Perimeter NAT Version Tagging for Load Balancer Flow Affinity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Maintaining data flow affinity across networks is challenging, especially in dynamic environments with version or state changes, as existing methods like connection tracking and hash-based routing face scalability issues and security concerns.
Innovation Solution
A connection tracking device encodes version information into packets, which is then used by a forwarding device to ensure affinity, reducing the need for extensive connection tracking at load balancers and preserving flow affinity through Network Address Translation (NAT) and load balancing operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If connection tracking is performed at load balancers to maintain flow affinity, then flow affinity is maintained, but processing and memory requirements at load balancers increase
Solution Approach 1:
The patent extracts the connection tracking function from the load balancer and relocates it to perimeter NAT devices. The perimeter NAT devices perform connection tracking and encode version identifiers in packets, while load balancers only need to read these identifiers to maintain flow affinity, significantly reducing processing and memory requirements at load balancers
Solution Approach 2:
The patent introduces version identifiers as an intermediary mechanism that carries connection state information through packets. These identifiers act as mediators that enable load balancers to maintain flow affinity without performing full connection tracking, as the version identifiers encapsulate the necessary state information
2Reliability
If version information is encoded into each packet, then flow affinity is maintained across version changes, but packet size increases
Solution Approach 1:
The patent applies local quality by encoding version identifiers in specific local fields within existing packet structures (such as destination port fields or custom headers) rather than adding separate version information fields. This approach maintains flow affinity while minimizing packet size increase by utilizing existing packet structure space efficiently
Solution Approach 2:
The patent makes existing packet fields multi-functional by using them to carry both their original information and version identifiers. For example, destination port fields are used to encode version information in addition to their traditional function, eliminating the need for separate version fields and avoiding packet size increase
3Reliability
If extensive connection tracking is performed at load balancers, then flow affinity is maintained, but scalability is reduced
Solution Approach 1:
The patent segments the connection tracking function from the load balancing function and distributes it to perimeter NAT devices. This segmentation allows load balancers to focus solely on forwarding decisions based on version identifiers, improving scalability while maintaining flow affinity through the distributed connection tracking architecture
Solution Approach 2:
The patent performs connection tracking and version identifier encoding in advance at perimeter NAT devices before packets reach load balancers. This preliminary action ensures that when packets arrive at load balancers, the version information is already encoded, eliminating the need for extensive real-time connection tracking and improving scalability
Data Source
AI summary
Various embodiments are directed to receiving, at a receiving device, a packet from a node in a first network. determining a version identifier for the packet, encoding the version identifier into the packet, and transmitting the packet containing the encoded version identifier to a load balancing device in a second network. The version identifier may be encoded into a destination port field of the packet. The receiving device may be a perimeter network address translation device. The packet is received at the load balancing device, where the version identifier is extracted and a hash of source address information is performed. The version and hash are used to select a back-end device in the second network. The packet is transmitted to the selected back-end device.