Efficient packet forwarding using cyber-security aware policies

摘要

For balancing load, a forwarder can selectively direct data from the forwarder to a processor according to a loading parameter. The selective direction includes forwarding the data to the processor for processing, transforming and/or forwarding the data to another node, and dropping the data. The forwarder can also adjust the loading parameter based on, at least in part, feedback received from the processor. One or more processing elements can store values associated with one or more flows into a structure without locking the structure. The stored values can be used to determine how to direct the flows, e.g., whether to process a flow or to drop it. The structure can be used within an information channel providing feedback to a processor.

主权项

1. A method of processing a plurality of flows, the method comprising:
computing, by a first processing element within a plurality of processing elements, an index into a structure stored in memory, the index being based on, at least in part, a first unique flow ID of a first flow and a property of the structure; storing by the first processing element, a value in the structure at the location identified by the index, if a specified condition associated with the first flow is satisfied, the storing step being an atomic operation, and the stored value corresponding to the first unique flow ID, wherein a false positive probability of computing the index based on, at least in part, a second unique flow ID of a second flow and computing a value corresponding to the second flow that is same as the stored value is less than a false negative probability of computing the index based on, at least in part, a third unique flow ID of a third flow and computing a value corresponding to the third flow that is different from the stored value; computing, by a second processing element within the plurality of processing elements, a value corresponding to the unique flow ID and the index; comparing by the second processing element the computed value with the value stored at the location identified by the index; and controlling, by the second processing element, processing of the flow based on, at least in part, a result of the comparison.