VPN Service Using Eventually Consistent Regional Database
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN clustering solutions are latency-bound and limited in size due to the requirement for strongly consistent VPN session data across all nodes, leading to common points of failure and administrative burdens.
Innovation Solution
Implementing a VPN service that uses an eventually consistent regional database to store VPN session data, allowing VPN appliances to access and restore sessions from a backend database without strict consistency requirements, enabling horizontal and geographical scaling and reducing the risk of single points of failure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strongly consistent VPN session data is maintained across all cluster nodes, then session reliability is improved, but system latency and device complexity increase
Solution Approach 1:
The patent introduces a database as an intermediary layer between VPN appliance nodes to store session data. Instead of requiring direct synchronization between all nodes (which causes latency), nodes query the database for session information. This mediator approach maintains data consistency while reducing inter-node communication overhead and latency.
Solution Approach 2:
The patent creates copies of session data in the database that can be independently queried by multiple VPN nodes. Rather than maintaining a single source of truth that requires constant synchronization, each node can retrieve session data from the database without blocking other nodes, thus improving system speed while maintaining reliability.
2Reliability
If VPN cluster nodes are co-located to ensure consistent session data access, then session reliability is improved, but geographic scalability and fault tolerance worsen
Solution Approach 1:
The database acts as a centralized intermediary that enables VPN nodes to be geographically distributed while maintaining access to session data. Nodes in different locations can query the same database without requiring physical proximity, thus enabling geographic scalability while preserving session availability through centralized data management.
Solution Approach 2:
The patent separates the spatial dimension of node placement from the data access dimension. By introducing a database layer, nodes can be distributed across different geographic locations (spatial dimension) while maintaining logical consistency through centralized data storage (data dimension). This dimensional separation enables both geographic scalability and session reliability.
3Reliability
If multiple VPN appliances form a cluster to provide redundancy, then fault tolerance is improved, but common points of failure and administrative complexity increase
Solution Approach 1:
The patent merges the session data storage function into a centralized database, separating it from the VPN appliance functions. This consolidation reduces administrative complexity by providing a single point for session data management while maintaining fault tolerance through the clustered appliance architecture. Administrators manage session data in one location rather than synchronizing across multiple appliances.
Data Source
AI summary
Embodiments presented herein disclose a VPN service which includes a cluster of VPN appliances that requires only an eventually consistent database to share VPN session data among cluster nodes. Doing so provides a VPN service that can scale both horizontally (i.e., the VPN service can support large numbers of VPN appliances) as well as geographically (i.e., nodes of the cluster do not need to be physically proximate to one another in order to satisfy latency requirements). Thus, the VPN service can provide regional endpoints to VPN clients that do not share common points of failure or administrative burdens.