Token Bucket Mechanism for HTTPS Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In scenarios where multiple users attempt to access the internet simultaneously, the processing burden on Broadband Remote Access Server (BRAS) devices increases significantly, potentially leading to system overload and breakdown due to the high volume of interactive HTTPS packets, exceeding the normal processing capability of the CPU.
Innovation Solution
Implementing a method where an access gateway device, such as a BRAS, manages HTTPS packets by using token buckets to restrict the number of packets processed by the CPU, ensuring only packets with obtained tokens are sent for processing, and abandoning those without tokens, thus controlling the CPU load. This involves setting token buckets based on the CPU's processing capability and maintaining session information for non-online user sessions to optimize processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the BRAS device processes all HTTPS packets from multiple users simultaneously, then the authentication service coverage is improved, but the CPU processing burden increases excessively leading to system overload
Solution Approach 1:
The patent segments the HTTPS packet processing task by introducing a token bucket mechanism that divides packets into two categories: those that can be processed by the CPU (with tokens) and those that cannot (without tokens). This segmentation allows the system to handle multiple users while preventing CPU overload by only passing a limited number of packets to the CPU for authentication processing.
2Adaptability or versatility
If the BRAS device establishes TCP and SSL connections with all user hosts, then the authentication capability is improved, but the system stability deteriorates due to excessive interactive packets
Solution Approach 1:
The patent applies preliminary action by pre-establishing token buckets for each user session before actual packet processing occurs. When a user host connects, the system pre-allocates a token bucket with a limited number of tokens, which are consumed as HTTPS packets are processed. This preliminary setup prevents system instability by ensuring that even if many users connect simultaneously, only a controlled number of packets per user will reach the CPU.
3Measurement precision
If the BRAS device processes every HTTPS packet through the CPU, then the authentication accuracy is improved, but the processing speed decreases due to CPU bottleneck
Solution Approach 1:
The patent extracts the authentication verification task from the CPU processing path by implementing a token-based filtering mechanism. The token bucket logic is extracted and implemented in the forwarding plane (hardware or software layer below CPU), allowing the system to quickly determine whether to process or discard packets without always involving the CPU. This extraction maintains authentication accuracy for packets that reach the CPU while dramatically improving overall processing speed by handling the majority of packets through the faster extraction path.
Data Source
AI summary
A method and device for processing a packet are provided in this disclosure. According to an example of the method, an HTTPS packet is received from a user host, and a non-online user session entry matching the HTTPs packet is searched for according to a source IP address and a destination IP address of the HTTPS packet. In case that the non-online user session entry is found, a token is obtained from a first token bucket if determining that a user session corresponding to the non-online user session entry has no token, where the number of tokens in the first token bucket is set based on processing capability of a CPU of the access gateway device. When the token is successfully obtained, the HTTPS packet is sent to the CPU for processing. When the token has failed to be obtained, the HTTPS packet is abandoned.