Network Service Header Relay for Authentication Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for authenticating clients in service function chains at the service topology layer of a network, particularly in Layer 2 and Layer 3 services, are inefficient as they require each service node to individually query an authentication server for each packet, leading to increased processing time and throughput delays, especially when multiple packets from the same client arrive in close temporal proximity.
Innovation Solution
Implementing a system where a service function classifier authenticates clients and adds relevant information, such as a cookie TLV value, to the Network Service Headers (NSH) of packets, allowing downstream service nodes to verify client authentication without needing to query an authentication server for each packet, thereby reducing redundant authentication queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each service node individually queries an authentication server for each packet, then authentication reliability is maintained, but processing time increases and throughput decreases
Solution Approach 1:
The service function classifier performs preliminary authentication of clients and stores authentication information (such as cookie TLV values) in the Network Service Header before packets reach downstream service nodes. This preliminary action eliminates the need for each service node to query the authentication server individually, thereby maintaining authentication reliability while significantly improving processing throughput.
Solution Approach 2:
The Network Service Header acts as an intermediary carrier that transports authentication information from the service function classifier to downstream service nodes. By embedding authentication data (cookie TLV values) in the NSH, the system enables service nodes to verify client authentication locally without repeated queries to the authentication server, resolving the contradiction between reliability and productivity.
2Measurement precision
If authentication queries are performed for each packet, then authentication accuracy is ensured, but processing time increases
Solution Approach 1:
Authentication information is extracted and stored in the Network Service Header during the initial classification phase. Downstream service nodes can then access this pre-stored authentication data (cookie TLV values) immediately when packets arrive, eliminating the time-consuming process of querying the authentication server for each packet while maintaining authentication accuracy.
Solution Approach 2:
The authentication information (cookie TLV values) is copied into the Network Service Header at the service function classifier and then propagated to downstream service nodes. This copying mechanism allows multiple service nodes to access authentication data without repeatedly querying the authentication server, significantly reducing processing time while preserving authentication accuracy.
3Reliability
If individual packet authentication is performed at each service node, then authentication thoroughness is maintained, but network throughput is reduced
Solution Approach 1:
The authentication function is merged into the packet header structure itself by embedding authentication information (cookie TLV values) in the Network Service Header. This merging allows downstream service nodes to perform authentication verification as part of their normal packet processing without separate queries to the authentication server, thereby maintaining authentication thoroughness while improving network throughput.
Solution Approach 2:
The Network Service Header serves as an intermediary that carries authentication information through the service function chain. By placing authentication data (cookie TLV values) in the NSH, the system enables thorough authentication verification at multiple service nodes without requiring repeated communication with the authentication server, thus maintaining reliability while boosting throughput.
Data Source
AI summary
In one embodiment, a system, method, and computer program product are disclosed for authenticating a packet received from a client node, storing the results of the authentication in a cache memory of a service classifier node, and including the results of the authentication in a network service header of a packet before forwarding the packet to downstream service nodes. In one embodiment, the initial authentication is performed in conjunction with an authentication node.