Isolated Virtual Network Flow Management With Cached Packet Rewriting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing network traffic in large-scale provider networks with virtualization-based services is complicated by the need for address translation, packet manipulation, and consistent routing of successive client requests, which ad-hoc solutions struggle to scale effectively.
Innovation Solution
A multi-tier network flow management service (FMS) that includes a packet transformation tier, flow state tracking tier, and rewriting decisions tier, utilizing caching and distributed nodes to apply consistent packet rewriting directives across virtual networks, supporting stateful anycast, multicast, and load balancing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ad-hoc solutions are used for packet transformation requirements, then flexibility in handling diverse packet manipulation needs is achieved, but scalability to large provider networks with hundreds of thousands of virtual machines is compromised
Solution Approach 1:
The system segments packet transformation operations into distinct functional tiers: a control plane that generates rewriting directives and a data plane that executes them. This segmentation allows the flexible directive generation to be separated from the high-volume packet processing, enabling scalability while maintaining adaptability.
Solution Approach 2:
The patent introduces an intermediary component (the control plane) that acts as a mediator between packet sources and the transformation execution. This intermediary generates and distributes rewriting directives to multiple data plane nodes, enabling coordinated packet manipulation across the network without requiring each node to independently handle complex transformation logic.
2Reliability
If address translation techniques are implemented to manage traffic in and out of isolated virtual networks, then network isolation and security are improved, but packet processing complexity increases
Solution Approach 1:
The patent extracts the complex address translation and packet manipulation logic from the data plane and relocates it to the control plane. This allows the data plane to focus on efficient packet forwarding while the control plane handles the complex rewriting directive generation, thereby maintaining security while reducing processing complexity at packet-handling nodes.
3Stability of the object's composition
If successive requests from a given client are directed to the same back-end server through packet header manipulation, then application consistency is improved, but routing control complexity increases
Solution Approach 1:
The system implements feedback mechanisms where the control plane monitors packet flows and adjusts rewriting directives to ensure consistent routing of successive requests from the same client to the same back-end server. This feedback-driven approach maintains application session consistency while centralizing routing control logic.
4Ease of operation
If packet processing requirements are handled at individual nodes independently, then decentralized control is maintained, but consistent packet rewriting across multiple virtual networks becomes difficult
Solution Approach 1:
The patent creates a universal control plane that generates rewriting directives applicable across multiple virtual networks and data plane nodes. This universal directive system ensures consistent packet rewriting behavior across the entire provider network while allowing individual nodes to operate independently according to the distributed directives.
Data Source
AI summary
A network address assigned to a virtual network interface of a packet transformation node of a flow management service is identified. A packet of a particular network flow associated with an application implemented at an isolated virtual network is sent to the network address. Using a rewrite directive generated at a rewriting decisions node of the service and cached at the packet transformation node, a transformed packet corresponding to a packet received at the packet transformation node is generated and transmitted to a destination.