Microservice TCP Reassembly via Window Specification Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face performance bottlenecks due to the need for multiple virtual tunnels for load balancing and TCP reassembly, which complicates configuration and increases processing time, especially when handling high-throughput data streams.
Innovation Solution
A protocol-defined window specification is used to load balance TCP traffic among multiple TCP reassembly microservices, allowing for scalable and efficient processing of encrypted data streams without the need for virtual tunnels, by utilizing an interface microservice that receives window specification feedback to distribute packets effectively across available reassembly microservices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple virtual tunnels are used for load balancing and TCP reassembly, then traffic distribution is achieved, but configuration complexity increases and processing time increases
Solution Approach 1:
The patent extracts the load balancing and TCP reassembly functions from the traditional virtual tunnel architecture and implements them directly in the security microservice. This eliminates the need for complex virtual tunnel configurations while maintaining the ability to distribute and reassemble TCP traffic efficiently across multiple service instances.
Solution Approach 2:
The patent introduces an intermediary component that receives window specification feedback and uses it to dynamically select appropriate microservice instances for processing packets. This intermediary mechanism enables load balancing without requiring virtual tunnels, simplifying the overall system configuration.
2Productivity
If multiple virtual tunnels are used for load balancing and TCP reassembly, then traffic distribution is achieved, but processing throughput decreases
Solution Approach 1:
The patent segments the security processing function into multiple independent microservice instances, each capable of handling TCP reassembly and security processing. This segmentation allows parallel processing of different data streams, increasing overall throughput and reducing processing time compared to sequential handling through virtual tunnels.
Solution Approach 2:
The patent performs preliminary actions by pre-establishing multiple ready-to-process microservice instances with pre-configured capabilities. When packets arrive, the system can immediately distribute them to available instances without the overhead of tunnel establishment and teardown, thereby reducing processing latency and increasing throughput.
3Productivity
If traditional encryption processing is used, then security is provided, but processing bottlenecks occur at high throughput
Solution Approach 1:
The patent implements dynamic load distribution across multiple microservice instances based on real-time conditions such as current load and window specifications. This dynamic approach allows the system to scale processing capacity according to demand, maintaining reliable security processing even at high throughput levels by distributing the encryption/decryption workload across multiple parallel instances.
Data Source
AI summary
Systems and methods are described herein generally relating to network security, and in particular, embodiments described generally relate to systems and methods for selecting microservices to process protocol data streams. For example, a method is disclosed, which calls for receiving a protocol packet, the protocol packet comprising a sequence number, generating a difference by subtracting a protocol message base from the sequence number, generating a first quotient by dividing the difference by a protocol common message length, generating a second value using the first quotient, determining a Transmission Control Protocol (TCP) reassembly resource using the generated second value, and transmitting the protocol packet to the determined TCP reassembly resource.