Condition-decided filtering for time-deterministic firewalls
By setting the maximum processing time tmax in the firewall and interrupting rule processing, the problem of the existing firewall's lack of time certainty when processing data packets is solved, and the guaranteed time for data packets to arrive at the receiver and network load smoothness are achieved.
Patent Information
- Application Number
- CN202380020914.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-02-18
- Filing Date
- 2023-02-17
- Publication Date
- 2025-01-21
AI Technical Summary
现有防火墙在处理数据包时缺乏时间确定性,导致可能以过高的延迟或过晚地转发包,引发冲击式的包处理和拥堵。
By introducing a mechanism in the firewall, the maximum processing time T is restricted, and the processing of the rules at this time is reached, the predetermined results are adopted, and the maximum data packet is sent at T0+T. At the same time, the packet copy that can be saved in the buffer can be saved in the buffer, and the performance of the firewall performance is allowed to be fully analyzed and processed.
It achieves guaranteed time for data packets to arrive at the receiver in the network, reduces firewall load and packet processing delay, and improves network load smoothness.
Smart Images
Figure CN119343893A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a method for implementing conditional filtering for a time-deterministic firewall. Background Art
[0002] In computer networks, firewalls are required to filter data packets sent in the network and forward or discard them based on rules.
[0003] The packet filter (firewall or switch with ACL rules) looks at each packet and makes a decision with the help of a rule set. This rule set can be saved in the firewall.
[0004] The advent of increased real-time transmission has the effect that the firewall can also process packets in real time (i.e. with a predetermined delay or processing time). The available time budget may be too small for a complete analysis of the packet with respect to all firewall rules. This may be related to the load on the firewall (e.g. the firewall takes too long because other computing operations are preferably processed) or parallel processing on the firewall (the CPU is used for other tasks).
[0005] Today, firewalls have no knowledge of time budgets. This results in the firewall forwarding packets with too high a delay / latency, and thus time-critical packets may arrive at the receiver in the network too late. Strongly varying processing times also cause problems, since this can result in bursty packet processing and packet jams. Constant processing times are therefore advantageous in many cases, in particular for the accurate prediction and planning of packet flows in the network.
[0006] To date, this problem has not been considered more thoroughly in research because firewalls have not been used in conjunction with time-critical transmissions. The present invention describes a method for handling this situation. Summary of the invention
[0007] The object of the present invention is therefore to provide a method for ensuring that time-critical packets arrive at a receiver in a timely manner. Accordingly, the present invention has the object of specifying a method for conditional filtering for a time-deterministic firewall.
[0008] This object is achieved by the features of the independent claims.
[0009] A method is proposed for this purpose, which seeks to ensure that data packets in a network arrive at a receiver at a predeterminable time. The method aims to predict the time required for a data packet to travel from a sender to a destination, so as to control data transmission in the network using the defined time and to predict it.
[0010] In order to achieve a constant processing time for packets through the firewall, it may make sense to最大 Analysis of the packet is then discontinued and the packet is sent without being fully evaluated by the firewall.
[0011] The total processing time is assumed to be t 处理 Normally, a data packet arrives at time t0 and is sent to the server at time t0+t 处理 is sent. Duration t 处理 This may be variable, since the duration depends on the processing time of the firewall and the number of filter rules. A firewall rule set usually consists of a plurality of (several) rules. In order to achieve a constant processing time, a mechanism is proposed, which limits the following point: when the maximum processing time t is reached 最大 In this case, the processing of the rule is interrupted and the predetermined result is adopted. 最大 (This is necessarily less than t0+t 处理 ) Send the packet. Alternatively, the check can also be ended by discarding the data packet after the fixed time. This ensures that subsequent data packets only have to wait for a defined time.
[0012] The forwarding or discarding of a packet is defined as a firewall action in a firewall rule group. The firewall action can be a common firewall action, such as accept, discard, reject, and / or log. These actions are also combinable.
[0013] In the case of forwarding packets, the maximum processing time t 最大 The packet is then forwarded without full filtering. This applies to packets where timely delivery outweighs the weight of a full evaluation of all firewall rules. 最大 It makes sense to then discard the packet for the low-priority packet in order not to use too much processing time in the case of this less important packet, which in turn could delay the high-priority packet.
[0014] The decision on which firewall action to apply (discard or forward) can be either configured for the transmission type or determined by means of the packet using the firewall's matching rules. In this way, different actions can be specified for different packets depending on the packet characteristics. This corresponds to the normal function of the firewall.
[0015] Additionally, the maximum processing time t can be configured according to the transmission type. 最大 Or any matching rule can be used to define t 最大 To this end, new rules can be introduced in the firewall, which as a decision contains the processing strategy (forward or delete) and / or the time budget t 最大 redistribution.
[0016] Because when a packet is sent according to this method, the packet is sent at time t0+t 最大 forwarding, so security issues may arise (if the decision is to send). Also, important low-priority packets may be lost (if the decision is to discard).
[0017] In order to deal with this problem, it is additionally stipulated that at time t0+t 最大 Not only are the packets that have not been processed completely sent and discarded, but a copy of the packet is also saved in the buffer so that it can be completely analyzed later once the firewall has sufficient performance reserve in order to process the remaining rules. For this purpose, the incomplete and interrupted packets are copied to the buffer and are provided to the filter again when the processing capacity becomes free. In this later second filtering step, only the rules that have not been applied so far need to be taken into account. Therefore, in the case of interrupted filtering, the packets are also buffered, at which rule position the filtering was interrupted and how the packet was processed (forwarded or deleted).
[0018] In a (later) second filtering process, it can be ascertained for the buffered packets that the forwarding or deletion was incorrect. In the case of an incorrect forwarding, another system (e.g. a system for intrusion detection) can then be informed, or an explicit deletion rule for following the transmission can be added to the firewall. This additional rule is added at the beginning of the rule list of the firewall so that the processing of this rule is possible. In the case of an incorrect deletion, a buffered copy of the packet can be sent further in the case of a complete filtering.
[0019] Since the buffer is limited to packets to be analyzed later, the buffer can be configured so that packets are only buffered for a certain period of time. They can then be deleted or sent. The buffer can also be configured so that if there is insufficient space in the buffer, either old or newly arrived data packets are discarded.
[0020] The cache and / or the second filtering process may also be implemented on an external network device.
[0021] The described method thus achieves two things: a) a guaranteed processing time for the packet is achieved independently of the load on the firewall. B) load smoothing is facilitated, since the packet can then be processed at a time with less load. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Other features are derived from the accompanying drawings. In the drawings:
[0023] Figure 1 shows a time diagram for packet filtering with interrupt criteria;
[0024] Figure 2 Shown for Figure 1 Block diagram of
[0025] Figure 3 A time diagram for packet filtering with post-filtering is shown;
[0026] Figure 4 Shown for Figure 3 Block diagram of . DETAILED DESCRIPTION
[0027] Figure 1 The method according to the invention is shown as a time diagram. In this case, a data packet 3 in a network 1 is provided to a firewall 2 for checking according to the rules stored in the firewall 2. The arrival time of the data packet is indicated by t0.
[0028] Depending on the number of rules to be processed, the performance of firewall 2, and the work consumption of firewall 2 when the data packet arrives at the input 4 of the firewall, the data packet needs to be processed for a time t 处理 .
[0029] However, there are situations in which fast forwarding of data packets is more important than complete processing of all filter rules in firewall 2 .
[0030] In order to bring about a time-deterministic behavior, it is now proposed that the data packet 3 can be sent according to a predefinable interruption criterion, even if the filtering in the firewall 2 has not yet been completed at that time. Figure 1 The scheduled time t is defined in 最大 , which allows for the maximum waiting time required for filtering of the data packet 3 in the firewall 2. If this time expires, the filtering 7 is interrupted and the data packet is forwarded 8.
[0031] At time t 最大 After the expiration, the data packet 3 is then sent to the output 7 of the data packet 3 and thus forwarded into the network 1 .
[0032] It is helpful for this if the data packet 3 is marked accordingly, it can also be known later that no complete filtering is carried out for this data packet 3 by the firewall 2 .
[0033] Figure 2 As a block diagram to illustrate the Figure 1 Method. Here, the data packet or data frame is first received by the firewall 10. A time stamp is created here, or the time of reception is ascertained in a functionally equivalent manner when it arrives at the firewall 11. Then, filtering processing 12 is started by the firewall.
[0034] After the filter rules have been processed, the time elapsed since the arrival time 11 is recorded. This elapsed time is then checked as follows to see whether it already corresponds to a predefined maximum filter time. If this time has been reached, then the interruption criterion 15 is met. In this case, although not all filter rules have been processed, the data packet is directed to the output of the firewall and thus sent 16.
[0035] Instead of sending the data packet 16, a firewall action may also be implemented. The firewall action may include forwarding or discarding the data packet (3).
[0036] If the termination criterion 15 has not been reached, then a query 14 is made as to whether further rules should be implemented by filtering in the firewall. If this is the case, the data packet is subjected to further filtering 12.
[0037] If no further filter rules are to be processed, the data packet can likewise be directed for transmission 16. In a time-deterministic network, data packets that arrive earlier are not urgent, but delayed arrival of data packets at the receiver should be avoided.
[0038] Figure 3 As a time diagram according to Figure 1 The method according to the invention now provides for buffering of data packets and reprocessing of data packets. In this case, data packets 3 in the network 1 are provided to the firewall 2 for checking according to the rules stored in the firewall 2. The arrival time of the data packet is described by t0.
[0039] Depending on the number of rules to be processed, the performance of the firewall, and the work consumption of the firewall when the packet arrives at the input 4 of the firewall, the packet needs to be processed for a time t 处理 .
[0040] However, there are situations in which fast forwarding of data packets is more important than complete processing of all filter rules in firewall 2 .
[0041] In order to achieve a time-deterministic behavior, it is now proposed that the data packet 3 can be sent according to a predefinable interruption criterion, even if the filtering in the firewall 2 has not yet been completed at this time. Figure 1 The scheduled time t is defined in 最大 , which allows the maximum waiting time required for the filtering of the data packet 3 in the firewall 2. If this time expires, the filtering 7 is interrupted and the data packet is forwarded 8.
[0042] At time t 最大 After the expiration, the data packet 3 is then sent to the output 7 of the data packet 3 and thus forwarded into the network 1 .
[0043] It is helpful for this if the data packet 3 is marked accordingly, it can also be known later that no complete filtering is carried out for this data packet 3 by the firewall 2 .
[0044] Different from Figure 2 In the example, the data packet 3 is provided to a buffer. The buffer can be integrated in the firewall 2, but another network participant can also be provided for this purpose.
[0045] If the network participant with the buffer can save corresponding resources, the previously interrupted filtering can now be continued at 7 ′. This further rule processing can then again be carried out by the firewall 2 itself or by the network participant with the buffer.
[0046] For this purpose, it is proposed that the data packet in the buffer is not only marked as one, for which filtering is interrupted, but also its filter rules must be processed until complete filtering.
[0047] The time required for this additional filtering can be calculated. This time is determined by the defined maximum processing time, after which the processing of the firewall 2 is first interrupted, and the processing time for reprocessing. The difference between the two times is then the processing time for reprocessing.
[0048] If the reprocessing is finished, a firewall action can be introduced, which can represent normal forwarding 8' of the data packet or discarding of the data packet.
[0049] Figure 4 As a block diagram to illustrate the Figure 3 Method. Here, the data packet or data frame is first received by the firewall 10. A time stamp is created here, or the time of reception is ascertained in a functionally equivalent manner when it arrives at the firewall 11. Then, filtering processing 12 is started by the firewall.
[0050] After the filter rules have been processed, the time elapsed since the arrival time 11 is recorded. This elapsed time is then checked as follows to see whether it already corresponds to a predefined maximum filter time. If this time is reached, then the interruption criterion 15 is met. In this case, the data packet is directed to the output of the firewall and thus sent 16, although not all filter rules have been processed.
[0051] Instead of sending data packet 16, a firewall action may be implemented. The firewall action may include forwarding or discarding data packet (3).
[0052] If query 17 is generated, ie not all rules have yet been processed, the data packet is additionally transferred to the buffer.
[0053] If the termination criterion 15 has not been reached, then a query 14 is made as to whether further rules should be implemented by means of a filtering process in the firewall. If this is the case, then the data packet is subjected to a further filtering process 12.
[0054] If no further filter rules are to be processed, the data packet can likewise be directed for transmission 16. In a time-deterministic network, data packets that arrive earlier are not urgent, but delayed arrival of data packets at the receiver should be avoided.
[0055] If data packets are marked for later reprocessing and / or data packets are received in a buffer for later processing 18 , this later processing 18 can be carried out at a later time if the network participant can save resources for this purpose.
[0056] The filtering process is continued at the point where the interruption criterion 15 has already caused an interruption of the process in the firewall. After the filtering is completed, the data packet is then subjected to a firewall action 20 and is forwarded or discarded as a result. Reference numerals list
[0057] 1. Network
[0058] 2 Firewall
[0059] 3 packets
[0060] 4 Input
[0061] 5. Processing
[0062] 6 outputs
[0063] 7. Interrupt rule processing
[0064] 7'Continue rule processing
[0065] 8 Forward
[0066] 8'Repost
[0067] 10Receive
[0068] 11 Arrival Time
[0069] 12. Processing
[0070] 13. Find out the processing time
[0071] 14. Inquiries about other rules
[0072] 15 Interruption criteria
[0073] 16Send
[0074] 17. Inquiries about other rules
[0075] 18 Later processing
[0076] 20 Firewall Actions
Claims
1. A method for ensuring that a data packet (3) in a network (1) arrives at a receiver at a predetermined time, Using a firewall (2) containing filtering rules in a computer network (1), It is characterized in that Allocate a time budget for processing in the firewall (2) to each packet (3), After the time budget has expired, a definable firewall action (20) is executed for the corresponding data packet, Therein, even if the processing of the filter rule in the firewall (2) has not yet been completed when the time budget expires, the firewall action (20) is implemented.
2. The method according to claim 1, characterized in that: The processing time of the firewall (2) includes the time from when the data packet (3) is input (4) on the firewall (2) and is processed (5) to when the data packet is output (6) on the firewall (2).
3. The method according to claim 1 or 2, characterized in that: The time budget for processing a data packet (3) in the firewall (2) corresponds to a definable maximum time (15), which can be shorter than the processing time (12) through the firewall (2).
4. The method according to claim 4, characterized in that: The data packet (3) is sent (16) to the firewall (3) output (7) as a firewall action (20) according to the interruption criteria (15).
5. The method according to claim 4, characterized in that The data packet (3) is dropped as a firewall action (20) based on the interruption criteria (15).
6. The method according to claim 4 or 5, characterized in that: Expiration of a defined maximum time (15) is defined as an interruption criterion (15).
7. The method according to any one of claims 1 to 6, characterized in that In the event that the processing of the filter rule in the firewall (2) has not yet been completed after the expiration of the time budget, the corresponding data packet is marked and provided with additional information.
8. The method according to claim 7, characterized in that The tag contains filter rules that are still pending, which have not yet been processed by the firewall (2).
9. The method according to any one of claims 1 to 8, characterized in that In the event that the processing of the filter rule in the firewall (2) has not yet been completed after the time budget has expired, the corresponding data packet is stored in a buffer.
10. The method according to claim 9, characterized in that The cache is arranged in a network participant outside the firewall (2).
11. The method according to claim 9 or 10, characterized in that: The data packets (3) in the buffer are processed after the firewall takes action, so that the filtering rules of the firewall (2) are processed completely.
12. The method according to claim 11, characterized in that After the processing of the filter rules is complete, the firewall action is also implemented (20).
13. The method according to any one of claims 1 to 12, characterized in that The packet (3) is time-checked upon arrival at the input (4) of the firewall (2) (11).
14. The method according to any one of claims 1 to 12, characterized in that The processing time corresponds to the time required for the firewall (2) to perform the filtering process (12) on the data packet (3).
15. The method according to any one of claims 1 to 13, characterized in that Subsequent processing (18) of the filter rules for the data packets (3) in the buffer is carried out by a network participant outside the firewall (2).