Policy-Driven Middleware Service Insertion for Cloud Packet Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for inspecting network traffic in cloud-based applications are inadequate, particularly in ensuring efficient and secure packet routing and evaluation.
Innovation Solution
Implementing middleware that utilizes a session table and policy table to manage packet routing, allowing packets to bypass security services when previously evaluated, and applying label-based mechanisms to ensure packet integrity and functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network traffic is evaluated by security services for every packet, then security reliability is improved, but system productivity deteriorates due to redundant evaluations
Solution Approach 1:
The patent applies preliminary action by evaluating network traffic at the connection establishment phase before data transmission begins. Security services inspect packets during the TCP three-way handshake, determine security policies in advance, and cache these policies. Subsequent data packets during the same connection reuse the cached policies, avoiding redundant security evaluations and improving processing efficiency while maintaining security reliability.
2Reliability
If security services inspect all packets, then security coverage is improved, but system complexity increases due to extensive packet routing management
Solution Approach 1:
The patent segments packet handling into two distinct phases: connection establishment phase and data transmission phase. During connection establishment, security evaluation is performed and policies are cached. During data transmission, the middleware uses the cached policies to rapidly route packets without full security inspection. This segmentation reduces security coverage scope per packet while maintaining overall security coverage, and simplifies routing complexity by avoiding repeated policy lookups.
3Productivity
If packet routing is optimized to bypass security services, then processing speed is improved, but security reliability may worsen due to potential bypass of necessary evaluations
Solution Approach 1:
The patent implements feedback by continuously monitoring connection state and packet characteristics. The middleware receives feedback from security services about which connections require inspection, adjusts routing decisions based on cached policy feedback, and updates routing dynamically when connection states change. This feedback mechanism ensures that packets are routed through security services when necessary while bypassing them when safe, maintaining both speed and reliability.
Data Source
AI summary
Middleware forwards packets to a service prior to modification according to functionality of the middleware. Packets received from the service are identified as having been previously received. The packets are then modified by the middleware and forwarded to a destination. A hash of a packet and a TTL thereof may be stored by the middleware prior to forwarding the packet to the service. The TTL of the packet may be decremented before forwarding. A packet having a hash matching a stored hash and a TTL lower than the stored TTL may be deemed to have been previously received. Modification may include NAT, encryption, and/or description. The service may be a firewall, IDS, and/or IPS.