Dynamic Placement of Inline Network Security Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face inefficiencies in placing network functions and security services across nodes, particularly in distributed firewall systems, leading to suboptimal protection and computational resource utilization.
Innovation Solution
A method for selecting optimal locations within a network to place security services and network functions using performance and network-function metrics, enabling serverless network functions to be provisioned directly on hardware components like DPUs, ASICs, and FPGAs, without containers or virtual machines, through a serverless API call.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If network functions are placed using traditional firewall systems, then security protection is provided, but computational resource utilization is suboptimal and system flexibility is limited
Solution Approach 1:
The patent implements dynamic placement of network functions by evaluating multiple metrics (performance, security, resource availability) and automatically selecting optimal locations for network functions in real-time. The system can dynamically migrate and reposition network functions based on changing network conditions, workload demands, and resource availability, transforming static firewall configurations into adaptive, dynamic security architectures that optimize resource utilization while maintaining security protection.
2Ease of manufacture
If network functions are deployed using containers or virtual machines, then virtualization benefits are achieved, but deployment complexity and resource overhead increase
Solution Approach 1:
The patent extracts the network function deployment process from traditional virtualization layers (containers, virtual machines, hypervisors) and implements direct placement on hardware devices. By removing unnecessary virtualization intermediaries, the system achieves simpler deployment through serverless architecture where network functions are instantiated directly on available hardware resources based on metric evaluation, eliminating the complexity of container management, VM provisioning, and hypervisor configuration while maintaining virtualization's flexibility benefits.
3Adaptability or versatility
If security services are placed at fixed network locations, then implementation is straightforward, but adaptability to changing network conditions is reduced
Solution Approach 1:
The patent implements feedback-driven placement by continuously monitoring network conditions, performance metrics, and resource availability, then using this feedback to automatically adjust network function placement decisions. The system evaluates multiple metrics in real-time and dynamically repositions network functions to optimize performance and adapt to changing conditions, transforming static security implementations into adaptive systems that automatically respond to network changes without requiring manual reconfiguration.
Data Source
AI summary
A system and method are provided for placing network functions among respective locations in a network. The locations at which the network functions are placed can be nodes and network devices within the network. These nodes can be selected, e.g., based on which network devices have available capacity and or specialized hardware (e.g., accelerator sin a data processing units (DPUs)) that is optimized for particular network functions. The network functions can include an inline network function that is provisioned directly in a data plane of one of the network devices (e.g., in-lined directly in a hardware offload device without a virtual machine and without a container). The decision of where to place the network functions can be based on a performance metric (e.g., representing available computational/memory resources at the network nodes) and/or a network-function metric (e.g., representing consumed computational/memory resources by the network functions) to improve system performance.