Packet Processing Indication via Return Tunneling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems often focus on single checking functionalities (CFs) and lack effective management of remote or multiple CFs, leading to inefficiencies and potential misinterpretation of network behavior due to congestion or overload, which can result in dropped traffic being mistaken for security violations.
Innovation Solution
Implementing a method where packets are tunneled from a source network device to a second network device associated with a selected CF, and if not processed, they are further tunneled to another CF, with return-tunneling indicating processing status, allowing for load balancing and congestion avoidance by selecting appropriate CFs based on capabilities and load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single checking functionality (CF) is used for packet processing, then the system is simple to manage, but the CF may become too busy to process additional traffic leading to dropped packets that are misinterpreted as security violations
Solution Approach 1:
The system segments packet processing across multiple checking functionalities (CFs) instead of relying on a single CF. Each CF processes a subset of traffic, distributing the load and preventing any single CF from becoming overloaded. This is achieved through load balancers that distribute packets to multiple CFs based on current load conditions.
Solution Approach 2:
Load balancers act as intermediaries between the network traffic and multiple CFs. These intermediaries monitor CF status and dynamically route packets to appropriate CFs, preventing direct overload of individual CFs while maintaining simple centralized management through the load balancer coordination layer.
2Reliability
If multiple checking functionalities (CFs) are deployed for load distribution, then packet processing reliability improves, but the system complexity increases due to need for coordination and status monitoring
Solution Approach 1:
Multiple CFs are merged into a coordinated system where load balancers aggregate status information from all CFs and make centralized routing decisions. This merging approach maintains reliability through multiple processing paths while managing complexity through centralized coordination logic in the load balancers.
Solution Approach 2:
The system implements feedback mechanisms where CFs report their processing status and load conditions to load balancers. This feedback enables dynamic, data-driven routing decisions that automatically adapt to changing conditions, improving reliability while keeping complexity managed through automated rather than manual coordination.
3Productivity
If traffic is sent to a busy CF, then the CF can process more packets, but the CF may drop packets due to overload which appears as security violations to clients
Solution Approach 1:
The load balancers perform preliminary actions by monitoring CF status and proactively routing traffic before CFs become overloaded. This preventive routing based on current load metrics ensures packets are directed to capable CFs in advance, maintaining high throughput while preventing overload-induced packet drops that would be misinterpreted as security violations.
Data Source
AI summary
A network, network devices, and methods are described for packet processing indication. A method includes tunneling a packet from a first network device to a second network device associated with a first checking functionality. The second network device has an address different than an original destination address of the packet. The method also includes return-tunneling the packet from the second network device to the first network device with an indication of whether the packet was processed by the first checking functionality. The method includes tunneling the packet from the first network device to a third network device associated with a second checking functionality in response to the indication being that the packet was not processed by the first checking functionality. The third network device has an address different from the original destination address of the packet.