Prioritisation for time-deterministic firewalls
Patent Information
- Application Number
- EP2023706328
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2022-02-18
- Filing Date
- 2023-02-17
- Publication Date
- 2024-12-25
AI Technical Summary
Firewalls in computer networks face challenges in processing time-critical packets due to varying processing times and high loads, leading to excessive delays and packet accumulation, as they lack time budgets and prioritize packets inadequately.
Implementing a method with a firewall and buffer system that prioritizes packets based on urgency, interrupting lower-priority packet processing when a high-priority packet arrives, storing them in a buffer for later completion, and resuming processing after higher-priority packets are handled, allowing for defined time budgets and rule positions to manage interruptions.
Ensures timely delivery of time-critical packets by prioritizing processing, reducing latency and intermittent packet processing, and enabling accurate prediction and planning of packet flows in networks.
Smart Images
Figure 1.1
Abstract
Description
[0001] Prioritization for time-deterministic firewalls
[0002] DESCRIPTION
[0003] The present invention relates to a method for implementing prioritization for time-deterministic firewalls.
[0004] Firewalls are required in computer networks to filter the data packets sent in the network and to forward or discard them according to rules.
[0005] Packet filters (firewalls, switches with ACL rules) examine packets and make decisions based on a set of rules. The increasing volume of real-time traffic requires firewalls to process packets in real time (i.e., with a specified delay or processing time). The available time budget may be too small to fully analyze the packet against all firewall rules. This can be due to the firewall's load (e.g., the firewall takes too long because other processing operations have priority) or to parallel processes on the firewall (the CPU is being used for something else).
[0006] Today, firewalls do not have time budgets. This leads to firewalls forwarding packets with excessive delay / latency, causing time-critical packets to arrive late at their destination in the network. Likewise, highly variable processing times cause problems, as they can lead to bursty packet processing and packet backlogs. A constant processing time is therefore advantageous in many cases, especially for the accurate prediction and planning of packet flows in the network. To date, this problem has not been examined in depth in research, as firewalls have not been used in conjunction with time-critical traffic. This invention describes a method for dealing with this situation.
[0007] The object of the present invention is therefore to implement a method for ensuring that time-critical packets arrive at the recipient in a timely manner. Accordingly, the invention sets out to provide a method for time-deterministic firewalls.
[0008] This problem is solved by the features of the main claim.
[0009] For this purpose, a method is proposed using a computer network, a firewall, and a cache in the firewall.
[0010] According to the procedure, each data packet is first assigned a prioritization. The data packet is then sent as usual after the filter rules have been fully processed in the firewall.
[0011] During packet filtering, it can happen that a low-priority packet is already being filtered while a high-priority packet arrives at the firewall. In this case, the slow packet delays the processing of the high-priority packet. This can be prevented by using a buffer to interrupt processing of the slow packet when an urgent packet arrives and resume processing later.
[0012] To this end, the firewall monitors incoming packets and queues them (this is still quite normal behavior). If a high-priority packet is received while a lower-priority packet is already being filtered, the high-priority packet can be filtered with priority by a) placing it at the top of the queue and b) pausing processing of the lower-priority packet.
[0013] Processing of the low-priority data packet is interrupted upon receipt of a high-priority data packet while filtering is still in progress. The low-priority packet is then written to a buffer with a note of the last rule tested. Filtering is then aborted. The high-priority packet can now be filtered directly.
[0014] Once the high-priority data packet has been finally processed by the firewall, processing of the low-priority data packet in the buffer can continue.
[0015] If other high-priority packets are present, these can also be filtered with priority. After all priority-filtered packets have been filtered, filtering of the lower-priority packet can be resumed at the point of interruption. Any time constraints can be taken into account when deciding how long the lower-priority packet can be parked in the buffer.
[0016] It is also possible to specify a rule position at which no further interruptions should occur. This prevents a low-priority packet, for example, which is at position 99 out of 100 in the processing of rules, from being buffered with greater effort due to a single remaining rule.
[0017] The prioritization of data packets can be determined based on the network's traffic class (LAN, WAN, etc.). Prioritization can also be determined based on a property of the data packet (size, content, etc.). Prioritization based on origin or destination is also conceivable (port, network, VLAN, etc.).
[0018] Further features are shown in the attached figures.
[0019] Figure 1 : Timing diagram for packet filtering with two differently prioritized data packets;
[0020] Figure 2: Time diagram for packet filtering with three differently prioritized
[0021] data packets;
[0022] Figure 3: Time diagram for packet filtering with four differently prioritized data packets; Figure 1 shows a method according to the invention with a firewall 2 in a network 1. The firewall 2 contains definable rules according to which incoming data packets 3 are examined. Depending on the result of the examination, a firewall action is subsequently executed, which can include sending the data packets 3 or discarding them.
[0023] The first data packet 3 arriving at input 4 of firewall 2 is forwarded to processing 5. Processing 5 involves executing the rules defined in the firewall. The time at which rule processing begins is recorded as processing start 7.
[0024] Depending on the workload of the firewall, its performance and the number of data packets to be processed 3, 3', the processing of the filter rules requires a certain amount of time, which can vary and with t process is defined, t process0 is thus defined for data packet 3.
[0025] According to current firewalls, after processing, a data packet is forwarded to output 6 of firewall 2, depending on the result of the processing, and thus sent to network 1, or data packet 3 is discarded. Another conceivable firewall action would be to mark the data packet.
[0026] According to the invention, each data packet is assigned a priority for processing in the firewall. This can depend on the source from which the data packet was sent, the destination to which it is to be sent, or the class of the network. In an automation network, for example, connected controllers are more time-critical than normal network devices, such as monitoring devices or PCs.
[0027] If a data packet 3' with a higher priority is received at the input 4 of the firewall 2 than the data packet 3 currently being processed 5, the processing 5 of the rules for the data packet 3 with the lower priority is interrupted according to the invention. The processing 5 of data packet 3 is paused, and the processing 5 of data packet 3' begins 8. To allow the processing of a data packet 3 to be interrupted and resumed later, it is proposed to integrate a buffer into the firewall 2. Data packet 3 and other data packets can be stored here as long as they are not currently being processed 5.
[0028] Processing 5 takes time t for the high-priority data packet 3' process1.After all rules for data packet 3' have been processed by processing 5 in firewall 2, processing end 9 is reached. Depending on the result of the processing, a firewall action is now performed, which could, for example, be forwarding data packet 3' to the output of firewall 2.
[0029] After the high-priority data packet 3' has been processed, the data packet 3 can now be retrieved from the buffer and forwarded to further processing 5. Processing 5 is continued at the point 7' where it was aborted. Therefore, not all rules are processed, but only those rules that have not yet been processed. This means that only the time difference, which is given by t process0 and the processing time required so far for data packet 3 (t1-t0).
[0030] Afterwards, old rules are also processed for data packet 3 and according to the result of the processing, a firewall action is now carried out, which can be, for example, forwarding data packet 3 to the output of firewall 2,
[0031] Figure 2 shows a method according to the invention with a firewall 2 in a network 1, but with three data packets 3, 3', 3" with increasing priority. The firewall 2 contains definable rules according to which incoming data packets 3 are examined. Depending on the result of the examination, a firewall action is subsequently executed, which may include sending the data packets 3 or discarding the data packets 3.
[0032] The first data packet 3 arriving at input 4 of firewall 2 is forwarded to processing 5. Processing 5 involves processing the rules defined in the firewall. Depending on the firewall's workload, its performance, and the number of data packets 3, 3', 3", to be processed, processing the filter rules requires a certain amount of time, which can vary and is determined by t process is defined. t process0 refers to the processing time for data packet 3.
[0033] If a data packet 3' with a higher priority is received at input 4 of firewall 2 than the data packet 3 currently being processed, the processing of the rules for the data packet 3 with the lower priority is interrupted. Processing of data packet 3 is paused, and processing of data packet 3' begins. The processing time required for data packet 3 to date is defined as tprocesso.i.
[0034] In order to interrupt the processing of a data packet 3 and resume it later, it is proposed to integrate a buffer into the firewall 2. The data packet 3 and other data packets can be stored here as long as they are not currently being processed 5. Processing 5 for the higher-priority data packet 3' takes the time tprocess1.1. If a data packet 3" with a higher priority is received at the input 4 of the firewall 2 than the data packet 3' currently being processed 5, the processing 5 of the rules for the data packet 3' is interrupted according to the invention. Processing 5 of data packet 3' is paused and processing 5 of data packet 3" begins. The processing time required so far for data packet 3' is defined as tprocessi.i.
[0035] To ensure that the processing of a data packet 3' can also be interrupted and resumed later, it is suggested that the data packet 3' also be stored in the buffer. Data packet 3' and other data packets can be stored here as long as they are not currently being processed.
[0036] After all rules have been processed by processing 5 in firewall 2 for data packet 3, the end of processing is reached. Depending on the result of the processing, a firewall action is now performed, which could, for example, be forwarding data packet 3 to the output of firewall 2. The processing time for data packet 3 is defined as t process2 defined.
[0037] After the high-priority data packet 3" has been processed, the next higher-priority data packet 3' can now be taken from the buffer and forwarded to further processing 5. Processing 5 is continued at the point where it was aborted. Old rules are no longer processed, but only the rules that have not yet been processed. This means that only the time difference tprocess1.2 is required, which is given by t process1 and the processing time required so far for data packet 3' tprocess1.1 is defined.
[0038] Afterwards, all rules for data packet 3' are also processed and, depending on the result of the processing, a firewall action is now carried out, which could, for example, be forwarding data packet 3' to the output of firewall 2.
[0039] After the higher-priority data packet 3' has been processed, the lower-priority data packet 3 can now be retrieved from the buffer and forwarded to further processing 5. Processing 5 is continued at the point where it was interrupted. Therefore, not all rules are processed, but only those that have not yet been processed. This means that only the time difference tprocess0.2 is required, which is given by t process0 and the processing time required so far for data packet 3 tprocess0.1 is defined.
[0040] Afterwards, all rules for data packet 3 are also processed and, depending on the result of the processing, a firewall action is now carried out, which could, for example, be forwarding data packet 3 to the output of firewall 2.
[0041] Figure 3 shows a method according to the invention with a firewall 2 in a network 1, but with four data packets 3, 3', 3", 3'" with different priorities. The data packet 3" is the highest priority, data packet 3' the next highest priority, data packet 3'" is the second lowest priority, and data packet 3 the lowest priority. The firewall 2 contains definable rules according to which incoming data packets 3 are examined. Depending on the result of the examination, a firewall action is subsequently executed, which can include sending the data packets 3 or discarding the data packets 3.
[0042] The first data packet 3 arriving at input 4 of firewall 2 is forwarded to processing 5. Processing 5 involves executing the rules defined in the firewall.
[0043] Depending on the workload of the firewall, its performance and the number of data packets to be processed 3, 3', 3", 3"', the processing of the filter rules requires a certain amount of time, which can vary and with t process is defined, t process0 refers to the processing time for data packet 3.
[0044] If a data packet 3' with a higher priority is received at input 4 of firewall 2 than the data packet 3 currently being processed, the processing of the rules for the data packet 3 with the lower priority is interrupted. Processing of data packet 3 is paused, and processing of data packet 3' begins. The processing time required for data packet 3 is defined as tprocess0.1.
[0045] To allow the processing of a data packet 3 to be interrupted and resumed later, it is proposed to integrate a buffer into firewall 2. Data packet 3 and other data packets can be stored here as long as they are not currently being processed.
[0046] If a data packet 3" with a higher priority is received at input 4 of firewall 2 than the data packet 3' currently being processed 5, the processing 5 of the rules for the data packet 3' with the lower priority is interrupted according to the invention. The processing 5 of data packet 3' is paused, and the processing 5 of data packet 3" begins. The processing time required so far for data packet 3' is defined as tprocess1.1.
[0047] In order to interrupt the processing of a data packet 3' and to resume it later, it is suggested that the data packet 3 and other data packets be stored in the buffer as long as they are not in processing 5.
[0048] If a data packet 3'" with a lower priority is received at input 4 of firewall 2 than the data packet 3" which is currently being processed 5, the processing is not interrupted and the data packet 3'" is stored in the buffer for later processing.
[0049] Advantageously, it is proposed to store the previous processing times and / or the rules already processed for the data packets in the buffer in order to be able to determine the rules still to be processed when the data packets are removed from the buffer.
[0050] After all rules have been processed by processing 5 in firewall 2 for data packet 3, the end of processing is reached. Depending on the result of the processing, a firewall action is now performed, which could, for example, be forwarding data packet 3 to the output of firewall 2. The processing time for data packet 3 is defined as t process2 defined.
[0051] After the high-priority data packet 3 has been processed, the next higher-priority data packet 3' can now be retrieved from the buffer and forwarded to further processing 5. Processing 5 is continued at the point where it was interrupted. Therefore, not all rules are processed now, but only the previously unprocessed rules. This means that only the difference in time tprocess1.2, which is defined by tprocess1 and the previously required processing time for data packet 3' tprocess1.1, is required.
[0052] Afterwards, old rules are also processed for data packet 3' and, depending on the result of the processing, a firewall action is now carried out, which could, for example, be forwarding data packet 3' to the output of firewall 2.
[0053] After the data packet 3' has been processed, the next higher priority data packet 3'" can now be taken from the buffer and forwarded to further processing 5. For this purpose, processing 5 is started from the beginning, since the data packet 3"' has not yet been processed. This means that the full processing time t process3 needed.
[0054] Subsequently, all rules for data packet 3'" are also processed and, depending on the result of the processing, a firewall action is now carried out, which could, for example, be forwarding data packet 3'" to the output of firewall 2.
[0055] After data packet 3 has been processed, the lowest-priority data packet 3 can now be taken from the buffer and forwarded to further processing 5. Processing 5 is continued at the point where it was aborted. Therefore, not all rules are processed anymore, but only the rules that have not yet been processed. Therefore, only the time difference tprocess0.2 is required, which is given by t process0 and the processing time required so far for data packet 3 tprocess0.1 is defined.
[0056] Afterwards, all rules for data packet 3 are also processed and, depending on the result of the processing, a firewall action is now carried out, which could, for example, be forwarding data packet 3 to the output of firewall 2.
[0057] LIST OF REFERENCE SYMBOLS 1 Network 2 Firewall 3 Data packet 3' Data packet 3" Data packet 3 ''' Data packet 4 Input 5 Processing 6 Output 7 Start of processing of 3 7' Continue processing of 7 8 Pause of 3, Start of processing of 3' 9 End of processing of 3' 10 End of processing of 3
Claims
PATENT CLAIMS 1. Method to convert data packets (3, 3', 3", 3'") in a network (1 ) into definable to allow data packets to arrive at the receiver at specific times, using a firewall (2) in a computer network (1) which includes filter rules, with a buffer in the firewall (2), characterized in that each data packet is assigned a priority for processing in the firewall (2), that a firewall action is provided for the respective data packet (3, 3', 3", 3'") after the processing of the filter rules has finished, wherein the processing of the filter rules is interrupted as soon as another data packet (3', 3", 3'") with a higher priority than the priority of the currently processed data packet (3, 3', 3'') arrives at the firewall and the data packet (3, 3', 3*") for which processing was interrupted is stored in the buffer for later processing.
2. Method according to claim 1, characterized in that the firewall action includes forwarding the data packet (3, 3', 3", 3"') to an output of the firewall (2) 3. Method according to claim 1, characterized in that the firewall action includes discarding the data packet (3, 3', 3", 3'').
4. Method according to one of claims 1 to 3, characterized in that the firewall action includes marking the data packet (3, 3', 3“, 3'").
5. Method according to claim 4, characterized in that the marking includes the outstanding filter rules which have not yet been processed by the firewall (2).
6. Method according to one of claims 1 to 5, characterized in that a respective data packet (3, 3', 3'") is deleted from the intermediate storage after removal from it.
7. Method according to one of claims 1 to 6, characterized in that the data packets (3, 3', 3“, 3'“) are time-stamped upon arrival at the entrance (4) of the firewall (2).
8. Method according to one of claims 1 to 7, characterized in that the data packets (3, 3', 3'") stored in the buffer are ordered according to their prioritization.
9. Method according to one of claims 1 to 8, characterized in that the prioritization of the data packets (3, 3', 3", 3"') is carried out by the firewall.
10. Method according to one of claims 1 to 8, characterized in that the prioritization of the data packets (3, 3', 3", 3"") is carried out by further network participants.
11. Method according to one of claims 1 to 10, characterized in that the prioritization is added to the data packet (3, 3', 3", 3'“).
12. Method according to one of claims 1 to 11, characterized in that several processing operations (5) are carried out simultaneously through the firewall (2).
13. Method according to claim 12, characterized in that the processing of a data packet is interrupted when one of the processing operations (5) processes a lower priority data packet.
14. Method according to one of claims 1 to 13, characterized in that the intermediate storage is designed as non-volatile storage.