Bypass Firewall Traffic Control for Stable Packet Forwarding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic control methods using firewalls deployed in series can disrupt normal forwarding of network traffic, leading to service interruptions, and there is a need for a more stable and efficient method to ensure network security without affecting normal operations.
Innovation Solution
A firewall control method where the firewall operates in a bypass manner, generating packet control messages in parallel with a firewall control module that buffers and processes packets without parsing data, allowing for packet-level access control and reducing the impact on normal forwarding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall is deployed in series to analyze and control network traffic in real time, then network security is improved, but normal forwarding of network traffic is affected
Solution Approach 1:
The system divides network traffic control into two independent parts: a firewall that analyzes packets in bypass mode and a firewall control module that executes control decisions. This segmentation allows security analysis and traffic forwarding to occur in parallel, resolving the contradiction between security inspection and normal traffic flow.
Solution Approach 2:
The firewall control module acts as an intermediary between the firewall and the network traffic. It receives control messages from the firewall and executes packet-level control actions, mediating between security requirements and traffic forwarding without becoming a bottleneck.
2Measurement precision
If firewall control module parses data to control network traffic, then access control precision is improved, but complexity of firewall control logic increases
Solution Approach 1:
The patent extracts the data parsing function from the firewall control module and assigns it to the firewall. The firewall control module only receives pre-analyzed control messages and executes control decisions, taking out the complex parsing logic and reducing its own complexity while maintaining precise control.
Solution Approach 2:
The firewall receives bypass traffic that is a copy of the original network traffic. It analyzes this copied traffic and generates control messages, allowing the firewall control module to operate on simplified control information rather than raw traffic data, reducing complexity while maintaining control precision.
3Reliability
If firewall stops forwarding to block harmful information, then network security is improved, but all network traffic is interrupted
Solution Approach 1:
The system dynamically switches between different control granularities. The firewall control module can execute packet-level control actions selectively, allowing normal traffic to forward while blocking only harmful packets. This dynamic approach replaces the static all-or-nothing forwarding stop with fine-grained, adaptive control.
Solution Approach 2:
The patent applies different control actions to different packets locally. Instead of uniformly stopping all traffic, the system applies packet-level control decisions based on individual packet analysis, allowing legitimate traffic to pass while blocking harmful information, thus applying security measures locally rather than globally.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
This application provides a network traffic control method, including: A firewall control module receives network traffic, and buffers a plurality of packets in the network traffic. A firewall receives bypass traffic obtained by performing a copy operation on the network traffic, and detects a packet in the bypass traffic, to obtain a packet control message. The firewall control module receives the packet control message sent by the firewall, and performs a target operation such as forwarding, discarding, or buffering on a target packet in the plurality of packets. In this method, the firewall deployed in a bypass manner parses data in parallel, and the firewall control module does not need to parse any data. Therefore, this can simplify logic of the firewall control module, improve stability of the firewall control module, reduce impact of the firewall control module on normal forwarding of the network traffic, and ensure normal operating of a service.