Logical Ring SPU IP Address Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed multi-SPU L2 switches face inefficiencies in IP address learning and aging due to excessive internal message traffic, as each SPU must consult others before deleting aged IP addresses, leading to network traffic bottlenecks.
Innovation Solution
Implementing a logical ring of security process units (SPUs) where a single SPU maintains ownership of an IP action entry, distributing it to others, and using install and delete messages to manage IP addresses, ensuring efficient management and reducing unnecessary message traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each SPU consults others before deleting aged IP addresses, then IP address management consistency is maintained, but internal message traffic increases
Solution Approach 1:
The patent segments the IP address management responsibility by designating a single owner SPU for each IP address entry. This owner SPU is responsible for deleting aged entries without consulting other SPUs, while non-owner SPUs simply forward delete messages without making decisions. This segmentation eliminates the need for widespread consultation while maintaining consistency.
Solution Approach 2:
The patent introduces an intermediary mechanism where the owner SPU acts as the intermediary for delete operations. When an SPU needs to delete an aged IP address, it sends a delete message to the owner SPU (identified via install message history), which then performs the deletion. This intermediary approach consolidates the decision-making process and reduces message traffic.
2Reliability
If multiple SPUs maintain IP action entries, then network security coverage is improved, but device complexity increases
Solution Approach 1:
The patent extracts the management complexity from the distributed system by identifying and designating a single owner SPU for each IP address entry. This owner SPU assumes full responsibility for the entry's lifecycle including deletion, while other SPUs adopt a simplified role of merely forwarding messages. This extraction of management responsibility reduces overall system complexity while maintaining distributed security coverage.
3Productivity
If IP address learning is distributed across all SPUs, then processing capacity is increased, but message traffic overhead increases
Solution Approach 1:
The patent applies local quality by differentiating the roles of owner and non-owner SPUs. Owner SPUs have full management capabilities for specific IP address entries, while non-owner SPUs have limited forwarding functions. This localized differentiation allows distributed processing capacity while minimizing message traffic overhead, as non-owner SPUs don't engage in unnecessary consultations.
Data Source
AI summary
A device includes a security process unit (SPU) associated with a logical ring of SPUs. The SPU receives a packet with an address associated with a malicious source, and creates, based on the packet, an entry in a data structure associated with the SPU. The entry includes information associated with the packet. The SPU provides an install message to a next SPU in the logical ring. The install message instructs the next SPU to create the entry in another data structure, and forward the install message to another SPU. The SPU receives the install message from a last SPU, and sets a state of the entry to active in the data structure based on receiving the install message from the last SPU. The SPU performs a particular action on another packet, associated with the malicious source, based on the setting the state of the entry to active.