Scalable Traffic Shaping Partitions for Network Performance Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High network traffic rates from virtual machines can impact performance at other virtual machines sharing the same physical computing resources, particularly in scenarios with thousands of virtual machines, leading to potential network attacks and performance degradation.
Innovation Solution
Implementing a scalable traffic shaping service using software defined networking (SDN) techniques to dynamically partition data plane nodes and apply rate limiting policies, identifying high-arrival-rate destinations, and adjusting partitions based on traffic metrics to mitigate network attacks and high traffic rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If virtualization technologies are used to share physical computing resources among multiple virtual machines, then resource utilization efficiency is improved, but network traffic from some virtual machines can impact performance at other virtual machines
Solution Approach 1:
The patent segments the fleet of data plane nodes into multiple partitions, where each partition is assigned to process traffic for a specific subset of traffic destinations. This segmentation isolates network traffic handling so that high traffic rates at one destination affect only its assigned partition rather than the entire system, thus maintaining performance isolation while preserving resource utilization efficiency.
2Reliability
If rate limiting is applied to all network traffic to prevent attacks and performance degradation, then network security and performance are improved, but computing resources required for rate limiting increase
Solution Approach 1:
The patent applies rate limiting selectively rather than uniformly across all traffic. Each partition implements rate limiting only for its assigned subset of destinations, and rate limiting is dynamically adjusted based on observed traffic patterns. This local quality approach maintains network security while reducing overall computing resource requirements compared to universal rate limiting.
Solution Approach 2:
The patent implements partial rate limiting by applying rate limits only when necessary based on traffic analysis, rather than applying maximum rate limiting to all traffic at all times. This allows the system to maintain security posture while consuming fewer computing resources during normal operating conditions.
3Device complexity
If a static partitioning scheme is used for data plane nodes, then system complexity is reduced, but the system cannot adapt to dynamic traffic patterns and attack scenarios
Solution Approach 1:
The patent implements dynamic partitioning where the control plane node continuously monitors traffic patterns and reassigns data plane nodes to different partitions based on current traffic conditions and attack scenarios. This dynamic adaptation allows the system to respond to changing traffic patterns while the control plane manages the complexity of reconfiguration, maintaining operational simplicity for individual partitions.
Data Source
AI summary
Packets received at a routing intermediary and directed to a resource are transmitted to a data plane node of a partition of a traffic management service. The data plane node transmits an indication of a high-arrival-rate destination group, identified based on a metric of network packets received at the data plane node, to a control plane node of the service. A resource is identified at the control plane node as a rate limiting target based on high-arrival-rate group information from several data plane nodes. A limit is applied to the rate at which packets are received at the target. The control plane node changes the number of data plane nodes in the partition based on a triggering condition.