Pre-filtering Traffic for Service Insertion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional service insertion methods are inefficient as they either redirect all packets of a flow or none, leading to wasteful processing of packets that do not require inspection, especially in cases involving encrypted traffic where only initial packets need analysis.
Innovation Solution
Implementing a pre-filter component that determines whether packets require processing by a security component, allowing for selective forwarding of only relevant packets to the security component for inspection, thereby bypassing unnecessary processing and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all packets of a flow are redirected to the security component for inspection, then security inspection coverage is improved, but resource utilization deteriorates due to wasteful processing of packets that do not require inspection
Solution Approach 1:
The patent applies partial action by redirecting only a subset of packets (initial packets) to the security component for inspection, rather than all packets. The pre-filter component examines initial packets to determine whether subsequent packets in the flow require security inspection, thereby avoiding unnecessary processing of packets that do not require inspection while maintaining adequate security coverage.
2Reliability
If all packets are forwarded to the security component, then security inspection completeness is improved, but processing efficiency deteriorates
Solution Approach 1:
The patent applies preliminary action by having the pre-filter component examine initial packets of a flow before determining whether subsequent packets need security inspection. This preliminary examination allows the system to make advance decisions about packet routing, forwarding only relevant packets to the security component and bypassing unnecessary processing for packets that do not require inspection, thereby improving processing efficiency while maintaining inspection completeness for packets that need it.
3Measurement precision
If packet inspection is performed on all packets, then security detection accuracy is improved, but time consumption deteriorates
Solution Approach 1:
The patent applies partial action by performing security inspection only on initial packets of each flow through the pre-filter component, rather than inspecting every packet. This approach maintains security detection accuracy for determining whether a flow requires inspection, while significantly reducing time consumption by avoiding redundant inspection of subsequent packets that do not require security processing.
4Device complexity
If conventional service insertion is used without pre-filtering, then implementation simplicity is improved, but resource waste deteriorates
Solution Approach 1:
The patent introduces a pre-filter component as an intermediary between the network traffic and the security component. This pre-filter component examines initial packets to determine whether subsequent packets require security inspection, thereby reducing resource waste by avoiding unnecessary processing of packets that do not need inspection, while maintaining relatively simple implementation through the addition of this intermediary filtering layer.
Data Source
AI summary
The disclosure provides an approach for pre-filtering traffic in a logical network. One method includes receiving, by a hypervisor, a packet from a virtual computing instance (VCI) and determining a service path for the packet based on a service table. The method further includes setting, by the hypervisor, a pre-filter component as a next hop for the packet based on the service path. The method further includes receiving, by the pre-filter component, the packet. The method further includes making a determination, by the pre-filter component, of whether the packet requires processing by the security component. The method further includes performing, by the pre-filter component, based on the determination, one of: forwarding the packet to its destination and bypassing the security component; or forwarding the packet to the security component.