Cloud-Native Application Routing for Control/Data Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure access solutions and cloud-native applications mix control-plane and data-plane traffic, which is less desirable in cloud-native architectures, necessitating separate scaling of these components.
Innovation Solution
Utilize computer-networking protocol extensions like SNI and ECH to segregate control-plane and data-plane traffic by routing them to separate nodes using proxy servers or load balancers, allowing for independent scaling and fast-pathing of packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If control-plane and data-plane traffic are mixed and routed to the same destination, then the architecture is simpler and easier to implement, but the ability to scale components separately is lost and performance is reduced
Solution Approach 1:
The patent segments traffic into control-plane traffic and data-plane traffic, routing them through different paths and to different destinations. Control-plane traffic is routed to control-plane nodes while data-plane traffic is routed to data-plane nodes, enabling independent scaling of each component type without increasing overall architectural complexity
Solution Approach 2:
The patent introduces protocol extensions as intermediaries that carry routing information within existing packets. These extensions enable the routing infrastructure to distinguish between control-plane and data-plane traffic without requiring fundamental changes to the networking stack, thus maintaining simplicity while enabling separation
2Device complexity
If control-plane and data-plane traffic are mixed and routed to the same destination, then routing configuration is simpler, but performance and efficiency are reduced
Solution Approach 1:
The routing configuration is segmented into control-plane routing rules and data-plane routing rules. The system maintains separate routing tables or policy sets for each traffic type, allowing optimized paths for each while keeping configuration manageable through structured policies
Solution Approach 2:
The patent modifies existing packet parameters by adding protocol extensions that encode traffic type information. This allows the routing infrastructure to differentiate traffic types using existing packet inspection mechanisms, avoiding complex configuration while enabling performance optimization
3Adaptability or versatility
If separate routing paths are established for control-plane and data-plane traffic, then component scaling flexibility is improved, but routing infrastructure complexity increases
Solution Approach 1:
The patent makes the routing infrastructure universal by using a single routing decision mechanism that handles both control-plane and data-plane traffic. The same routing tables and policy enforcement points process both traffic types, differentiated only by the protocol extension markers, thus providing scaling flexibility without proportionally increasing infrastructure complexity
Solution Approach 2:
Protocol extensions serve as intermediaries that encode routing intent within standard packet formats. This allows the routing infrastructure to handle separate paths for control and data plane traffic using existing routing mechanisms, avoiding the need for entirely separate routing systems
Data Source
AI summary
Techniques for using computer networking protocol extensions to route control-plane traffic and data-plane traffic associated with a common application are described herein. For instance, a traffic flow associated with an application may be established such that control-plane traffic is sent to a control-plane node associated with the application and data-plane traffic is sent to a data-plane node associated with the application. When a client device sends an authentication request to connect to the application, the control-plane node may send an indication of a hostname to be used by the client device to send data-plane traffic to the data-node. As such, when a packet including the hostname corresponding with the data-plane node is received, the packet may be forwarded to the data-plane node.