Stateful Flow Information Table for Packet Inspection Coherence
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Packet inspection systems deployed at network edges face coherence issues when handling high data rates and rapid flow creations/deletions, leading to inconsistent flow information table identifiers and unpredictable system behavior.
Innovation Solution
Incorporating state information into flow information tables to manage ownership and location of flow identifiers, utilizing a deterministic Finite State Automata to ensure valid state transitions and coherent handling of flow identifiers across dual packet inspection subsystems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If dual packet inspection subsystems operate independently to handle high data rates, then processing capacity is improved, but flow identifier coherence deteriorates
Solution Approach 1:
A shared flow information table acts as an intermediary between the secure and unsecure packet inspection subsystems. This table stores flow identifiers and their states, allowing both subsystems to access and update flow information in a coordinated manner, preventing identifier conflicts while maintaining independent high-speed processing capabilities
Solution Approach 2:
The system implements feedback mechanisms where subsystems communicate flow creation and deletion events to each other through the shared flow information table. This feedback ensures that both subsystems have consistent knowledge of flow states, preventing coherence issues even when operating independently at high data rates
2Reliability
If master-slave arbitration is implemented to resolve flow identifier conflicts, then identifier uniqueness is improved, but system complexity increases
Solution Approach 1:
The system uses dynamic state transitions in the flow information table to manage identifier allocation. Instead of static master-slave arbitration, the state machine adapts to real-time conditions, allowing either subsystem to allocate identifiers based on current flow states and events, reducing complexity while maintaining uniqueness
Solution Approach 2:
Each subsystem independently manages its own flow identifier allocation using the shared flow information table and state machine. The subsystems serve themselves by checking the state of flow identifiers before allocation, eliminating the need for complex centralized arbitration while ensuring uniqueness
3Adaptability or versatility
If rapid flow creation and deletion is allowed to handle dynamic traffic, then system adaptability is improved, but identifier consistency deteriorates
Solution Approach 1:
The system performs preliminary checks of the flow information table state before allocating or deallocating flow identifiers. This preliminary action ensures that rapid flow creation and deletion operations maintain consistency by verifying identifier availability and proper state transitions before executing changes
Solution Approach 2:
The patent replaces mechanical synchronization mechanisms with a software-based state machine and shared data structure approach. This substitution allows rapid flow operations without the overhead and complexity of traditional synchronization mechanisms, maintaining both adaptability and consistency
Data Source
AI summary
A packet processing system comprises two packet inspection systems for tracking packet flows between a first network and a second network. A memory is accessible by each of the packet inspection systems for storing flow entries. Each of the flow entries includes a flow key characterizing a packet flow associated with flow entry, a flow identifier. State information is further maintained indicating ownership of the flow identifiers among the two packet inspection systems. Using stateful identifiers ensures that two packet processing systems do not become incoherent and properly indicate the status of free flow identifiers.