Ingress Node Filter Update for Load Balanced Security Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ingress nodes in networks continue to consume resources processing and forwarding traffic from untrusted host devices, even after security nodes have determined the traffic should be blocked, leading to potential security risks and inefficient resource utilization.
Innovation Solution
An ingress node receives traffic from a host device, selects a security node using load balancing, forwards the traffic, and updates its ingress filter based on a message from the security node indicating that traffic from the host device should be blocked, thereby preventing further traffic from being processed and forwarded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the ingress node continues to forward traffic from host devices after security nodes block it, then load balancing functionality is maintained, but security risks increase and resource consumption increases
Solution Approach 1:
The security node sends a feedback message to the ingress node indicating that traffic from a specific host device should be blocked. The ingress node receives this feedback and updates its ingress filter accordingly, preventing further traffic from the untrusted host device from being processed and forwarded, thus resolving the contradiction between maintaining security and reducing resource consumption
Solution Approach 2:
The ingress node proactively updates its ingress filter before receiving additional traffic from the host device. By receiving the block instruction from the security node and immediately updating the filter, the system prevents harmful traffic from entering the network in the first place, rather than reacting after security breaches occur
2Productivity
If the ingress node processes and forwards traffic from host devices, then load balancing across security nodes is achieved, but unnecessary resource consumption occurs
Solution Approach 1:
The system extracts the traffic filtering function from the security nodes and places it at the ingress node through the updated ingress filter. This allows the ingress node to prevent untrusted traffic from reaching security nodes, thereby eliminating unnecessary resource consumption at security nodes while maintaining load balancing functionality for trusted traffic
Solution Approach 2:
The security node provides feedback to the ingress node about which host devices should be blocked. This feedback mechanism enables the ingress node to make intelligent filtering decisions, ensuring that only necessary traffic is forwarded to security nodes for processing, thus optimizing resource utilization while maintaining load balancing
Data Source
AI summary
In some implementations, an ingress node may receive first traffic from a host device. The ingress node may determine and based on an ingress filter of the ingress node, that traffic from the host device is allowed. The ingress node may select, using a load balancing functionality, and based on determining that traffic from the host device is allowed, a security node, of a plurality of security nodes, to which the ingress node is to forward the first traffic. The ingress node may forward the first traffic to the selected security node. The ingress node may receive, based on forwarding the first traffic, a message that indicates that traffic from the host device is to be blocked. The ingress node may update, using the message, the ingress filter of the ingress node to indicate that traffic from the host device is to be blocked.