Packet delays for time-deterministic firewalls
Patent Information
- Application Number
- EP2023706013
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2022-02-18
- Filing Date
- 2023-02-17
- Publication Date
- 2024-12-25
AI Technical Summary
Firewalls in computer networks lack time determinism, leading to variable and often excessive packet processing delays, which can result in late arrival of time-critical packets and unpredictable network traffic, especially with increased real-time traffic loads.
Assigning a time budget to each data packet for processing, ensuring it is only sent after the maximum possible processing time has expired, thereby maintaining a constant and predictable processing time, and using buffering to synchronize packet transmission with defined times or recurring cycles.
This approach ensures time-critical packets arrive on time, maintains deterministic behavior, and allows for accurate prediction and planning of packet flows by ensuring a uniform processing time for all packets within a traffic class, reducing latency and packet accumulation.
Smart Images
Figure 1.1
Abstract
Description
[0001] Packet delays for time-deterministic firewalls
[0002] DESCRIPTION
[0003] The present invention relates to a method for implementing time-deterministic firewalls.
[0004] Firewalls are needed in computer networks to filter the data packets sent in the network and to forward or discard them according to rules,
[0005] Packet filters (firewalls, switches with ACL rules) examine packets and make decisions based on a set of rules. This set of rules can be stored in the firewall.
[0006] The increased volume of real-time traffic requires firewalls to process packets in real time (i.e., with a specified delay or processing time). The available time budget may be too small to fully analyze the packet against all firewall rules. This can be due to the firewall's load (e.g., the firewall takes too long because other processing operations have priority) or to parallel processes on the firewall (the CPU is being used for something else).
[0007] Today, firewalls do not have time budgets. This can lead to firewalls forwarding packets with excessive delay / latency, causing time-critical packets to arrive late at their destination in the network. Likewise, widely varying processing times cause problems, as they can lead to bursty packet processing and packet backlogs. A slower but consistent processing time is therefore advantageous in many cases, especially for the accurate prediction and planning of packet flows in the network. To date, this problem has not been examined in depth in research because firewalls have not been used in conjunction with time-critical traffic. This invention describes a method for dealing with this situation.
[0008] The object of the present invention is therefore to implement a method for ensuring that time-critical packets arrive at the recipient in a timely manner. Accordingly, the invention sets out to provide a method for time-deterministic firewalls.
[0009] This problem is solved by the features of the main claim.
[0010] For this purpose, a method is proposed that ensures that data packets in a network arrive at the receiver at specified times. The goal of the method is to be able to predict the time it takes for a data packet to travel from the sender to the destination, in order to use these defined times to control and predict data traffic in the network.
[0011] For this purpose, the network contains at least one firewall. Each data packet is then assigned a time budget, which is required for processing the data packet in the firewall. The respective data packet is only sent after the time budget has expired. This means that each data packet is only sent after the time budget has expired, regardless of the actual time required for filtering by the firewall.
[0012] The time budget itself is therefore based on the maximum possible processing time in the firewall.
[0013] In order to achieve a uniform processing time for all packets of a traffic class or packet stream, it can be useful to delay packets so long that processing the firewall rules results in a fixed (but increased) time requirement. Due to varying loads on the firewall, no difference in processing time is noticeable externally. This makes the firewall's behavior deterministic and predictable. To achieve this behavior, each packet is assigned a time budget. The time budget is chosen so that the firewall has sufficient capacity to always adhere to it. After processing by the firewall, packets are buffered until the time budget has expired. They are then sent at a defined time.The defined time can be defined according to the following criteria: a) Fixed processing time: Each packet of a traffic class or packet stream has the same processing time t. max When the packet arrives at the firewall, a timestamp t0 of the arrival time is taken and stored. The packet is buffered after processing. The packet is then forwarded after t0 + t max forwarded, t max is chosen so that the processing of the firewall is always completed within the time t max Each package is then stored for a fixed time t maxprocessed. To the outside, the firewall has a constant processing time. b) Timed forwarding with delay: To maintain synchronization with other time-clocked network devices, it can be useful to always send a packet at specific (recurring) times. This is often described as a time in a cycle. In addition to part a), an additional delay can be applied so that the packet is always sent at a recurring, fixed time t. send can take place. For this purpose, after the delay from point a) a variable delay t wait (extended caching) is performed so that t0+ t max + t wait - t send for the next transmission window t send . c) Timed forwarding without delay: In some cases it may be advantageous to have a variable forwarding at specific times without an additional delay of t maxIn these cases, the firewall will have a higher jitter, but it will still transmit at certain times. In this case, the buffering and sending time is chosen as follows: t0 + t process + t wait = t send . The time period t process represents the variable natural processing time of the firewall. The firewall always sends the packet as quickly as possible but at the next defined sending time t send The time period t process can be variable, as it depends on the processing time of the firewall and the number of filter rules.
[0014] The maximum waiting time t max can either be configured for traffic classes or it can be determined based on the packet containing the firewall's matching rules. For this purpose, new rules can be introduced into the firewall, which, as a decision, reallocate a time budget. maxThis allows the time budget to be set differently for different packets using the firewall's rules.
[0015] The time budget for data packets can be allocated based on various criteria. For example, it is possible to set the time budget based on the network's traffic class (LAN, WAN, etc.). Likewise, the time budget can be set based on a property of the data packet (size, content, etc.). Setting the time budget based on the source or destination (port, network, VLAN, etc.) is also conceivable.
[0016] Further features can be seen from the attached figures, which show
[0017] Figure 1 : Time diagram for a transmission delay with fixed processing time;
[0018] Figure 2: Block diagram for Figure 1
[0019] Figure 3: Timing diagram for a transmission delay with clocked forwarding;
[0020] Figure 4: Time diagram according to Figure 3, without additional waiting time;
[0021] Figure 5: Block diagram for Figures 3 and 4;
[0022] Figure 6: Timing diagram according to Figure 3, without transmission delay;
[0023] Figure 7: Block diagram for Figure 6. Figure 1 shows a timing diagram of the inventive method according to the previously described variant a). Here, a data packet 3 in a network 1 is fed to a firewall 2 to be examined according to the rules stored in the firewall 2. The arrival time of the data packet is designated as t0.
[0024] Depending on the number of rules to be processed, the performance of the firewall and the workload of the firewall when the data packet arrives at input 4 of the firewall, the data packet requires a processing time t process .
[0025] The data packet is therefore kept in processing 5 of the firewall 2 until the rules have been processed and thus the time t processwas completely finished 8.
[0026] In order to achieve time-deterministic behavior, it is now introduced that the data packet 3 is transferred to a buffer 6, where it is held until a predetermined time t max has expired. This predetermined time is determined by the performance of the firewall and the maximum working time that can occur in the firewall.
[0027] After the time t max the data packet 3 is then sent to the output 7 of the firewall, so that the data packet is not sent immediately after processing of the firewall 3, but first an intermediate storage begins 9 and after the time t max first the transmission 10 to the output 7 of the firewall and thus further into network 1 takes place.
[0028] Figure 2 illustrates the process shown in Figure 1 as a block diagram. First, a data packet or data frame is received by the firewall 11. A timestamp is created or the time of receipt is determined upon arrival 12 at the firewall in a functionally equivalent manner. The firewall then begins filter processing 13.
[0029] At the end of filter processing 13, the time is again recorded as processing time 14. This is calculated by subtracting the two recorded times, i.e., the time of arrival 12 of the data packet at the firewall is subtracted from the time after the end of filter processing 13. This results in the processing time 14 tp rocess.
[0030] Subsequently, the data packet is temporarily stored and waited until the predetermined time t max has expired. After calculating the processing time 14, the difference between t max and t process waited, so that the data packet is stored for a maximum time of 15 t max was processed in the firewall.
[0031] The data packet is then sent. 16 It can then also be deleted from the cache. The cache can be located in the firewall or stored externally on another network device.
[0032] Figure 3 shows a time diagram of the inventive method according to the previously described variant b). Here, a data packet 3 in a network 1 is fed to a firewall 2 to be examined according to the rules stored in the firewall 2. The arrival time of the data packet is designated as t0.
[0033] Depending on the number of rules to be processed, the performance of the firewall and the workload of the firewall when the data packet arrives at input 4 of the firewall, the data packet requires a processing time tprocess .
[0034] The data packet is therefore kept in processing 5 of the firewall 2 until the rules have been processed and thus the time t process was completely finished 8.
[0035] In order to achieve time-deterministic behavior, it is now introduced that the data packet 3 is transferred to a buffer 6, where it is held until a predetermined time t max has expired. This predetermined time is determined by the performance of the firewall and the maximum working time that can occur in the firewall.
[0036] In contrast to Figure 1, however, the data packet is not sent after the time t max sent, but a clocked, periodically repeating time t sendDefines the time at which data packets are sent by the firewall. This results in predictable times at which data packets can be sent.
[0037] After the time t max Then, data packet 3 is not sent to the firewall's output 7, but is buffered again 9', which lasts until the next feed. This additional waiting time is denoted by t wait Only when the next t send and thus after the time t wait the transmission 10' takes place to the output 7 of the firewall and thus further into network 1.
[0038] Figure 4 shows a further variant of the method according to Figure 3. Here, the predetermined time t max exactly at the time of t send , so that no further intermediate storage 9" is required. In this case, the data packet 3 can be sent immediately, without applying a waiting time t wait Transfer 10”.
[0039] Figure 5 illustrates the process according to Figures 3 and 4 as a block diagram. First, a data packet or data frame is received by the firewall 11. A timestamp is created or the time of receipt is determined upon arrival 12 at the firewall in a functionally equivalent manner. The firewall then begins filter processing 13.
[0040] At the end of filter processing 13, the time is again recorded as processing time 14. This is calculated by subtracting the two recorded times, ie, the time of arrival 12 of the data packet at the firewall is subtracted from the time after the end of filter processing 13. This gives the processing time 14 t process .
[0041] Subsequently, the data packet is temporarily stored and waited until the predetermined time t maxhas expired. After calculating the processing time 14, the difference of t max and t process waited, so that the data packet is stored for a maximum time of 15 t max was processed in the firewall.
[0042] Now the nearest t send waited. Data packet 3 is held in the buffer until the waiting time t wait can be determined as follows: 17 t wait = t send - (t0+ t max ). This waiting time is 18 until the data packet is forwarded.
[0043] The data packet is then sent. 16 It can then also be deleted from the cache. The cache can be located in the firewall or stored externally on another network device.
[0044] Figure 6 shows a time diagram of the method according to the invention according to the previously described variant c). Here, a data packet 3 in a network 1 is fed to a firewall 2 to be examined according to the rules stored in the firewall 2. The arrival time of the data packet is designated as t0.
[0045] Depending on the number of rules to be processed, the performance of the firewall and the workload of the firewall when the data packet arrives at input 4 of the firewall, the data packet requires a processing time t process .
[0046] The data packet is therefore kept in processing 5 of the firewall 2 until the rules have been processed and thus the time t process was completely finished 8.
[0047] In order to achieve time-deterministic behavior, it is now introduced that the data packet 3 is transferred to a buffer 6, where it is initially held.
[0048] For this purpose, a clocked, periodically repeating time t send Defines the time at which data packets are sent by the firewall. This results in predictable times at which data packets can be sent.
[0049] After the time t process The buffer storage 9''' of the data packet is carried out in the buffer 6, which is stored until the next t send This additional waiting time is denoted by t wait Only when the next t send and thus after the time t wait the transmission 10' takes place to the output 7 of the firewall and thus further into network 1.
[0050] In contrast to the variant in Figures 3 and 4, there is no need to wait for t maxFigure 7 illustrates the process shown in Figure 6 as a block diagram. First, a data packet or data frame is received by the firewall 11. A timestamp is created, or the time of receipt is determined upon arrival 12 at the firewall in a functionally equivalent manner. The firewall then begins filter processing 13.
[0051] At the end of filter processing 13, the time is again recorded as processing time 14. This is calculated by subtracting the two recorded times, ie, the time of arrival 12 of the data packet at the firewall is subtracted from the time after the end of filter processing 13. This gives the processing time 14 t process .
[0052] Now the nearest t send waited. Data packet 3 is held in the buffer until the waiting time t wait can be determined as follows: 17 t wait = t send - (t0+ tmax ). This waiting time is 18 until the data packet is forwarded.
[0053] The data packet is then sent. 16 It can then also be deleted from the cache. The cache can be located in the firewall or stored externally on another network device.
[0054] 10
[0055] LIST OF REFERENCE SYMBOLS
[0056] 1 network
[0057] 2 Firewall
[0058] 3 data packages
[0059] 4 Entrance
[0060] 5 Processing
[0061] 6 cache
[0062] 7 Exit
[0063] 8 Rule processing completed
[0064] 9 Start caching
[0065] 9' Further caching
[0066] 9'' another buffer 9''' buffer until transmission time
[0067] 10 Transmission
[0068] 10' transfer after waiting time
[0069] 10'' transmission without waiting time
[0070] 10''' Transfer after waiting time
[0071] 11 Reception
[0072] 12 Arrival
[0073] 13 Filter editing
[0074] 14 Processing time
[0075] 15 Maximum time
[0076] 16 Send
[0077] 17 Determine waiting time
[0078] 18 Waiting time
Claims
PATENT CLAIMS 1. Method for ensuring that data packets (3) arrive at the receiver in a network (1) at definable times, with a firewall (2) in a computer network (1), characterized in that each data packet (3) is allocated a time budget for processing in the firewall. (2) is assigned that the sending of the respective data packet (3) will only be carried out after the time budget has expired, the time budget being determined based on the maximum possible processing time in the firewall (2), 2. Method according to claim 1, characterized in that the processing time of the firewall (2) is the time from the receipt (4) of a data packet (3) at the firewall (2) via the processing (5) to the output (7) of the data packet at the firewall (2) includes.
3. Method according to claim 2, characterized in that the processing time additionally includes an intermediate storage time during which the data packet (3) is held in an intermediate storage (6).
4. Method according to one of claims 1 to 3, characterized in that the time budget for processing the data packet (3) in the firewall (2) of a The method according to claim 4, characterized in that the data packet (3) is sent (16) to the output (7) of the firewall (3) after the defined maximum time (15) has elapsed. The method according to any one of claims 1 to 5, characterized in that a periodically repeating transmission time is defined and the transmission (16) of the data packet (15) to the output (7) of the firewall (3) only takes place at these transmission times. The method according to claim 6, characterized in that the time budget for processing the data packet (3) in the firewall (2) corresponds to a definable maximum time (15) which is greater than the maximum expected processing time (14), and a waiting time which is determined by the time after the processing time (14) until the next transmission time (17).A method according to claim 7, characterized in that the data packet (3) is sent (16) to the output (7) of the firewall (2) after the defined maximum time (15) and the waiting time have elapsed. A method according to claim 7 or 8, characterized in that if the expiry of the maximum time (15) coincides with a transmission time, the waiting time is equal to 0. A method according to claim 6, characterized in that the time budget for processing the data packet (3) in the firewall (2) corresponds to the processing time (14) and a waiting time, which is determined by the time after the processing time (14) until the next transmission time (17). A method according to claim 10, characterized in that the data packet (3) is sent (16) to the output (7) of the firewall (2) after the processing time (14) and the waiting time have elapsed. A method according to any one of claims 1 to 11, characterized in that the data packets (3) are time-stamped upon arrival (12) at the input (4) of the firewall (2). A method according to any one of claims 1 to 12, characterized in that the processing time (14) corresponds to the time required for the filter processing (13) of the firewall (2) for a data packet (3). A method according to any one of claims 1 to 13, characterized in that the buffer (6) is arranged in the firewall (2).