IPSec Traffic Load Balancing via Inner-Flow Steering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network load balancers (NLBs) are inefficient and lack control in distributing secure network traffic, particularly for IPSec tunnels, leading to unequal load distribution, configuration scale issues, and inability to meet service-level agreements due to encrypted tunnel characteristics and lack of control over traffic direction.
Innovation Solution
Implementing a network load balancer with a network processing layer that terminates secure protocol sessions, allowing for deterministic load distribution based on inner flow characteristics and reducing the need to store tunnel configuration information on all nodes, while ensuring compliance with service-level agreements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional network load balancers distribute secure network traffic, then traffic distribution is achieved, but load distribution is unequal and control is lacking due to encrypted tunnel characteristics
Solution Approach 1:
The patent introduces a network processing layer as an intermediary between the load balancer and security processing nodes. This layer terminates secure protocol sessions and extracts inner flow characteristics, enabling the load balancer to make distribution decisions based on visible flow data rather than encrypted tunnel data. The intermediary translates encrypted tunnel traffic into readable flow characteristics that can be used for deterministic load balancing.
Solution Approach 2:
The patent changes the parameters used for load balancing from encrypted tunnel characteristics to inner flow characteristics such as source/destination IP addresses, ports, and protocols. By decrypting or inspecting the inner flow at the network processing layer, the system transforms the load balancing decision parameters from opaque tunnel metadata to visible flow attributes, enabling precise and balanced distribution.
2Reliability
If tunnel configuration information is stored on all nodes for load balancing, then traffic direction control is maintained, but memory overhead increases and scaling efficiency decreases
Solution Approach 1:
The patent extracts tunnel configuration information from all nodes and centralizes it in the network processing layer. The network processing layer terminates secure protocol sessions and maintains the necessary routing and flow state information. This extraction eliminates the need for each security processing node to store complete tunnel configuration data, significantly reducing memory overhead while maintaining traffic direction control through the centralized layer.
Solution Approach 2:
The patent introduces a new architectural dimension by adding the network processing layer between the load balancer and security processing nodes. This dimensional change allows tunnel configuration information to be stored in a centralized location rather than replicated across all nodes. The network processing layer handles the complexity of tunnel management, while security processing nodes focus on security functions, separating concerns and reducing overall system complexity.
3Reliability
If network traffic from a single branch exceeds security processing node capacity, then service-level agreements can be maintained, but traffic capacity limitations are encountered
Solution Approach 1:
The patent segments network traffic from a single branch into multiple smaller flows based on inner flow characteristics such as destination IP addresses or ports. The network processing layer divides the aggregated branch traffic into multiple independent flows that can be distributed to different security processing nodes. This segmentation allows the system to handle traffic volumes exceeding single-node capacity while maintaining service-level agreements through balanced distribution across multiple nodes.
Data Source
AI summary
Techniques for load balancing secure network traffic are disclosed. A system, process, and/or computer program product for load balancing secure network traffic includes monitoring network traffic for one branch of a plurality of branches for an enterprise network, and splitting the network traffic of the one branch into a plurality of network segments based on a determination that the network traffic exceeds traffic capacity of at least one security processing node (SPN) of a plurality of SPNs using a network load balancer (NLB) in communication with a plurality of Network Processing Nodes (NPNs), the plurality of monitored branches being distributed to the plurality of SPNs via a plurality of tunnels.