Multi-Tenant Local Breakout Switching with Dynamic Load Balancing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices in multi-tenant environments face challenges in efficiently managing and balancing network traffic, particularly in determining appropriate destinations for encrypted traffic while adhering to tenant policies, which affects latency and resource utilization.
Innovation Solution
The network device employs a traffic proxy to decrypt packets using tenant-specific keys, evaluates traffic characteristics, and executes local breakout functions to forward traffic based on quality of service policies, thereby determining optimal processing locations within the network platform, and implements load balancing techniques to distribute workloads across available resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If network traffic is forwarded to remote cloud servers, then centralized processing capability is maintained, but latency increases and local resource utilization decreases
Solution Approach 1:
The patent applies preliminary action by pre-establishing security contexts and encryption keys in the network switch before encrypted traffic arrives. The switch proactively retrieves tenant secret keys and establishes decryption capabilities in advance, enabling immediate local breakout decisions without real-time key management overhead, thus reducing latency while maintaining security
Solution Approach 2:
The patent introduces a traffic proxy as an intermediary component that assists the network switch in evaluating encrypted traffic. The traffic proxy receives decrypted payload information from the switch, evaluates traffic characteristics against tenant policies, and provides guidance on local breakout decisions, thereby simplifying the switch's decision-making complexity while enabling intelligent traffic routing
2Productivity
If encrypted traffic is processed locally with local breakout, then latency is reduced, but the ability to evaluate traffic characteristics is limited without decryption
Solution Approach 1:
The patent applies the taking out principle by extracting only the necessary traffic characteristics from encrypted payloads for policy evaluation. Instead of fully decrypting and analyzing entire traffic flows, the system extracts key payload information (such as application identifiers, traffic type indicators) that are sufficient for making local breakout decisions, thereby maintaining productivity while minimizing information loss
Solution Approach 2:
The traffic proxy acts as an intermediary that receives partial decryption information from the network switch and performs policy evaluation. This intermediary role allows the system to process encrypted traffic efficiently by working with limited visible information rather than requiring full decryption, thus maintaining both productivity and appropriate information protection
3Difficulty of detecting and measuring
If network switch decrypts traffic using tenant keys, then traffic evaluation capability is improved, but security risks increase from key management
Solution Approach 1:
The patent applies segmentation by separating key management functions from traffic processing functions. The network switch maintains tenant secret keys in a secure key store and uses them only for selective decryption of traffic characteristics needed for policy evaluation. Full decryption and processing are handled by dedicated traffic proxies or endpoint devices, thereby improving traffic detection capability while distributing security risks across multiple isolated components
Solution Approach 2:
The traffic proxy serves as a secure intermediary that handles the sensitive operation of decrypting and evaluating traffic payloads. The network switch interacts with the proxy through secure interfaces, passing only necessary traffic metadata for evaluation. This intermediary architecture allows the switch to benefit from traffic visibility while maintaining security compliance by not permanently storing or improperly handling decryption keys
4Adaptability or versatility
If traffic is forwarded to centralized cloud services, then resource utilization is optimized, but local processing capability and responsiveness are reduced
Solution Approach 1:
The patent applies dynamics by implementing adaptive local breakout switching that dynamically adjusts traffic routing based on real-time conditions. The network switch continuously evaluates tenant policies, traffic characteristics, and network state to make flexible routing decisions between local and centralized processing options. This dynamic approach enables the system to adapt to changing conditions and optimize processing location flexibility while managing policy evaluation complexity through automated decision-making algorithms
Data Source
AI summary
Technologies for providing a multi-tenant local breakout switching and dynamic load balancing include a network device to receive network traffic that includes a packet associated with a tenant. Upon a determination that the packet is encrypted, a secret key associated with the tenant is retrieved. The network device decrypts a payload from the packet using the secret key. The payload is indicative of one or more characteristics associated with network traffic. The network device evaluates the characteristics and determines whether the network traffic is associated with a workload requesting compute from a service hosted by a network platform. If so, the network device forwards the network traffic to the service.