Dynamic VPN Session Distribution Across Multiple Gateways
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VPN solutions are limited by the computing resources of a single default gateway, leading to potential resource exhaustion and reduced performance when handling multiple VPN sessions.
Innovation Solution
Implement a dynamic distribution of VPN sessions across multiple gateways based on real-time computing resource utilization, using network address translation (NAT) to maintain a single public network address and configuring real and shadow VPN sessions to efficiently move sessions between gateways.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If all VPN sessions are configured on a single default gateway, then VPN session management is simplified, but computing resources of the gateway become exhausted leading to reduced performance
Solution Approach 1:
The patent segments VPN session management by distributing sessions across multiple gateways instead of consolidating them on a single gateway. The manager component divides the workload by assigning specific VPN sessions to different gateways based on their resource utilization status, thereby preventing any single gateway from becoming overwhelmed while maintaining organized session management through the central coordinator.
Solution Approach 2:
The patent introduces a new dimension to VPN session management by adding a manager component that operates at a higher level of abstraction. This manager coordinates multiple gateways, transforming the system from a single-point architecture to a distributed multi-node architecture, thereby scaling the system's capacity without proportionally increasing management complexity.
2Productivity
If VPN sessions are distributed across multiple gateways, then computing resource utilization is balanced, but system complexity increases
Solution Approach 1:
The patent merges the control plane and data plane functions by introducing a manager component that handles high-level session distribution decisions while individual gateways handle local session execution. This separation of concerns allows the system to achieve balanced resource utilization across multiple gateways while centralizing the complexity of session management logic in the manager, thereby reducing overall system complexity.
Solution Approach 2:
The manager component serves multiple functions: it monitors gateway resource utilization, makes intelligent session assignment decisions, and coordinates session migration. This multi-functional design consolidates what would otherwise require separate components, thereby achieving balanced resource utilization without proportionally increasing system complexity.
3Reliability
If VPN sessions are moved between gateways, then resource exhaustion is prevented, but reconfiguration is required impacting external endpoints
Solution Approach 1:
The patent implements preliminary action by establishing shadow VPN sessions on standby gateways before actively moving sessions. The shadow sessions are pre-configured with all necessary parameters and security associations, so when a session needs to be migrated, the transition is seamless as the receiving gateway is already prepared. This eliminates reconfiguration impacts on external endpoints while maintaining resource availability.
Solution Approach 2:
The patent uses copying by creating shadow copies of VPN session configurations on multiple gateways. These shadow copies contain all the necessary session parameters, security associations, and routing information. When load balancing or failover is needed, the system switches to the shadow copy rather than creating a new configuration, thereby preventing resource exhaustion without impacting external endpoints through reconfiguration.
Data Source
AI summary
The disclosure provides an approach for processing inter-network communications. Embodiments include configuring, by a management component of a data center, a first virtual private network (VPN) session between a first endpoint outside of the data center and a first gateway of the data center. Embodiments include configuring, by the management component, a second VPN session between a second endpoint outside of the data center and a second gateway of the data center. Embodiments include programming, by the management component, one or more network address translation (NAT) tables of the data center such that, for the first VPN session and the second VPN session, a single public network address of the data center is exposed to the first endpoint and the second endpoint.