Shared-Memory Firewall SVM High Availability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High availability (HA) solutions are not currently available for shared-memory-based service virtual machines (SVMs), leading to potential data packet redirection halts and dropped traffic if an SVM fails.
Innovation Solution
Implementing HA for shared-memory-based SVMs by configuring a pair of SVMs to provide redundancy, where one SVM is active and the other is standby, with a hypervisor managing shared memory devices and agent processes to ensure continuous data traffic handling, and using a heartbeat link to detect failures and maintain service availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single SVM is used to provide network services, then the system structure is simple, but the system reliability deteriorates because data packet redirection halts and traffic is dropped if the SVM fails
Solution Approach 1:
The patent creates a standby copy of the SVM with identical configuration and shared memory access. When the active SVM fails, the standby SVM is already prepared and can immediately take over without requiring system reconfiguration or traffic redirection changes, thus maintaining reliability while keeping the copying mechanism simple
Solution Approach 2:
The standby SVM is pre-configured with all necessary settings, rules, and shared memory access permissions before any failure occurs. This preliminary preparation ensures that failover can happen immediately without delay for configuration or setup, maintaining system availability while avoiding complex real-time reconfiguration
2Reliability
If HA mechanisms are implemented for guest VMs with host failure, then system reliability improves, but the complexity of failure recovery increases due to IP address modification and migration overhead
Solution Approach 1:
The patent merges the failover capability into the existing SVM architecture by using shared memory that is already accessible by multiple SVMs. The standby SVM shares the same memory space and configuration as the active SVM, eliminating the need for separate IP address modification and complex migration processes required in traditional guest VM HA solutions
Solution Approach 2:
The standby SVM is a prepared copy with identical shared memory access rights and configuration. When failover is needed, the standby simply becomes active without requiring IP address changes or complex state migration, thus improving service continuity while keeping the failover process simpler than traditional VM migration
3Measurement precision
If the hypervisor needs to know the active status of each SVM for packet queuing, then packet routing precision improves, but the hypervisor complexity and information management overhead increase
Solution Approach 1:
The standby SVM is configured as a copy with identical shared memory access permissions and packet processing capabilities. Both active and standby SVMs can independently access the same shared memory queues, eliminating the need for the hypervisor to track which SVM is active for routing decisions, thus maintaining routing precision while reducing hypervisor complexity
Solution Approach 2:
The SVM pair autonomously manages its own active/standby status through shared memory access rights without requiring hypervisor intervention for status tracking. The hypervisor simply queues packets to the shared memory device, and the active SVM processes them without needing explicit status information from the hypervisor, reducing information management overhead
Data Source
AI summary
A method for a shared-memory-based SVM to provide high availability of service is disclosed. In an embodiment, an agent process of the SVM receives a signal that one or more data packets have been queued in a shared memory device of one or more shared memory devices. Upon receiving the signal, the agent process determines whether the SVM has been designated as active for the shared memory device, and if it has, the agent process reads the one or more data packets from the shared memory device. As the data packets are read from the shared memory device: for each data packet, of the one or more data packets read from the shared memory device: the agent process determines whether an indication that the packet is to be transmitted to its destination is received, and if the indication is received, the packet is placed back to the shared memory device.