TCP Stream Inspection via Dual-Processor Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current router technologies face throughput limitations when performing packet monitoring and filtering, as they require significant CPU processing, which reduces performance and is not easily portable across different router models.
Innovation Solution
A method and router configuration that involves receiving and buffering TCP data packets, determining whether to block or allow connections by examining stored packets, and using a dual processor setup to handle traffic efficiently, allowing safe packets to be forwarded via the ASIC for increased throughput while blocking malicious connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet monitoring and filtering is implemented on the CPU, then the router can perform traffic inspection and blocking, but the throughput is significantly reduced to 200-400 Mb/s
Solution Approach 1:
The router processing is segmented into two distinct paths: a fast path handled by the ASIC for high-speed packet forwarding, and a slow path handled by the CPU for inspection and filtering. This segmentation allows the majority of traffic to bypass CPU processing while still enabling monitoring capabilities for specific connections.
Solution Approach 2:
The patent introduces a TCP connection tracking mechanism as an intermediary between the fast path and slow path. The CPU inspects packets and decides whether to allow or block connections, then the ASIC handles subsequent packet forwarding based on these decisions. This intermediary approach enables CPU-based filtering without requiring all traffic to be processed by the CPU.
2Adaptability or versatility
If packet monitoring is implemented as a user-mode application on the CPU, then the software is easily portable across different router models, but the processing speed is slower compared to kernel-mode or ASIC implementations
Solution Approach 1:
The system performs preliminary actions by establishing TCP connection tracking before full packet inspection. The CPU sets up the connection state and filtering rules in advance, then the ASIC handles subsequent packet forwarding without requiring continuous CPU intervention. This preliminary setup enables fast processing while maintaining software portability.
3Reliability
If all data packets are buffered and inspected by the CPU before forwarding, then malicious connections can be blocked, but the router throughput and response time are significantly reduced
Solution Approach 1:
Instead of inspecting all packets thoroughly before forwarding, the system performs partial inspection by examining only the initial packets to establish TCP connection state and apply filtering rules. Once the connection is approved, subsequent packets are forwarded rapidly by the ASIC without repeated CPU inspection, reducing delay while maintaining security.
Data Source
AI summary
A method of monitoring traffic by a router acting as a gateway between a first and second network is described. The router can receive data packets sent from the first device over the TCP connection and can send a TCP ACK packet to the first device in response to each data packet. The data packets can be stored without sending them to the second device. The stored data packets can be examined in order to determine whether to block or allow the TCP connection. In the event that it is determined to allow the TCP connection, the router can send each of the stored data packets to the second device. In the event that it is determined to block the TCP connection, the router can send a TCP RST message to each of the first and second devices in order to close the TCP connection.