Bidirectional Policy Database Rule Normalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network devices store a large number of direction-specific policy rules, leading to an unnecessarily large policy database due to the lack of consideration for bidirectional nature of some policy rules, which increases resource requirements and costs.
Innovation Solution
Implementing a method to populate policy databases with bidirectional rules that utilize a canon to generate a single rule applicable to both directions of symmetric packet flows, reducing the database size by using metadata to create a search key that matches both forward and reverse packet flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If direction-specific policy rules are stored for each packet flow, then packet flow control precision is improved, but policy database size increases
Solution Approach 1:
The patent merges bidirectional packet flows into a single policy rule entry. Instead of storing separate rules for forward and reverse directions, the system combines them by sorting source and destination addresses in ascending order and using wildcards to represent both directions, thereby reducing policy database size while maintaining control precision
Solution Approach 2:
The patent creates universal policy rules that apply to both forward and reverse packet flows simultaneously. By using wildcard characters and normalized address ordering, a single rule entry serves multiple directional flows, making the policy database more efficient without sacrificing the ability to control specific packet flows
2Adaptability or versatility
If separate policy rules are stored for forward and reverse packet flows, then flow-specific control is improved, but resource requirements increase
Solution Approach 1:
The system combines resource-intensive separate rules for bidirectional flows into a single normalized rule entry. By sorting addresses and using wildcards, the patent reduces the number of rule entries in the policy database, thereby decreasing memory usage and processing resources while preserving flow-specific control capabilities
Solution Approach 2:
The patent changes the parameter representation by normalizing address ordering (sorting source and destination addresses in ascending order) and introducing wildcard parameters. This transformation allows a single rule to cover multiple directional flows, reducing resource requirements while maintaining adaptability
3Quantity of substance
If bidirectional rules are implemented, then policy database size is reduced, but rule matching complexity increases
Solution Approach 1:
The patent performs preliminary normalization of packet flow parameters before rule matching. By pre-sorting source and destination addresses in ascending order and pre-configuring wildcard positions in policy rules, the system prepares the data structure in advance, making the actual matching process simpler and more efficient despite the bidirectional nature of rules
Data Source
AI summary
Aspects of the disclosure provide a method for processing packets in a network device. The method can include populating a policy database with one or more bidirectional rules that are to be selectively applied in a packet processing operation. Ones of the bidirectional rules can include at least: a first address field populated with a first value corresponding to a source address for first packet flow that is traversing a network in a first direction and to a destination address for second packet flow that is traversing the network in a second direction different from the first direction, a second address field populated with a second value, and an action that is applicable to packet flow having a respective source address and destination address corresponding to the first values stored in the first address field and to the second values stored in the second address field.