Packet delay for time deterministic firewalls
By allocating a time budget to each data packet and sending it at a scheduled time, the problem of time certainty of the firewall when processing data packets is solved, and the timely arrival of data packets and transmission stability are achieved.
Patent Information
- Application Number
- CN202380020850.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-02-18
- Filing Date
- 2023-02-17
- Publication Date
- 2025-01-21
AI Technical Summary
The existing firewall lacks time certainty when processing data packets, resulting in high latency and unstable packet processing, which cannot meet the transmission requirements of strict time requirements.
Time-deterministic packet delivery is achieved by allocating a time budget to each packet, ensuring that packets are sent at the scheduled time after processing in the firewall.
It achieves the timely arrival of data packets in the network, reduces delay and jitter, and improves the processing stability and predictability of the firewall.
Smart Images
Figure CN119343906A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a method for implementing a time-deterministic firewall. Background Art
[0002] Firewalls are needed in computer networks to filter data packets sent in the network and forward or discard them according to rules.
[0003] The packet filter (firewall, switch with ACL rules) examines each packet and makes a decision with the help of a rule set. The rule set can be stored in the firewall.
[0004] The advent of increased real-time transmission has the effect that the firewall can also process packets in real time (i.e. with a predetermined delay or processing time). The available time budget may be too small for a complete analysis of the packet with respect to all firewall rules. This may be due to the load on the firewall (e.g. the firewall takes too long because other computing operations are prioritized) or parallel processing on the firewall (the CPU is used for other tasks).
[0005] Today, firewalls have no knowledge of time budgets. This has the consequence that the firewall may forward packets with too high a delay / latency, and therefore time-critical packets may arrive at the receiver in the network too late. Slow, highly variable processing times are also problematic, since they can result in bursty packet processing and packet jams. Slower but constant processing times are therefore advantageous in many cases, in particular for the accurate prediction and planning of packet flows in the network.
[0006] To date, this problem has not been considered more thoroughly in research because firewalls have not been used in conjunction with time-critical transmissions. The present invention describes a method for handling this situation. Summary of the invention
[0007] The object of the present invention is therefore to provide a method for ensuring that time-critical packets arrive at a receiver in a timely manner. Accordingly, the present invention has the object of specifying a method for a time-deterministic firewall.
[0008] This object is achieved by the features of the independent claims.
[0009] A method is proposed for this purpose, which seeks to ensure that data packets in a network arrive at a receiver at a predeterminable time. The method aims to predict the time required for a data packet to travel from the sender to the destination, so that the data transmission in the network can be controlled and predicted using the defined time.
[0010] For this purpose, the network includes at least one firewall. Each data packet is then allocated a time budget required for processing in the firewall. The corresponding data packet is sent only after the time budget expires. This means that each data packet is sent only after the time budget expires, regardless of the actual time required for filtering by the firewall.
[0011] The time budget itself therefore depends on the maximum possible processing time in the firewall.
[0012] In order to achieve a uniform processing time for all packets of a transmission type or a packet flow, it may be useful to delay the packets to such an extent that the processing of the firewall rules results in a fixed (but increasing) time requirement. As a result, no differences in the processing time due to the varying load on the firewall are visible from the outside. The behavior of the firewall thus becomes deterministic and programmable.
[0013] To achieve this feature, a time budget is assigned to each packet. The time budget is chosen so that the firewall has sufficient capacity to always comply with this. After being processed by the firewall, the packet is placed in a buffer until the time budget expires. The packet is then sent at a defined time. The defined time can be defined according to the following criteria:
[0014] a) Fixed processing time: Each packet of a transmission type or a packet flow has the same processing time t 最大 When a packet is input to the firewall, the timestamp of the input time is obtained and stored. 0 After processing, the packet is cached. 0 +t 最大 Then continue to send the packet. 最大 , so that the firewall processing can always be completed at time t 最大 Therefore, for a fixed time t 最大 Processes each packet. From the outside, the firewall appears to have a constant processing time.
[0015] b) Synchronous forwarding with delay: In order to achieve synchronization with other time-synchronized network devices, it can be useful to always send packets at a certain (repeated) time. This is often also described as the time within a cycle. In addition to method part a), additional delays can be introduced so that the packet can always be sent at a recurring, fixed, time t. 发送 For this purpose, a variable delay t is also implemented after the delay in point a). 等待 (Extended buffer), so that for the next sending window t 发送 :t 0 +t 最大 +t等待 =t 发送 .
[0016] c) Synchronous forwarding without delay: In some cases it may be advantageous to forward the data at a certain time without additional delay t 最大 In these cases, the firewall will then have a higher jitter, but will then at least send at a certain sending time. In this case, the time for buffering and sending is selected as follows: t 0 +t 处理 +t 等待 =t 发送 Duration t 处理 This represents the variable natural processing time of the firewall. The firewall therefore always sends the message as quickly as possible, but at the next defined sending time t 发送 Continue to send data packets. Duration t 处理 This can be variable since the duration depends on the processing time of the firewall and the number of filter rules.
[0017] Maximum waiting time t 最大 Either it can be set for the transmission type or it can be determined based on the packet using the matching rules of the firewall. For this purpose, new rules can be introduced into the firewall, which contain the time budget t as a decision. 最大 In this way, the time budget can be specified differently for the most different packets by means of the firewall's rule set.
[0018] The time budget for a data packet can be allocated according to various criteria. It is possible to define the time budget according to the transmission type of the network (LAN, WAN, etc.). It is also possible to define the time budget according to the characteristics of the data packet (size, content, etc.). It is also conceivable to determine the time budget according to the source or destination (port, network, VLAN, etc.). BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Other features are derived from the accompanying drawings. In the drawings:
[0020] Figure 1 A timing diagram showing a transmission delay for a transmission with a fixed processing time;
[0021] Figure 2 Shown for Figure 1 Block diagram of
[0022] Figure 3 A time diagram showing the transmission delay for forwarding with synchronization;
[0023] Figure 4 Show according to Figure 3The timing diagram of ,without additional waiting time;
[0024] Figure 5 Shown for Figure 3 and 4 Block diagram of
[0025] Figure 6 Show according to Figure 3 The timing diagram of,without sending delay;
[0026] Figure 7 Show Figure 6 Block diagram of . DETAILED DESCRIPTION
[0027] Figure 1 The method according to the invention according to the above-described variant a) is shown as a time diagram. In this case, a data packet 3 from the network 1 is provided to the firewall 2 for checking according to the rules stored in the firewall 2. The arrival time of the data packet is t 0 describe.
[0028] Depending on the number of rules to be processed, the performance of the firewall, and the work consumption of the firewall when the data packet arrives at the input 4 of the firewall, the data packet needs to be processed for a time t 处理 .
[0029] The data packet is therefore kept in the processing 5 of the firewall 2 until the rule has been processed, and at this time t 处理 Completely finished 8.
[0030] In order to achieve a time-deterministic behavior, it is now proposed that a data packet 3 arrives in the buffer 6 and is held there until a predetermined time t 最大 The predetermined time is determined by the performance of the firewall and the maximum operating time determined in this case, which may occur in the firewall.
[0031] At time t 最大 After the expiration, the data packet 3 is then sent to the output 7 of the firewall, so that the data packet is also not sent after the firewall 3 has completed processing, but first starts 9 caching and at time t 最大 Only after the expiration date does the transmission 10 take place to the output 7 of the firewall and thus to the further transmission into the network 1 .
[0032] Figure 2 As a block diagram to illustrate the Figure 1 Here, firstly, a data packet or a data frame is received 11 by the firewall. A timestamp is created here, or the time of reception is specified in a functionally equivalent manner when it arrives at the firewall 12. Then, filtering processing 13 by the firewall begins.
[0033] When the filtering process 13 is completed, the time is recorded again as the processing time 14. The processing time is calculated by subtracting the two recorded times, that is, the time when the data packet arrives at the firewall 12 is subtracted from the time after the filtering process 13 is completed. Thus, the processing time 14t is obtained. 处理 .
[0034] Then get the buffer of the data packet and wait until the predetermined time t 最大 After calculating the processing time 14, wait for t 最大 With t 处理 The difference between the maximum time and the maximum time is 15t. 最大 The data packet is processed.
[0035] Then 16 packets are sent. The packets can then also be deleted from the buffer. The buffer can be located in the firewall or stored externally in other network participants.
[0036] Figure 3 The method according to the invention is shown as a time diagram according to the above-described variant b). In this case, a data packet 3 from the network 1 is supplied to the firewall 2 for checking according to the rules stored in the firewall 2. The arrival time of the data packet is t 0 describe.
[0037] Depending on the number of rules to be processed, the performance of the firewall, and the work consumption of the firewall when the data packet arrives at the input 4 of the firewall, the data packet needs to be processed for a time t 处理 .
[0038] The data packet is therefore held in the processing 5 of the firewall 2 until the rule processing is complete, and thus the time t 处理 Completely finished 8.
[0039] In order to achieve a time-deterministic behavior, it is now proposed that the data packet 3 arrives in the buffer 6 and is held there until a predetermined time t 最大 The predetermined time is determined by the performance of the firewall and the maximum operating time determined in this case, which may occur in the firewall.
[0040] Relative to Figure 1 , but now is not at time t 最大 Instead of sending a data packet after the expiration, it defines the periodic repetition time t of synchronization 发送 , at which the firewall sends a data packet in a defined manner. This results in a calculable time at which the respective data packet can be sent.
[0041] At time t最大 After the expiration, the data packet 3 is then not sent to the output 7 of the firewall, but is instead buffered further 9', which lasts until the next t 发送 The additional waiting time is t 等待 Definition. When reaching the next t 发送 And therefore at time t 等待 Only after the expiration date does the transmission 10 ′ take place to the firewall 7 and thus to the network 1 .
[0042] Figure 4 Show according to Figure 3 Another variation of the method. At this predetermined time t 最大 It happens to be the time t 发送 , so that no additional buffering 9 has to take place. The data packet 3 can in this case be received immediately, i.e. without applying a waiting time t 等待 10” is transmitted.
[0043] Figure 5 As a block diagram to illustrate the Figure 3 and 4 Here, firstly, a data packet or a data frame is received 11 by the firewall. A time stamp is created here, or in a functionally equivalent manner, the time of reception is ascertained when it reaches the firewall 12. Then, filtering processing 13 by the firewall begins.
[0044] When the filtering process 13 is completed, the time is recorded again as the processing time 14. The processing time is calculated by subtracting the two recorded times, that is, the time when the data packet arrives at the firewall 12 is subtracted from the time after the filtering process 13 is completed. Thus, the processing time 14t is obtained. 处理 .
[0045] Then get the buffer of the data packet and wait until the predetermined time t 最大 After the processing time 14 is calculated, the waiting time is t 最大 With t 处理 The difference between the maximum time and the maximum time is 15t. 最大 The data packet is processed.
[0046] Now wait for the nearest t 发送 The data packet 3 is thus kept in the buffer for a long time. For this purpose, the waiting time t 17 can be determined as follows: 等待 :t 等待 =t 发送 -(t 0 +t 最大 ). Wait for the waiting time described in 18 until the data packet is forwarded.
[0047] Then 16 packets are sent. The packets can then also be deleted from the buffer. The buffer can be located in the firewall or stored externally in other network participants.
[0048] Figure 6 The method according to the invention according to the above-described variant c) is shown as a time diagram. In this case, a data packet 3 from the network 1 is provided to the firewall 2 for checking according to the rules stored in the firewall 2. The arrival time of the data packet is t 0 describe.
[0049] Depending on the number of rules to be processed, the performance of the firewall, and the work consumption of the firewall when the data packet arrives at the input 4 of the firewall, the data packet needs to be processed for a time t 处理 .
[0050] The data packet is therefore held in the processing 5 of the firewall 2 until the rule processing is completed, and thus the time t 处理 Completely finished 8.
[0051] In order to achieve a time-deterministic behavior, it is now provided that the data packet 3 arrives in the buffer 6 where it is initially stored.
[0052] For this purpose, a synchronous, periodically recurring time t is defined 发送 , at which the firewall sends a data packet in a defined manner. This results in a calculable time at which the respective data packet can be sent.
[0053] At time t 处理 After the expiration, the data packet is cached in the buffer 6 9"', and the cache lasts until the next t 发送 The additional waiting time is t 等待 Definition. When reaching the next t 发送 And therefore at time t 等待 Only after the expiration date does the transmission 10 ′ take place to the output 7 of the firewall and thus to the further transmission into the network 1 .
[0054] Compared to Figure 3 and 4 A variation of , in which the waiting time to t is omitted 最大 .
[0055] Figure 7 As a block diagram Figure 6 Here, firstly, a data packet or a data frame is received 11 by the firewall. A time stamp is created here, or in a functionally equivalent manner, the time of reception is ascertained when it reaches the firewall 12. Then, filtering processing 13 by the firewall begins.
[0056] At the end of the filtering process 13, the time is recorded again as the processing time 14. The processing time is calculated by subtracting the two recorded times, that is, the time when the data packet arrives at the firewall 12 is subtracted from the time after the filtering process 13 is completed. Thus, the processing time 14t is obtained. 处理 .
[0057] Now wait for the nearest t 发送 The data packet 3 is held in the buffer for such a long time. For this purpose, the waiting time t 17 can be determined as follows 等待 :t 等待 =t 发送 -(t 0 +t 最大 ). Wait for the waiting time described in 18 until the data packet is forwarded.
[0058] Then 16 packets are sent. The packets can then also be deleted from the buffer. The buffer can be located in the firewall or stored externally in other network participants.
[0059] Reference numerals list
[0060] 1 Network
[0061] 2 Firewall
[0062] 3 Data Packets
[0063] 4 Input
[0064] 5. Processing
[0065] 6 Buffer
[0066] 7 Output
[0067] 8 End rule processing
[0068] 9 Start caching
[0069] 9' Additional Cache
[0070] 9” No additional buffer
[0071] 9"' Cache until sending time
[0072] 10 Transmission
[0073] 10' Transmit after waiting time
[0074] 10” transmission without waiting time
[0075] 10"' Transmission after waiting time
[0076] 11. Receive
[0077] 12 Arrival
[0078] 13 Filtration
[0079] 14 Processing Time
[0080] 15 Maximum time
[0081] 16 Send
[0082] 17 Determine the waiting time
[0083] 18 Waiting time
Claims
1. A method for causing a data packet (3) in a network (1) to arrive at a receiver at a predetermined time, Using a firewall (2) in a computer network (1), It is characterized in that Allocate a time budget for processing in the firewall (2) to each packet (3), The corresponding data packet (3) is sent only after the time budget has expired. Therein, the time budget is defined based on the maximum possible processing time in the firewall (2).
2. The method according to claim 1, characterized in that The processing time of the firewall (2) includes the time from the input (4) of the data packet (3) at the firewall (2) to the processing (5) to the output (7) of the data packet at the firewall (2).
3. The method according to claim 2, characterized in that The processing time additionally includes a buffering time during which the data packet (3) is held in a buffer (6).
4. The method according to any one of claims 1 to 3, characterized in that The time budget for processing a data packet (3) in the firewall (2) corresponds to a definable maximum time (15) which is greater than a maximum foreseeable processing time (14).
5. The method according to claim 4, characterized in that After expiration of a defined maximum time (15), the data packet (3) is sent (16) to an output (7) of the firewall (3).
6. The method according to any one of claims 1 to 5, characterized in that Periodically recurring sending times are defined, and the sending (16) of data packets (15) to the output (7) of the firewall (3) takes place only at these sending times.
7. The method according to claim 6, characterized in that The time budget for processing a data packet (3) in the firewall (2) corresponds to: a definable maximum time (15), which is greater than the maximum expected processing time (14); and a waiting time, which is determined by the time after the processing time (14) until the next sending time (17).
8. The method according to claim 7, characterized in that After expiration of the defined maximum time (15) and the waiting time, the data packet (3) is sent (16) to the output (7) of the firewall (2).
9. The method according to claim 7 or 8, characterized in that: In the case where the expiration of the maximum time (15) coincides with the sending time, the waiting time is equal to 0.
10. The method according to claim 6, characterized in that The time budget for processing a data packet (3) in the firewall (2) corresponds to a processing time (14) and a waiting time which is determined by the time (17) after the processing time (14) until the next sending time.
11. The method according to claim 10, characterized in that After the processing time (14) and the waiting time have expired, the data packet (3) is sent (16) to the output (7) of the firewall (2).
12. The method according to any one of claims 1 to 11, characterized in that The time detection of the data packet (3) is performed when it arrives (12) at the input (4) of the firewall (2).
13. The method according to any one of claims 1 to 12, characterized in that The processing time (14) corresponds to the time required for the firewall (2) to perform the filtering process (13) on the data packet (3).
14. The method according to any one of claims 1 to 13, characterized in that The buffer (6) is arranged in the firewall (2).