A matching method for network quintuples based on ordered interval lists

Abstract

The present invention relates to a network quintuple matching method based on an ordered interval list, belonging to the technical field of computer network communications. Through data structure design, the present invention enables rapid matching of network quintuples in data packets to corresponding security policies. Furthermore, by maintaining a policy interval information list and a bitmap corresponding to each policy interval, security policies can be added, deleted, modified, and checked, thereby increasing the flexibility of network firewall configuration.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network communications, and in particular relates to a matching method for network quintuples based on an ordered interval list. Background Art

[0002] In computer network communications, the network quintuple is used at the transport layer to identify the sender and receiver. It is included in the packet headers of both the network and transport layers. It consists of five fields: sender IP address, sender port, receiver IP address, receiver port, and protocol, hence the name quintuple. A security policy is a control rule consisting of matching conditions and actions. Matching conditions can include the quintuple, user, time, and other factors. The action determines how packets meeting the matching conditions will be handled.

[0003] A network quintuple comprises the five basic attributes of a network packet. A network quintuple uniquely identifies a session between two entities in a computer network, making it of great significance. Quintuple matching is widely used in network security, such as in firewall packet filtering. Essentially, it determines whether a packet can pass through based on security policies predefined by users or network administrators. The matching criteria for security policies primarily rely on limiting the scope of the network quintuple. For example, denying all packets from a certain IP address, destination port 80, and protocol value 6 (TCP) effectively prevents that IP address from accessing the HTTP server within the firewall. Configured firewalls often have numerous security policies. Determining whether to pass a packet requires locating the associated security policy based on the packet's quintuple. Therefore, quickly matching the quintuple with the security policy is crucial to firewall throughput performance. Furthermore, configured security policies should be flexible, such as supporting dynamic addition, deletion, modification, and querying of policies. Summary of the Invention

[0004] (1) Technical issues to be solved

[0005] The technical problems to be solved by the present invention are: how to quickly match the corresponding security policy through the network quintuple in the data packet; and how to dynamically add, delete, modify and check the security policy.

[0006] (2) Technical solution

[0007] In order to solve the above technical problems, the present invention provides a network quintuple matching method based on an ordered interval list, which implements security policy matching of the network quintuple in the following manner:

[0008] If the sender's IP address is an IPv4 address, it is treated as a 4-byte unsigned integer. If it is an IPv6 address, it is treated as a 16-byte unsigned integer. The matching condition in the security policy divides the IP address into an interval. If the IP address is treated as an integer, this interval is treated as an integer interval. Therefore, given a policy interval and an IP address, the size of the integers is compared to determine whether the IP address is within the interval. In the same way, each element in the network quintuple is treated as an unsigned integer, thus converting the policy matching problem into the problem of comparing integer sizes and determining whether an integer exists in a certain interval.

[0009] Furthermore, a list is designed to maintain the information of all policy intervals of a tuple. The elements in the list are integer intervals connected from beginning to end. Initially, the list is initialized to have only one element, whose interval is [0, MAX]. MAX is the maximum value allowed for this element.

[0010] This list and its elements must satisfy the following three constraints:

[0011] ①The starting value of the first interval is 0, and the ending value of the last interval is MAX;

[0012] ②The end value of the same interval is greater than or equal to the starting value;

[0013] ③The starting value of the next interval in the list is the ending value of the previous interval plus 1;

[0014] The list that satisfies the above three constraints is a list of monotonically non-decreasing intervals, where there is no intersection between different intervals and the union of all intervals is [0, MAX];

[0015] After obtaining such a list, for an input IP address that needs to be matched, since the list has been sorted into a monotonically non-decreasing order, for a list with n intervals, a binary search method is used with a time complexity of O(log n) to find which interval the input IP address exists in.

[0016] Assuming the maximum number of security policies allowed is N, each security policy is assigned a policy index number in the range [0, N-1]. Each interval maintains a bitmap with a bit length of N. If the security policy with index x includes this interval, the x+1th bit in the interval bitmap is set to 1; otherwise, it is set to 0. Therefore, the bitmap for an interval contains the index number information of all security policies that include this interval. After locating the corresponding interval through input and obtaining the bitmap, a scan of the bitmap can be used to find which security policies define ranges that include the input IP address.

[0017] For the case of a five-tuple, five independent lists are maintained for each of the five elements. After five binary searches on the five-tuple list, five bitmaps of the same length can be obtained. The five bitmaps are bitwise ANDed to obtain the security policy index number that satisfies the matching conditions on the five elements at the same time, that is, the policy index number for which the final match is completed.

[0018] Preferably, for a single element, there may be multiple policy index numbers containing the input value found, but if there is no error in the policy definition process, there should be only one policy index number finally matched, otherwise it means that the matching conditions of different policy index numbers are exactly the same.

[0019] Preferably, the method further implements adding, deleting, modifying and checking security policies by maintaining a list and a bitmap corresponding to each policy interval.

[0020] Preferably, the search for security policies is achieved in the following manner: according to the input value of each element, a binary search method is applied to the list corresponding to each element to find the interval containing this input value and obtain the bitmap corresponding to this interval; bitwise AND is performed on the five bitmaps of equal length corresponding to the five elements to obtain the corresponding policy index number.

[0021] Preferably, the security policy is added in the following ways:

[0022] For the case of one tuple, the increase strategy consists of two steps: interval splitting and bitmap updating;

[0023] Interval splitting: For the new strategy with the interval [X, Y], split the original list at X and Y respectively to create new intervals. Let X be the starting value of the new interval to the right of the break position at X, and let Y be the ending value of the new interval to the left of the break position at Y. At the same time, make necessary adjustments to the list to meet the three constraints on the list mentioned above.

[0024] Bitmap update: The new interval formed after the split is a subinterval of the interval before the split, so the bitmap of the new interval needs to inherit the bitmap of the interval before the split. At the same time, after the interval split, for all new intervals in the [X, Y] range, the corresponding bits of the corresponding policy index numbers in the bitmap of the new interval should be set to 1 to indicate that the entire [X, Y] range meets the matching conditions of this policy.

[0025] For a quintuple, perform interval splitting and bitmap update on the interval list corresponding to the quintuple.

[0026] Preferably, the security policy is deleted by:

[0027] Deleting a security policy is the reverse process of adding a security policy. For the case of a tuple, there are also two steps: bitmap update and interval merging;

[0028] Bitmap update: For the deleted policy with the policy interval [A, B], set the bits corresponding to the corresponding policy index numbers in the bitmap of all intervals within the range [A, B] to 0;

[0029] Interval merging: For the strategy with a strategy interval of [A, B], the processing method is as follows: after the bitmap is updated, for the interval with the starting value A, compare the bitmap of this interval with the previous interval. If they are exactly the same, it means that there is no other strategy with the starting value A as the boundary value. Therefore, merge the left interval of the starting value A and the right interval of the ending value B into a larger interval. Otherwise, the interval cannot be merged. For the interval with the ending value B, compare the bitmap of this interval with the next interval. If they are exactly the same, it means that there is no other strategy with the ending value B as the boundary value. Therefore, merge the left interval of the starting value A and the right interval of the ending value B into a larger interval.

[0030] For a quintuple, bitmap update and interval merging can be performed separately on the interval list corresponding to the quintuple.

[0031] Preferably, modifying the security policy is achieved by first deleting the security policy and then adding the security policy.

[0032] The present invention also provides a system for implementing the method.

[0033] The invention also provides a network firewall designed and implemented based on the method.

[0034] The present invention also provides a network communication method implemented based on the method.

[0035] (3) Beneficial effects

[0036] The present invention realizes the rapid matching of the network quintuple in the data packet to the corresponding security policy through the design of the data structure, and realizes the addition, deletion, modification and query of the security policy by maintaining the policy interval information list and the bitmap corresponding to each policy interval, thereby improving the flexibility of the network firewall configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Schematic diagram of the strategy interval splitting process designed for the present invention;

[0038] Figure 2 Schematic diagram of the bitmap update process designed for the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below with reference to the accompanying drawings and examples.

[0040] With the development of network infrastructure, people are placing higher demands on network speed, security, and other aspects. Firewalls are devices used to enhance network security. They primarily use packet filtering technology to audit passing data packets and intercept packets originating from or destined for untrusted peers. Packet filtering relies on identifying the five-tuple of a packet according to defined security policies. The matching conditions in security policies define a specific range for the five-tuple. Because every packet must undergo this matching process before passing through the firewall, a prolonged matching process can significantly impact network throughput and latency. Therefore, how to quickly match the network five-tuple in a packet to the corresponding security policy has become a core issue that firewalls must address. Furthermore, to enhance configuration flexibility, security policies should also support dynamic addition, deletion, modification, and querying of policies.

[0041] The present invention designs a fast network quintuple matching method, and the matching method can support dynamic addition, deletion, modification and query of security policies.

[0042] 1. Solution Design

[0043] The present invention provides a network quintuple matching method based on an ordered interval list. The core of the method lies in the design of the data structure. First, consider the case where only the sender's IP address is a unigram in the data packet. Taking this as an example, the solution for unigrams can be easily extended to the case of quintuples.

[0044] The sender's IP address, if it's an IPv4 address, can be considered a 4-byte unsigned integer; if it's an IPv6 address, it can be considered a 16-byte unsigned large integer. The matching conditions in the security policy divide the IP address into a range. By treating the IP address as an integer, this range can also be considered an integer range. Therefore, given a policy range (matching range) and an IP address, we can determine whether the IP address falls within this range by comparing the integers. In this way, each element in the network quintuple can be considered an unsigned integer, transforming the policy matching problem into one of comparing integers and determining whether an integer falls within a range.

[0045] The present invention uses a list to maintain information about all policy intervals of a tuple, where the elements in the list are integer intervals connected end to end. Initially, the list is initialized to have only one element, whose interval is [0, MAX]. MAX is the maximum value allowed for this element. For example, for an IPv4 address, since it is regarded as a 4-byte unsigned integer, MAX = 0xFFFFFFFF.

[0046] This list and its elements must satisfy the following three constraints:

[0047] ①The starting value of the first interval is 0, and the ending value of the last interval is MAX;

[0048] ②The end value of the same interval is greater than or equal to the starting value;

[0049] ③The starting value of the next interval in the list is the ending value of the previous interval plus 1.

[0050] The list that satisfies the above three constraints is a monotonically non-decreasing list of intervals. There is no intersection between different intervals, and the union of all intervals is [0, MAX].

[0051] After obtaining such a list, for an input IP address that needs to be matched, since the list is already sorted in monotonically non-decreasing order, a binary search algorithm can be used to find the interval in which the input IP address falls within a list of n intervals with a time complexity of O(log n), making the search relatively fast. Assuming the maximum number of security policies allowed (security policies are simply referred to as policies) is N, each security policy needs to be assigned a policy index number in the range [0, N-1]. Furthermore, a bitmap with a bit length of N is maintained for each interval. If the security policy with index x includes the interval, the x+1th bit in the interval bitmap is set to 1; otherwise, it is set to 0. Therefore, the bitmap for an interval contains the index number information of all security policies that include the interval. After locating the corresponding interval through the input and obtaining the bitmap, a single scan of the bitmap can be used to find which security policies define the range that includes the input IP address.

[0052] For quintuples, five separate lists are maintained for each of the five elements (five fields). Five binary searches of the five-element lists yield five bitmaps of equal length. A bitwise AND of these five bitmaps yields the security policy index that satisfies the matching conditions on all five elements, representing the final matching policy index. For a single element, multiple policy indexes containing the input value may be found. However, if the policy definition process is error-free, only one policy index should be found. Otherwise, different policy indexes may have identical matching conditions.

[0053] 2. Working Principle

[0054] The core of the present invention is how to maintain this list and bitmap, and how to use this list and bitmap to support the addition, deletion, modification and query of policies. The following will describe this process in detail:

[0055] ①Search strategy:

[0056] The process of finding a strategy has been described above. Here is a summary:

[0057] According to the input value of each element, a binary search method is applied to the list corresponding to each element to find the interval containing this value and obtain the bitmap corresponding to this interval; the five bitmaps of equal length corresponding to the five elements are bitwise ANDed to obtain the corresponding policy index number.

[0058] Because the number of executions of the search operation is much greater than the number of executions of the addition, deletion, and modification operations in actual application scenarios, how to improve the execution speed of the search operation becomes the key. According to the method of the present invention, considering the worst case scenario, that is, the addition of each new strategy will introduce 2 new intervals into each element, assuming that the maximum number of strategies allowed is N, the time complexity of the binary search method is 5*O(log N)=O(log N), the time complexity of the bitmap scan is O(N), and the total time complexity is O(N)+O(log N). Among them, the binary search method part itself is already an efficient O(log N) time complexity, and the bitmap scan part uses efficient bit operations, and the constant factor is extremely low after special optimization, so the method of the present invention has a higher search efficiency. According to actual tests, in a typical scenario where 3000 strategies exist, the time required for strategy search can reach microseconds as a pure software implementation solution of the present invention.

[0059] ②Add strategy:

[0060] For the case of one tuple, the augmentation strategy consists of two steps: interval splitting and bitmap updating.

[0061] Interval splitting: For the new strategy with the strategy interval [X, Y], split the original list at X and Y respectively and split the new intervals. Let X be the starting value of the new interval to the right of the break position at X, and let Y be the ending value of the new interval to the left of the break position at Y. At the same time, make necessary adjustments to the list to meet the three constraints on the list mentioned above, such as Figure 1 shown.

[0062] After the interval splitting is completed, each interval will completely meet the matching conditions of one or more strategies. There will be no situation where some values ​​in a certain interval meet the matching conditions of a certain strategy while other values ​​do not.

[0063] Bitmap update: The interval splitting should not affect the matching process of other intervals and strategies, and the new interval formed after the split is a sub-interval of the interval before the split, so the bitmap of the new interval needs to inherit the bitmap of the interval before the split; at the same time, after the interval splitting, for all new intervals in the [X, Y] range, the corresponding bits of the strategy index number in the bitmap of the new interval should be set to 1 to indicate that the entire [X, Y] range meets the matching conditions of this strategy, such as Figure 2 shown.

[0064] For a quintuple, the above process can be performed separately on the interval list corresponding to the quintuple.

[0065] ③Deletion strategy:

[0066] The deletion strategy can be understood as the reverse process of the addition strategy. For the case of a tuple, there are also two steps: bitmap update and interval merging.

[0067] Bitmap update: For the deleted policy with the policy interval [A, B], set the bit corresponding to the policy index number in the bitmap of all intervals in the range [A, B] to 0.

[0068] Interval merging: For strategies with a conditional interval of [A, B], after deletion, it is necessary to consider whether to merge the intervals on both sides of the start value A and the end value B into a larger interval. However, because other strategies may use the start value A or the end value B as the boundary value, the intervals cannot be merged in this case. Therefore, the specific processing method is: After the bitmap is updated, for the interval with the start value A, compare the bitmap of this interval with the previous interval. If they are exactly the same, it means that there is no other strategy with the start value A as the boundary value, so the two intervals can be merged into a larger interval. Otherwise, the intervals cannot be merged. For the interval with the end value B, compare the bitmap of this interval with the next interval, and the processing flow is the same as above.

[0069] For a quintuple, the above process can be performed separately on the interval list corresponding to the quintuple.

[0070] ④Modification strategy:

[0071] To modify a policy, first delete the policy and then add the policy.

[0072] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network quintuple matching method based on an ordered interval list, characterized in that: Implement security policy matching for network quintuples as follows: If the sender's IP address is an IPv4 address, it is treated as a 4-byte unsigned integer. If it is an IPv6 address, it is treated as a 16-byte unsigned integer. The matching condition in the security policy divides the IP address into a policy range. If the IP address is treated as an integer, this policy range is treated as an integer range. Therefore, given a policy range and an IP address, the integer size is compared to determine whether the IP address is within the policy range. In the same way, each element in the network quintuple is regarded as an unsigned integer, thereby converting the policy matching problem into the problem of comparing the sizes of integers and judging whether an integer exists in a certain integer interval; Furthermore, a list is designed to maintain the information of all policy intervals of a tuple, and the elements in the list are integer intervals connected from beginning to end; Initially, the list is initialized to have only one element, and its range is [0, MAX]; MAX is the maximum value allowed for this element; This list and its elements must satisfy the following three constraints: The starting value of the first integer interval is 0, and the ending value of the last integer interval is MAX; The ending value of the same integer interval is greater than or equal to the starting value; The starting value of the next integer interval in the list is the ending value of the previous integer interval plus 1; The list that satisfies the above three constraints is a list of monotonically non-decreasing integer intervals, where there is no intersection between different integer intervals, and the union of all integer intervals is [0, MAX]; After obtaining such a list, for an input IP address that needs to be matched, since the list has been sorted in a monotonically non-decreasing order, for a list with n policy intervals, a binary search method is used with a time complexity of O(log n) to find which policy interval the input IP address exists in. Assuming the maximum number of security policies allowed is N, each security policy is assigned a policy index number in the range [0, N-1]. Each policy interval maintains a bitmap with a bit length of N. If the security policy with index x includes this policy interval, the x+1th bit of this policy interval bitmap is set to 1; otherwise, it is set to 0. Therefore, the bitmap of a policy interval contains the index number information of all security policies that include this policy interval. After locating the corresponding policy interval through input and obtaining this bitmap, a scan of the bitmap can be used to find which security policies define a range that includes the input IP address. For the case of a five-tuple, five independent lists are maintained for each of the five elements. After five binary searches on the five-tuple list, five bitmaps of the same length can be obtained. The five bitmaps are bitwise ANDed to obtain the security policy index number that satisfies the matching conditions on the five elements at the same time, that is, the policy index number for which the final match is completed.

2. The method according to claim 1, wherein For a single element, there may be multiple policy index numbers that contain the input value. However, if there are no errors in the policy definition process, there should be only one policy index number that is finally matched. Otherwise, it means that the matching conditions of different policy index numbers are exactly the same.

3. The method according to claim 1, wherein The method also implements the addition, deletion, modification and query of security policies by maintaining a list and a bitmap corresponding to each policy interval.

4. The method according to claim 3, wherein The security policy is searched by applying a binary search to the list corresponding to each element based on the input value of each element to find the policy interval containing this input value and obtain the bitmap corresponding to this policy interval. Perform bitwise AND on the five bitmaps of equal length corresponding to the five elements to obtain the corresponding policy index number.

5. The method according to claim 3, wherein Add security policies in the following ways: For the case of one-tuple, the increase strategy consists of two steps: integer interval splitting and bitmap updating; Integer interval splitting: For the new strategy corresponding to the integer interval [X, Y], split the original list at X and Y respectively to create new integer intervals, let X be the starting value of the new interval to the right of the break position at X, and let Y be the ending value of the new integer interval to the left of the break position at Y. At the same time, make necessary adjustments to the list to meet the three constraints on the list mentioned above; Bitmap update: The integer interval corresponding to the new strategy formed after the split is a subinterval of the integer interval before the split. Therefore, the bitmap of the new integer interval needs to inherit the bitmap of the interval before the split. At the same time, after the integer interval is split, for all new integer intervals in the range [X, Y], the corresponding bits of the corresponding strategy index numbers in the bitmap of the new integer interval should be set to 1 to indicate that the entire [X, Y] range meets the matching conditions of this strategy. For a quintuple, perform integer interval splitting and bitmap update on the interval list corresponding to the quintuple.

6. The method according to claim 5, wherein To delete a security policy: Deleting a security policy is the reverse process of adding a security policy. For the case of a tuple, there are also two steps: bitmap update and integer interval merging; Bitmap update: For the deleted policy whose corresponding integer interval is [A, B], set the bits corresponding to the corresponding policy index numbers in the bitmap of all integer intervals in the range [A, B] to 0; Integer interval merging: For the policy whose corresponding integer interval is [A, B], the processing method is: after the bitmap is updated, for the integer interval with the starting value A, compare the bitmap of this integer interval with the previous integer interval. If they are exactly the same, it means that there is no other policy with the starting value A as the boundary value. Therefore, the integer interval on the left of the starting value A and the integer interval on the right of the ending value B are merged into a larger integer interval. Otherwise, the integer interval cannot be merged. For the integer interval with the ending value B, compare the bitmap of this integer interval with the next integer interval. If they are exactly the same, it means that there is no other policy with the ending value B as the boundary value. Therefore, the integer interval on the left of the starting value A and the integer interval on the right of the ending value B are merged into a larger integer interval. For a quintuple, bitmap update and integer interval merging can be performed separately on the integer interval list corresponding to the strategy corresponding to the quintuple.

7. The method according to claim 6, wherein To modify a security policy, first delete the security policy and then add it.

8. A network communication method implemented based on the method according to any one of claims 1 to 7.

Images