Multi-Tenant QUIC Stream Pairing for Tunnel-Less Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network solutions face challenges in applying network policies to cloud-based enterprise networks due to non-routable private IP addresses, overlapping IP address issues, and inefficiencies in connection tracking and tunneling protocols like IPSec, leading to throughput limitations and high protocol overhead.
Innovation Solution
Implementing a multi-stream transport protocol (e.g., QUIC) with a Multi-Tenant Module (MTM) that uses stream pairs to carry 5-tuple and metadata, eliminating the need for tunnels and connection tracking, and employing in-memory caching for efficient packet handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tunneling protocols like IPSec are used to protect private network IP addresses, then network security and policy application are improved, but protocol overhead increases and throughput decreases
Solution Approach 1:
The patent extracts the connection tracking and tunneling functions from the network path by implementing them in the application layer using QUIC protocol. The MTM module extracts 5-tuple information directly from QUIC streams without requiring IPSec tunneling, eliminating the performance overhead of tunneling protocols while maintaining security through application-layer identity management.
Solution Approach 2:
The patent replaces the mechanical tunneling system (IPSec) with an application-layer solution using QUIC protocol's native stream identification. Instead of encapsulating traffic in tunnels, the system uses QUIC's built-in stream IDs and MTM's 5-tuple extraction to achieve the same policy application goals without the performance penalty of tunneling.
2Measurement precision
If connection tracking is implemented to apply network policies, then policy enforcement accuracy is improved, but device complexity and processing overhead increase
Solution Approach 1:
The QUIC protocol and MTM module perform self-identification through native stream IDs and 5-tuple information embedded in the protocol. The system does not require external connection tracking infrastructure because QUIC streams carry their own identification information, allowing the MTM module to enforce policies directly based on stream-level identities without complex tracking state management.
Solution Approach 2:
The patent moves policy enforcement from the network layer (where connection tracking is complex) to the application layer where QUIC streams provide native identification. By operating at the stream level rather than connection level, the system gains access to richer identification information (5-tuple + stream ID) without the complexity of maintaining connection state across multiple layers.
3Reliability
If private IP addresses are used for multi-tenant enterprises, then network isolation is improved, but IP address overlapping and routing difficulties worsen
Solution Approach 1:
The MTM module acts as an intermediary that translates private IP address identities into universal 5-tuple identifiers. Instead of requiring global IP address compatibility, the system uses MTM to intercept and identify traffic based on 5-tuple information from QUIC streams, allowing private IP addresses to maintain their isolation properties while the MTM layer provides the compatibility needed for cloud-based policy enforcement.
Solution Approach 2:
The patent changes the identification parameter from IP address alone to a composite 5-tuple identifier (source IP, source port, destination IP, destination port, protocol). This parameter transformation allows the system to work with private IP addresses in multi-tenant environments without routing conflicts, as the full 5-tuple provides unique identification even when IP addresses overlap across tenants.
4Extent of automation
If gateway solutions are deployed in the cloud to enforce policies, then centralized policy management is improved, but latency and response time increase
Solution Approach 1:
The MTM module performs policy-relevant identification and classification actions at the stream level, before full connection establishment. By extracting 5-tuple information early in the QUIC handshake process and making policy decisions at the stream level rather than waiting for complete connection setup, the system achieves centralized policy management with minimal latency.
Solution Approach 2:
The patent segments policy enforcement into stream-level operations rather than connection-level operations. Each QUIC stream can be independently identified and policy-checked using its 5-tuple information, allowing parallel processing of multiple streams without serializing through a single connection tracking state machine. This segmentation reduces the time penalty of centralized policy management.
Data Source
AI summary
Systems for packet handling over a network, the systems including a client device configured to communicate over a network, the client device further including a Multi Tenant Module-Client module (MTM-Client module) having processor-readable instructions to direct at least one client device processor to determine whether a packet is a Synchronize packet and, if so, the MTM-Client module opens a pair of streams with consecutive stream IDs to communicate over the network, and the first stream of the pair carries a 5-tuple and metadata for the communication from the client device, and the second stream of the pair carries the TCP packet for the communication from the client device. The systems further including a server device configured to communicate over the network with the client device, the server device further including a Multi Tenant Module-Server module (MTM-Server module) having processor-readable instructions to direct at least one server device processor to detect the 5-tuple and metadata from the first stream; and search for the next stream ID for the TCP packet, and the MTM-Server module saves the 5-tuple to an in-memory cache database.