput
Solution Approach 1:
The master packet engine performs preliminary actions by pre-allocating and caching IIP address pools before slave packet engines need them. This allows slave packet engines to quickly obtain addresses from pre-prepared pools without blocking the master engine's main processing flow, thus maintaining high throughput while simplifying management.
Solution Approach 2:
The patent segments the IIP address management by creating multiple IIP pools that can be distributed among different slave packet engines. The master packet engine divides address pools and assigns them to slaves, allowing parallel address allocation without creating a single-point bottleneck, thus maintaining both simplified management and high throughput.
3Quantity of substance
If IIP addresses are allocated dynamically to each session, then address utilization becomes efficient, but tracking and managing addresses across concurrent sessions becomes challenging
Solution Approach 1:
The master packet engine implements feedback mechanisms by maintaining a central record of IIP address allocations to different sessions and users. When slave packet engines allocate addresses from pools, they report back to the master, which updates its tracking information. This feedback loop enables efficient address utilization while maintaining accurate session address tracking across concurrent users.
Solution Approach 2:
The patent uses copying by creating and maintaining copies of IIP address pool information across the master packet engine and slave packet engines. Each slave receives a copy of its assigned pool and can operate independently while the master maintains the master copy for tracking and reallocation. This copying approach enables efficient utilization while preserving tracking information.
Data Source
AI summary
In a multi-core system, multiple packet engines across corresponding cores may be working concurrently processing data packets from data flows of SSL VPN sessions. For example, a first core may establish a SSL VPN session with a client. Any one of the other cores, such as a second core, may received packets related to the session owned by the first core. Embodiments of the systems and method described below provide management of IIP addresses for the multi-core/multi-packet engine approach to providing SSL VPN service. In some embodiments, the approach to managing IIP addresses is to have one packet engine on a core act as a master or controller of the IIPs for the remaining packet engines and cores. The packet engines/cores use a protocol for communications regarding IIP management.