Pipeline Processor Complex for Network Traffic Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Real-time application classification and policy enforcement in high-speed networks is challenging due to the need to enforce tens of thousands of policies across various enterprise locations, traffic categorizations, and flow directions.
Innovation Solution
A pipeline processor complex with multiple processor cores is used to construct network traffic trees for characterization and enforce policies, applying traffic rate control by traffic type for both inbound and outbound traffic, utilizing lock-free queues and per-processor timer wheels to ensure efficient and real-time processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time application classification and policy enforcement is implemented in high-speed networks, then quality of service control is improved, but processing complexity and resource requirements increase
Solution Approach 1:
The system segments the complex policy enforcement task into multiple independent pipeline stages, each handled by dedicated processor cores. The pipeline includes stages for packet classification, traffic tree construction, policy matching, and rate control enforcement. This segmentation allows each core to specialize in specific processing tasks, improving overall system reliability for QoS control while distributing processing complexity across multiple components rather than concentrating it in a single complex module.
Solution Approach 2:
The patent introduces a hierarchical dimension to policy organization using traffic trees with multiple levels (enterprise location, traffic categorization, application type, flow direction). This dimensional organization transforms the flat complex policy set into a structured hierarchy, enabling more efficient processing by breaking down the enforcement task into manageable hierarchical levels rather than handling all policies as a single complex set.
2Adaptability or versatility
If tens of thousands of policies are enforced across multiple enterprise locations and traffic categorizations, then policy coverage is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-constructing traffic trees that organize policies hierarchically before actual traffic processing occurs. The traffic trees are built in advance with all policy rules structured by enterprise location, traffic categorization, application type, and flow direction. This preliminary organization allows rapid policy matching during runtime without requiring real-time construction or evaluation of all tens of thousands of policies, thus maintaining comprehensive policy coverage while reducing processing time.
Solution Approach 2:
The pipeline architecture segments policy processing into parallel stages handled by different processor cores. One set of cores constructs traffic trees while another set performs policy enforcement, allowing these operations to occur concurrently rather than sequentially. This segmentation enables the system to handle tens of thousands of policies across multiple enterprise locations and traffic categorizations without linearly increasing processing time, as multiple policies can be evaluated in parallel through the pipeline.
3Productivity
If granular traffic flow control is implemented, then bandwidth allocation efficiency is improved, but system complexity increases
Solution Approach 1:
The system implements granular traffic flow control by segmenting bandwidth allocation into discrete rate limits applied at each level of the traffic tree hierarchy. Each policy node in the hierarchy can have its own rate control parameters, allowing precise bandwidth allocation for different enterprise locations, traffic categories, applications, and flow directions. This segmentation enables fine-grained control without requiring a single complex monolithic control mechanism, as the bandwidth management is distributed across multiple independent rate control points in the pipeline.
Solution Approach 2:
The patent adds hierarchical dimensions to bandwidth allocation through the traffic tree structure. Instead of flat bandwidth management, the system allocates rates across multiple dimensions (enterprise location, traffic categorization, application type, flow direction) simultaneously. This multi-dimensional approach enables granular control where bandwidth can be precisely allocated and enforced at each hierarchical level, improving bandwidth allocation efficiency while the hierarchical structure itself organizes the complexity into manageable layers rather than a single complex control plane.
Data Source
AI summary
A machine has a bus, an input port connected to the bus to receive inbound network traffic, an output port connected to the bus to convey outbound network traffic and a processor complex connected to the bus. The processor complex is configured as a pipeline with individual processor cores assigned individual network traffic processing tasks. The pipeline includes a first set of processor cores to construct network traffic trees characterizing the inbound network traffic and the outbound network traffic. Each network traffic tree characterizes traffic type and traffic rate. A second set of processor cores enforces network traffic policies utilizing the network traffic trees. The network traffic policies apply traffic rate control by traffic type for the inbound network traffic and the outbound network traffic.