Dynamic Scaling of VPN Gateway Instances for Cloud Bandwidth
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN systems experience communications lags due to insufficient network bandwidth and processing power at VPN tunnels, leading to negative impacts on user experience, as all network traffic relies on a single VPN data channel and instance of the VPN gateway.
Innovation Solution
Implementing a gateway scaler that dynamically scales the number of data channels and instances of the VPN gateway by monitoring operating parameters, creating new instances and data channels when the current instance is overloaded, and distributing traffic using security logic groups to alleviate processing and network congestion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single VPN data channel and instance of the VPN gateway are used, then device complexity is reduced, but network bandwidth and processing power become insufficient leading to communications lags
Solution Approach 1:
The system dynamically scales the number of VPN gateway instances and data channels based on monitored operating parameters such as CPU utilization, memory usage, and network bandwidth. When thresholds are exceeded, the gateway scaler automatically creates new instances and redistributes traffic, transforming the static single-instance architecture into a dynamic multi-instance system that adapts to varying load conditions.
Solution Approach 2:
The patent segments the monolithic VPN gateway into multiple independent instances, each handling a portion of the network traffic through separate data channels. This segmentation allows the system to distribute processing loads across multiple instances, thereby increasing overall network bandwidth and processing capacity while maintaining the functional capabilities of the original single gateway.
2Productivity
If a single VPN gateway instance processes all traffic, then ease of operation is maintained, but processing power becomes insufficient leading to communications lags
Solution Approach 1:
The gateway scaler implements self-service automation by continuously monitoring operating parameters of VPN gateway instances and autonomously making decisions about creating new instances, establishing data channels, and distributing traffic loads. This eliminates the need for manual intervention in traffic distribution management, maintaining ease of operation while significantly increasing processing power through dynamic resource allocation.
Solution Approach 2:
The system incorporates feedback mechanisms where the gateway scaler continuously monitors operating parameters such as CPU utilization, memory usage, and network bandwidth of VPN gateway instances. Based on this feedback, the scaler automatically adjusts the number of instances and redistributes traffic to optimize processing power utilization, thereby resolving the contradiction between increased processing capability and operational complexity.
3Reliability
If the VPN gateway instance is overloaded, then network bandwidth is exceeded causing communications lags, but adding more instances increases device complexity
Solution Approach 1:
The system dynamically adjusts the number of data channels and VPN gateway instances based on real-time monitoring of operating parameters and traffic load conditions. When the single instance becomes overloaded, the gateway scaler automatically creates additional instances and establishes new data channels, transforming the static architecture into a dynamic system that maintains reliable user experience by adapting to varying bandwidth requirements.
4Productivity
If all traffic flows through a single VPN tunnel, then device complexity is minimized, but network bandwidth becomes insufficient leading to communications lags
Solution Approach 1:
The patent segments the single VPN tunnel into multiple parallel data channels, each handled by a separate VPN gateway instance. This segmentation distributes network traffic across multiple tunnels, thereby increasing overall network bandwidth and eliminating the bottleneck of the single-tunnel architecture while maintaining manageable complexity through automated traffic distribution.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Techniques for dynamically scaling instances of virtual private network (VPN) gateway in a cloud computing system are disclosed herein. In one embodiment, a method includes determining whether a number of packets processed by a first instance of the VPN gateway exceeds a preset threshold. In response to determining that the number of packets exceeds the preset threshold, a new security association (SA) corresponding to a portion of the VPN network traffic is created. Upon completion of creating the SA, a load balancing policy at a load balancer is modified to forward a portion of the network traffic to a second instance of the VPN gateway when an incoming packet contains a security parameter index (SPI) corresponding to the created SA in its EPS header.