Multiprocessor Switch Authentication Throughput
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Web-based user authentication solutions are inefficient and ill-equipped to handle multiple users, particularly in multi-VLAN environments, as they typically rely on single-processor systems that handle both plaintext and encrypted traffic, leading to CPU usage inefficiencies and scalability issues.
Innovation Solution
A multiprocessor network switch architecture that separates cryptographic and non-cryptographic processing, using an associative store to forward packets to dedicated processors based on secure transport protocols, thereby optimizing traffic distribution and authentication throughput.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single-processor system is used to handle both plaintext and encrypted traffic, then device complexity is reduced, but cryptographic processing becomes a bottleneck and authentication throughput decreases
Solution Approach 1:
The patent divides the authentication system into multiple independent processor components: cryptographic processors dedicated to SSL/TLS operations, AAA processors for authentication logic, and forwarding processors for packet routing. This segmentation eliminates the bottleneck by distributing cryptographic processing across multiple specialized units rather than overloading a single general-purpose processor.
Solution Approach 2:
The patent extracts cryptographic processing functions from the general authentication flow and places them in dedicated cryptographic processors. This separation allows cryptographic operations to be handled independently and in parallel, removing them as a bottleneck to overall authentication throughput while maintaining system modularity.
2Ease of operation
If a single-processor system is used to handle authentication, then ease of operation is improved, but the system cannot scale to handle additional users in multi-VLAN environments
Solution Approach 1:
The patent designs processors with multiple functional capabilities: cryptographic processors can handle various SSL/TLS protocols and cipher suites, AAA processors can authenticate users across multiple VLANs and network segments, and forwarding processors can route traffic according to different policies. This multi-functionality allows the system to scale to accommodate additional users and complex multi-VLAN environments without requiring fundamentally different architecture.
Solution Approach 2:
The patent transitions from a single-dimension (single-processor) architecture to a multi-dimensional distributed architecture where authentication can occur simultaneously across multiple processors and network segments. This dimensional expansion enables the system to handle concurrent authentication requests from multiple VLANs and scale horizontally by adding more processor units.
3Device complexity
If the same processor handles both plaintext and encrypted traffic, then device complexity is minimized, but CPU usage efficiency decreases
Solution Approach 1:
The patent assigns specific processing qualities to dedicated processor units: cryptographic processors are optimized for encrypted traffic with specialized cryptographic instruction sets and hardware acceleration, while forwarding processors handle plaintext traffic with efficient packet routing algorithms. This local optimization ensures each processor type operates at peak efficiency for its designated function, improving overall CPU usage efficiency without requiring a complex heterogeneous processor system.
Data Source
AI summary
Web-based authentication includes receiving a packet in a network switch having at least one associative store configured to forward packet traffic to a first one or more processors of the switch that are dedicated to cryptographic processing if a destination port of the packet indicates a secure transport protocol, and to a second one or more processors of the switch that are not dedicated to cryptographic processing if the destination port does not indicate a secure transport protocol. If a source of the packet is an authenticated user, the packet is forwarded via an output port of the switch, based on the associative store. If the source is an unauthenticated user, the packet is forwarded to the first one or more processors if the destination port indicates a secure transport protocol, and to the second one or more processors if the destination port does not indicate a secure transport protocol.