Priority differentiation for time-decided firewalls
By assigning priority to firewall packets and using buffers to process high priority packets, the problem of high latency and unstable processing during packets with strict processing time requirements is solved, and timely packet arrival and processing efficiency is achieved Improvement.
Patent Information
- Application Number
- CN202380020849.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-02-18
- Filing Date
- 2023-02-17
- Publication Date
- 2025-02-11
AI Technical Summary
When existing firewalls have strict processing time requirements, the delay and unstable processing time are high, resulting in delays in packets reaching the receiver, resulting in impact packet processing and congestion problems.
By assigning priority to each packet and introducing a buffer into the firewall, high-priority packets are processed first, low-priority packet processing is interrupted, and the processing of low-priority packets is saved in the buffer, and after the processing of high-priority packets is completed, it is possible to complete the processing of high-priority packets. Continue to process low-priority packets.
It realizes timely arrival of packets with strict time requirements to the receiver, reducing the instability of packet delay and processing time, and avoids impact packet processing and congestion problems.
Smart Images
Figure CN119422350A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a method for implementing a prioritization for a time-determined firewall. Background Art
[0002] In computer networks, firewalls are needed to filter data packets sent in the network and pass or discard the data packets according to the rules.
[0003] Packet filters (firewalls, switches with ACL rules) consider the data packets and make decisions based on the rules. The enhancement of real-time communication occurs when the firewall is also able to process the data packets in real time (i.e. with a predetermined delay or processing time). The available time budget may be too small for a complete analysis of the data packets with respect to all firewall rules. This can be related to the load on the firewall (e.g. the firewall takes too long because other computing operations are prioritized) or parallel processing on the firewall (the CPU is used for other things, for example).
[0004] Today, firewalls have no knowledge of time budgets. This results in the firewall passing on data packets with high delays / latencies and time-critical data packets arriving too late at the receiver in the network. Strongly varying processing times also cause problems, since this can lead to bursty packet processing and packet jams. Constant processing times are therefore advantageous in many cases, in particular for the accurate prediction and planning of packet flows in the network.
[0005] To date, this problem has not been considered more intensively in research because firewalls have not been used in conjunction with time-critical communications. The present invention describes a method for dealing with this situation. Summary of the invention
[0006] The object of the present invention is therefore to provide a method for ensuring that time-critical data packets arrive at a receiver in a timely manner. Accordingly, the present invention has the object of providing a method for a time-critical firewall.
[0007] This object is achieved by the features of the independent claims.
[0008] To this end, a method is proposed having a computer network, a firewall, and a buffer in the firewall.
[0009] According to this method, each data packet is first assigned a priority. The data packets are to be sent in the firewall after complete processing of the filter rules, as is conventional.
[0010] During packet filtering, it can happen that packets with a low priority are already being filtered, while packets with a high priority appear at the firewall. In this case, the slow packets postpone the processing of the high-priority packets. This can be prevented by interrupting the processing of the slow packets with a buffer when urgent packets appear and continuing the processing afterwards.
[0011] For this purpose, the firewall observes incoming packets and places them in a waiting queue (this is still a completely normal behavior). If a packet with a high priority is now received, while packets with a low priority are already being filtered, the high priority packet can be filtered first by a) placing the high priority packet at the head of the waiting queue and b) stopping the processing of packets with a low priority.
[0012] If filtering is still ongoing, the processing of the low-priority data packets is interrupted when a high-priority data packet is received. The low-priority data packet is then written to the buffer together with the note of the last rule tested. The filtering is then interrupted. The high-priority data packets can now be filtered directly.
[0013] If the data packet with a high priority is finally processed by the firewall, the processing of the data packet with a low priority located in the buffer can continue.
[0014] If there are other data packets with a higher priority, then these other data packets with a higher priority can also be filtered with priority. After the filtering of all the data packets filtered with priority is completed, the filtering of the data packets with a lower priority can be resumed at the interrupted position. A possible time budget can be taken into account for the decision of how long the data packets with a lower priority can be stored in the buffer.
[0015] It is also possible to determine the following rule position from which no interruption should occur. This can avoid that a data packet with a low priority (which is located at position 99 in 100 in the rule processing, for example) is buffered at a high cost based on the only remaining rule.
[0016] Data packets can be prioritized based on the type of communication in the network (LAN, WAN, etc.). It is also possible to prioritize based on the characteristics of the data packets (size, content, etc.). Determination based on the source or destination is also conceivable (port, network, VLAN, etc.). BRIEF DESCRIPTION OF THE DRAWINGS
[0017] Further features are apparent from the accompanying drawings. In the drawings:
[0018] Figure 1 A time diagram showing packet filtering for packets having two different priorities;
[0019] Figure 2 A time diagram showing packet filtering for packets having three different priorities;
[0020] Figure 3 A time diagram is shown for packet filtering of packets having four different priorities. DETAILED DESCRIPTION
[0021] Figure 1 The method according to the invention is shown with a firewall 2 in a network 1. The firewall 2 contains definable rules according to which incoming data packets 3 are checked. Depending on the result of the check, a firewall action is then performed, which may include sending the data packet 3 or discarding the data packet 3.
[0022] The first data packet 3 arriving at the input 4 of the firewall 2 is passed for processing 5. The processing 5 comprises the processing of rules that have been defined in the firewall. The moment when the processing of the rules is started is recorded as processing start 7.
[0023] Depending on the workload of the firewall, its power capabilities and the number of data packets 3, 3' to be processed, the processing of the filter rules requires a certain time, which can vary and is expressed in t process Definition. So define t process0 For data pack 3.
[0024] According to previous firewalls, after the processing is completed, the data packet is passed to the output 6 of the firewall 2 depending on the result of the processing and thus sent to the network 1, or the data packet 3 is discarded. Marking of the data packet is also conceivable as a firewall action.
[0025] According to the invention, each data packet is now assigned a priority for processing in the firewall. This can be related to which source sends the data packet, to which destination the data packet is to be sent, or to the type of network. In automation networks, for example, connected controllers have more stringent time requirements than ordinary network participants, such as monitoring participants or PCs.
[0026] If a data packet 3' with a higher priority than the data packet 3 being processed 5 is now received at the input 4 of the firewall 2, then according to the invention the rule processing 5 for the data packet 3 with the lower priority is interrupted. The processing 5 of the data packet 3 is suspended and the processing 5 of the data packet 3' is started 8.
[0027] In order to be able to interrupt the processing of the data packet 3 and to be able to carry it out again later, it is proposed to integrate a buffer into the firewall 2. The data packet 3 and other data packets can be stored here, as long as these data packets are not in the processing 5.
[0028] Process 5 for a packet with high priority 3' duration t process1 After all rules have been processed by the process 5 in the firewall 2 for the data packet 3 ′, the process ends 9 . Depending on the result of the process, a firewall action is now carried out, which may be, for example, the forwarding of the data packet 3 ′ to the output of the firewall 2 .
[0029] After processing the data packet 3' with a high priority, the data packet 3 can now be retrieved from the buffer and made available for further processing 5. For this purpose, processing 5 is continued 7' at the point of interruption. That is, now all rules are no longer processed, but only the rules that have not been processed so far. As a result, only the following time difference is now required, which is calculated from t process0 The processing time (t1-t0) required so far for data packet 3 is defined.
[0030] All rules are then also processed for data packet 3 and, depending on the result of the processing, a firewall action is now carried out, which may be, for example, the forwarding of data packet 3 to the output of firewall 2 .
[0031] Figure 2 The method according to the invention is shown with a firewall 2 in a network 1, but with three data packets 3, 3', 3" with increasing priority. The firewall 2 contains definable rules, according to which the incoming data packets 3 are checked. Depending on the result of the check, a firewall action is then carried out, which can include sending the data packet 3 or discarding the data packet 3.
[0032] A first data packet 3 arriving at the input 4 of the firewall 2 is passed on for processing 5. Processing 5 comprises the processing of rules that have been defined in the firewall.
[0033] Depending on the workload of the firewall, its power capabilities and the number of data packets 3, 3', 3'' to be processed, the processing of the filter rules requires a certain time, which can vary and is expressed in t process Definition. process0 Here, the processing time for data packet 3 is indicated.
[0034] If a data packet 3' with a higher priority than the data packet 3 being processed 5 is now received at the input 4 of the firewall 2, then according to the invention the rule processing 5 for the data packet 3 with the lower priority is interrupted. The processing 5 of the data packet 3 is suspended and the processing 5 of the data packet 3' is started. The processing time required so far for the data packet 3 is defined as tprocess0.1 .
[0035] In order to be able to interrupt the processing of the data packet 3 and to be able to carry it out again later, it is proposed to integrate a buffer into the firewall 2. The data packet 3 and other data packets can be stored here, as long as these data packets are not in the processing 5.
[0036] Process 5 for higher priority packets 3' duration t process1.1 If a data packet 3'' is now received at the input 4 of the firewall 2 with a higher priority than the data packet 3' being processed 5, then according to the invention the rule processing 5 for the data packet 3' is interrupted. The processing 5 of the data packet 3' is suspended and the processing 5 of the data packet 3' is started. The processing time required so far for the data packet 3' is defined as t process1.1 .
[0037] In order to also be able to interrupt the processing of a data packet 3 ′ and to be able to resume it later, it is proposed to also store the data packet 3 ′ in a buffer. The data packet 3 ′ and further data packets can be stored here, provided that these are not in the processing 5 .
[0038] After all rules have been processed by the process 5 in the firewall 2 for the data packet 3 ″, the end of the process is achieved. Depending on the result of the process, a firewall action is now carried out, which can be, for example, the data packet 3 ″ being passed to the output of the firewall 2 . The processing time for the data packet 3 ″ is defined as t process2 .
[0039] After processing the data packet 3 ″ with the highest priority, the data packet 3 ′ with the second highest priority can now be retrieved from the buffer and made available for further processing 5. For this purpose, the processing 5 is continued at the point of interruption. That is, now all rules are no longer processed, but only the rules that have not been processed so far. Therefore, only the following time difference t is now required: process1.2 , the time difference is t process1 and the processing time t required so far for data packet 3' process1.1 definition.
[0040] All rules are then also processed for the data packet 3 ′ and, depending on the result of the processing, a firewall action is now carried out, which may be, for example, the forwarding of the data packet 3 ′ to the output of the firewall 2 .
[0041] After processing the data packet 3' with a high priority, the data packet 3 with a low priority can now be retrieved from the buffer and provided for further processing 5. For this purpose, the processing 5 is continued at the point of interruption. That is, now all rules are no longer processed, but only the rules that have not been processed so far. Therefore, only the following time difference t is now requiredprocess0.2 , the time difference is t process0 and the processing time t required so far for data packet 3 process0.1 definition.
[0042] All rules are then also processed for data packet 3 and, depending on the result of the processing, a firewall action is now carried out, which may be, for example, the forwarding of data packet 3 to the output of firewall 2 .
[0043] Figure 3 The method according to the invention is shown with a firewall 2 in a network 1, but with four data packets 3, 3', 3", 3''' with different priorities. Data packet 3'' is the data packet with the highest priority, data packet 3' is the data packet with the second highest priority, data packet 3''' is the data packet with the second lowest priority, and data packet 3 is the data packet with the lowest priority. The firewall 2 contains definable rules, according to which the incoming data packets 3 are checked. Depending on the result of the check, a firewall action is then carried out, which can include sending the data packet 3 or discarding the data packet 3.
[0044] A first data packet 3 arriving at the input 4 of the firewall 2 is passed on for processing 5. Processing 5 comprises the processing of rules that have been defined in the firewall.
[0045] Depending on the workload of the firewall, its power capabilities and the number of data packets 3, 3', 3", 3''' to be processed, the processing of the filter rules requires a certain time, which can vary and is expressed in t process Definition. process0 Here, the processing time for data packet 3 is indicated.
[0046] If a data packet 3' with a higher priority than the data packet 3 being processed 5 is now received at the input 4 of the firewall 2, then according to the invention the rule processing 5 for the data packet 3 with the lower priority is interrupted. The processing 5 of the data packet 3 is suspended and the processing 5 of the data packet 3' is started. The processing time required so far for the data packet 3 is defined as t process0.1 .
[0047] In order to be able to interrupt the processing of the data packet 3 and to be able to carry it out again later, it is proposed to integrate a buffer into the firewall 2. The data packet 3 and other data packets can be stored here, as long as these data packets are not in the processing 5.
[0048] If a data packet 3'' with a higher priority than the data packet 3' currently being processed 5 is now received at the input 4 of the firewall 2, then according to the invention the rule processing 5 for the data packet 3' with the lower priority is interrupted. The processing 5 of the data packet 3' is suspended and the processing 5 of the data packet 3' is started. The processing time required so far for the data packet 3' is defined as t process1.1 .
[0049] In order to be able to interrupt the processing of a data packet 3 ′ and to be able to resume it later, it is proposed to store the data packet 3 ′ and further data packets in a buffer, provided that these are not in the processing 5 .
[0050] If a data packet 3 ''' is now received at the input 4 of the firewall 2 which has a lower priority than the data packet 3 '' being processed 5 , the processing is not interrupted and the data packet 3 ''' is stored in a buffer for later processing.
[0051] Advantageously, provision is made for each data packet in the buffer to store the previous processing time and / or the rules already processed, in order to be able to determine the rules still to be processed when a data packet is removed from the buffer.
[0052] After all rules have been processed by the process 5 in the firewall 2 for the data packet 3 ″, the end of the process is achieved. Depending on the result of the process, a firewall action is now carried out, which can be, for example, the data packet 3 ″ being passed to the output of the firewall 2 . The processing time for the data packet 3 ″ is defined as t process2 .
[0053] After processing the data packet 3 ″ with the highest priority, the data packet 3 ′ with the second highest priority can now be retrieved from the buffer and made available for further processing 5. For this purpose, the processing 5 is continued at the point of interruption. This means that now all rules are no longer processed, but only the rules that have not been processed so far. As a result, only the time difference t process1.2 , the time difference is t process1 and the processing time t required so far for data packet 3' process1.1 definition.
[0054] All rules are then also processed for the data packet 3 ′ and, depending on the result of the processing, a firewall action is now carried out, which may be, for example, the forwarding of the data packet 3 ′ to the output of the firewall 2 .
[0055] After processing the data packet 3', the data packet 3'"' with the next highest priority can now be retrieved from the buffer and made available for further processing 5. For this purpose, the processing 5 is started from the beginning, since no data packet 3'"' has been processed so far. The complete processing time t is now required. process3.
[0056] All rules are then also processed for the data packet 3 ′″ and, depending on the result of the processing, a firewall action is now carried out, which can be, for example, the forwarding of the data packet 3 ′″ to the output of the firewall 2 .
[0057] After processing the data packet 3''', the data packet 3 with the lowest priority can now be retrieved from the buffer and made available for further processing 5. For this purpose, processing 5 is continued at the point of interruption. That is, now all rules are no longer processed, but only the rules that have not been processed so far. As a result, only the following time difference t is now required: process0.2 , the time difference is t process0 and the processing time t required so far for data packet 3 process0.1 definition.
[0058] All rules are then also processed for data packet 3 and, depending on the result of the processing, a firewall action is now carried out, which may be, for example, the forwarding of data packet 3 to the output of firewall 2 .
[0059] Reference numerals list
[0060] 1 Network
[0061] 2 Firewall
[0062] 3 Data Packets
[0063] 3' Data Pack
[0064] 3'' Data Pack
[0065] 3''' Data Packet
[0066] 4 Input
[0067] 5. Processing
[0068] 6 Output
[0069] 7 3 Processing starts
[0070] 7' Continue processing 7
[0071] 8 3 pause, 3' processing starts
[0072] 9 3' processing is completed
[0073] 10 3 processing is completed
Claims
1. A method for ensuring that data packets (3, 3', 3", 3''') in a network (1) arrive at a receiver at a determinable time, comprising a firewall (2) in the computer network (1) which contains filter rules and a buffer in the firewall (2), It is characterized in that Assigning each packet a priority for processing in the firewall (2), After the filtering rules are processed, the firewall action is set for the corresponding data packet (3, 3', 3'', 3'''), Once another data packet (3', 3'', 3''') with a higher priority than the data packet (3, 3', 3''') being processed appears at the firewall, the processing of the filtering rule is interrupted, and the data packet (3, 3', 3''') targeted by the interrupted processing is stored in the buffer for subsequent processing.
2. The method according to claim 1, characterized in that The firewall action includes passing the data packet (3, 3', 3'', 3''') to the output port of the firewall (2).
3. The method according to claim 1, characterized in that The firewall action includes dropping the packet (3, 3', 3'', 3''').
4. The method according to any one of claims 1 to 3, characterized in that The firewall action includes marking the packet (3, 3', 3'', 3''').
5. The method according to claim 4, characterized in that The tag contains filter rules that are still pending and have not yet been processed by the firewall (2).
6. The method according to any one of claims 1 to 5, characterized in that The corresponding data packet (3, 3', 3''') is deleted from the buffer after being taken out from the buffer.
7. The method according to any one of claims 1 to 6, characterized in that The data packets (3, 3', 3'', 3''') are time-checked when arriving at the input (4) of the firewall (2).
8. The method according to any one of claims 1 to 7, characterized in that The data packets (3, 3', 3''') stored in the buffer are sorted according to their priorities.
9. The method according to any one of claims 1 to 8, characterized in that Prioritization of packets (3, 3', 3'', 3''') is achieved through the firewall.
10. The method according to any one of claims 1 to 8, characterized in that The data packets (3, 3', 3'', 3''') are prioritized by other network participants.
11. The method according to any one of claims 1 to 10, characterized in that Add priority to the packet (3, 3', 3'', 3''').
12. The method according to any one of claims 1 to 11, characterized in that Multiple processes (5) are implemented simultaneously through the firewall (2).
13. The method according to claim 12, characterized in that If one of the processes (5) contains a low priority data packet, the processing of the data packet is interrupted.
14. The method according to any one of claims 1 to 13, characterized in that The buffer is constructed as a non-volatile memory.