Security Device Flow Table Saturation Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Flow-based security devices face saturation issues due to limited memory and processing power, leading to denial of service when handling a large number of flows, and are vulnerable to attacks like floods that overwhelm their flow tables.
Innovation Solution
Implementing a method where certain packets, such as those associated with peer-to-peer networking or DNS traffic, are processed without maintaining flow records, allowing them to pass through without adding to the flow table, thereby preventing table saturation and allowing the device to handle a larger volume of traffic with fixed resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If flow-based security devices maintain flow records for all packets, then security processing accuracy is improved, but flow table saturation occurs leading to denial of service
Solution Approach 1:
The patent segments packet handling into two categories: packets requiring flow record maintenance (first plurality) and packets not requiring flow records (second plurality). This segmentation allows the system to maintain security processing for critical packets while avoiding flow table saturation from packets that don't require stateful inspection, such as certain DNS or peer-to-peer traffic.
Solution Approach 2:
The patent applies different processing qualities to different packet types. Instead of uniformly maintaining flow records for all packets, the system selectively maintains flow records only for packets where security processing requires state information, while allowing other packets to pass without flow record overhead. This local differentiation optimizes both security accuracy and resource utilization.
2Manufacturing precision
If flow-based security devices process all packets with flow record maintenance, then security inspection thoroughness is improved, but device availability deteriorates under high traffic volume
Solution Approach 1:
The patent implements partial action by maintaining flow records only for the portion of traffic that requires stateful security inspection, rather than for all packets. This selective approach ensures thorough security inspection where needed while avoiding the excessive resource consumption that would lead to device unavailability under high traffic conditions.
Solution Approach 2:
The system dynamically determines which packets require flow record maintenance based on packet characteristics and security policy requirements. This dynamic adaptation allows the device to adjust its resource consumption in real-time, maintaining security inspection thoroughness for critical packets while preserving device availability by skipping flow record maintenance for packets where it is not necessary.
3Quantity of substance
If flow tables are designed with larger capacity, then ability to handle more flows is improved, but memory consumption and processing overhead increase
Solution Approach 1:
The patent extracts the unnecessary flow record maintenance operation from the packet processing pipeline for certain packet types. By taking out the flow record creation and maintenance steps for packets that don't require stateful inspection (such as DNS queries or P2P traffic), the system avoids allocating memory resources for these records, thereby reducing overall memory consumption while maintaining adequate flow table capacity for packets that do require tracking.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for processing a first plurality of packets using one or more processors and maintaining one or more flow records associated with the first plurality of packets, and processing a second plurality of packets without maintaining flow records associated with the second plurality of packets and allowing the second plurality of packets to pass to one or more destinations.