VPN Cluster Session Management via Eventual Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN clustering solutions are latency-bound and limited in scale due to the requirement for strongly consistent session data across all nodes, leading to common points of failure and administrative burdens.
Innovation Solution
Implementing a VPN service that uses an eventually consistent regional database to store session data, allowing VPN appliances to operate independently and scale both horizontally and geographically, with session data updated in a best-effort manner without strict consistency guarantees.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strongly consistent session data is maintained across all VPN cluster nodes, then session data consistency is improved, but system latency and device complexity increase
Solution Approach 1:
The patent introduces a centralized session data store as an intermediary component that all VPN appliance nodes access. This mediator holds the authoritative session data and provides it to requesting nodes, eliminating the need for direct peer-to-peer consistency synchronization. The session data store acts as a buffer and coordination point, allowing nodes to independently access consistent data without direct communication overhead between them.
Solution Approach 2:
The patent extracts session data management from the VPN appliance nodes themselves and places it in a separate, dedicated session data store. By removing the consistency maintenance burden from the appliance nodes, each node can operate independently with lower latency, while the centralized store ensures data consistency is maintained separately without impacting node performance.
2Reliability
If VPN cluster nodes are co-located to maintain strong consistency, then session data access consistency is improved, but fault tolerance and scalability worsen due to common points of failure
Solution Approach 1:
The patent segments the VPN service into independent appliance nodes that can be geographically distributed, with session data functionality segmented into a separate centralized store. This segmentation allows nodes to be located in different physical locations without compromising consistency, as each node independently accesses the centralized store. The segmentation enables both geographic distribution for fault tolerance and centralized coordination for consistency.
Solution Approach 2:
The centralized session data store serves as an intermediary that enables geographic distribution of VPN nodes while maintaining consistency. Nodes can be located far apart physically but still access consistent session data through the mediator, eliminating the requirement for co-location while preserving data consistency across distributed nodes.
3Measurement precision
If traditional VPN clustering is implemented with strong consistency requirements, then session data accuracy is improved, but system scalability and ease of operation worsen
Solution Approach 1:
The patent implements self-service by allowing each VPN appliance node to independently query and access session data from the centralized store without requiring coordination or synchronization with other nodes. Each node serves itself by directly accessing the authoritative session data when needed, eliminating complex inter-node communication protocols and consistency maintenance mechanisms while ensuring data accuracy.
Solution Approach 2:
The centralized session data store acts as a mediator that simplifies the system architecture by providing a single source of truth that all nodes access independently. This eliminates the need for complex distributed consensus algorithms and inter-node synchronization protocols, reducing system complexity while maintaining session data accuracy through the centralized coordination point.
4Reliability
If multiple VPN endpoints are deployed for redundancy, then fault tolerance is improved, but maintaining strong consistency across all endpoints increases latency and complexity
Solution Approach 1:
The centralized session data store serves as a mediator that enables multiple VPN endpoints to be deployed for redundancy without requiring fast synchronization between them. Each endpoint independently accesses the centralized store for session data, eliminating the need for direct synchronization between endpoints. The mediator absorbs the consistency maintenance burden, allowing endpoints to be geographically distributed with lower latency requirements.
Data Source
AI summary
Embodiments presented herein disclose a VPN service which includes a cluster of VPN appliances that requires only an eventually consistent database to share VPN session data among cluster nodes. Doing so provides a VPN service that can scale both horizontally (i.e., the VPN service can support large numbers of VPN appliances) as well as geographically (i.e., nodes of the cluster do not need to be physically proximate to one another in order to satisfy latency requirements). Thus, the VPN service can provide regional endpoints to VPN clients that do not share common points of failure or administrative burdens.