Multi-Application Shared Memory for Cloud Security Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting and preventing malware are inefficient due to bottlenecks in communication between local and cloud systems, particularly in offloading data processing tasks, which hampers effective detection and mitigation of malicious activities.
Innovation Solution
Implementing a multi-application shared memory system that allows direct communication between local security entities and cloud services without the need for a management plane, enabling seamless data processing offloading and reducing latency by using forward and reverse direction shared memories to manage request and response messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a management plane is used to mediate communication between local security entities and cloud services, then system architecture is simplified and easier to manage, but communication latency increases and processing efficiency decreases
Solution Approach 1:
The patent extracts the communication mediation function from the management plane and creates a dedicated shared memory mechanism. Local security entities can directly write requests to shared memory and read responses without management plane intervention, separating the fast communication path from the management architecture.
Solution Approach 2:
The patent introduces shared memory as an intermediary between local security entities and cloud services. This intermediary enables direct communication by providing a common buffer where requests are written and responses are read, eliminating the need for management plane mediation while maintaining architectural integrity.
2Productivity
If data processing tasks are offloaded to cloud services, then local processing capacity is reduced and security analysis capability is improved, but communication overhead increases and processing speed decreases
Solution Approach 1:
The patent extracts the communication overhead from the data processing workflow by establishing a direct shared memory channel. This separates the heavy data processing tasks (offloaded to cloud) from the communication mechanism (local shared memory), allowing efficient task offloading without communication bottlenecks.
Solution Approach 2:
The patent enables continuous processing by allowing local security entities to continuously write requests to shared memory and immediately read responses when available. This continuous action pattern eliminates idle waiting time and maintains high processing throughput despite cloud offloading.
3Reliability
If multiple local security entities communicate with cloud services through individual channels, then each entity has dedicated communication path, but system resource utilization is low and processing efficiency decreases
Solution Approach 1:
The patent merges multiple individual communication channels into a single shared memory buffer that serves all local security entities. This consolidation allows multiple entities to simultaneously write requests and read responses from the same memory space, improving resource utilization while maintaining communication reliability through proper synchronization.
Solution Approach 2:
The shared memory structure serves multiple functions: it acts as a request queue, a response buffer, and a synchronization mechanism for multiple security entities simultaneously. This universal structure replaces multiple dedicated channels, improving efficiency while maintaining the reliability needed for security communications.
Data Source
AI summary
The present application discloses a method, system, and computer system for using a shared memory quota for communicating with a plurality of services in a data plane. The method includes processing a set of data for network security analysis, determining whether to offload the set of data to a cloud security entity for security processing, in response to determining to offload the set of data to the cloud security entity, send the set of data from a shared memory of the inline security entity to the cloud security entity. The cloud security entity provides a plurality of services. The plurality of services share a multiple-service shared-memory in which messages pertaining to the set of data offloaded to the cloud security entity is stored. Each service in the plurality of services is allocated a quota of the multiple-service shared-memory.