Stateless Packet Marking for Stateful Firewall Rule Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hardware switches struggle with stateful session/rule management due to memory and resource constraints, leading to high latency and CPU utilization in processing dynamic firewall rules for virtual machines or containers, as they are limited to handling 32 to 64K connection flows, whereas active sessions exceed this capacity.
Innovation Solution
Implementing a hybrid system where hardware switches perform stateless lookups and mark packets with IP sets/security groups, while software handles stateful rule processing, using content addressable memory (CAM) for efficient packet classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If hardware switches perform stateful session management, then connection flow handling capability is improved, but memory and resource constraints prevent supporting more than 32 to 64K connection flows
Solution Approach 1:
The patent segments the firewall processing functionality into two parts: stateless rule matching is performed in hardware (switch), while stateful session management is performed in software (host). This segmentation allows the hardware to handle packet classification efficiently without requiring large memory resources, while the software handles the complex stateful management with access to sufficient memory resources.
Solution Approach 2:
The patent introduces packet markings as an intermediary mechanism. The hardware switch marks packets with identifiers indicating which security groups or containers they belong to, and these markings are then used by the software stateful engine to perform rule matching. This intermediary approach enables efficient hardware-assisted processing while maintaining full software-based stateful management capability.
2Quantity of substance
If software handles stateful rule processing, then unlimited memory access is available, but processing latency and CPU resource utilization increase significantly
Solution Approach 1:
The hardware switch performs preliminary stateless rule matching and packet classification before packets reach the software stateful engine. By pre-marking packets with security group identifiers and matching rules in hardware, the system reduces the computational burden on the software, enabling faster overall processing despite the software's superior memory access capability.
3Speed
If hardware switches perform stateless lookups, then lookup speed is improved, but ability to handle dynamic security group membership changes is limited
Solution Approach 1:
The patent segments the processing of static and dynamic firewall rules. Stateless rules with static parameters are matched in hardware for high-speed processing, while stateful rules involving dynamic security group membership are handled in software. This segmentation allows the system to leverage hardware speed for appropriate workloads while maintaining flexibility for dynamic rule processing.
Solution Approach 2:
Packet markings serve as an intermediary that bridges hardware and software processing. The hardware switch marks packets with security group identifiers based on stateless lookups, and these markings enable the software stateful engine to efficiently handle dynamic membership changes without sacrificing the initial high-speed classification provided by hardware.
Data Source
AI summary
A novel method for stateful packet classification that uses hardware resources for performing stateless lookups and software resources for performing stateful connection flow handshaking is provided. To classify an incoming packet from a network, some embodiments perform stateless look up operations for the incoming packet in hardware and forward the result of the stateless look up to the software. The software in turn uses the result of the stateless look up to perform the stateful connection flow handshaking and to determine the result of the stateful packet classification.