Circular Queue Packet Bucket for Network Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In high-speed network security equipment, packet processing is delayed due to lock contention and repeated packet copying, which leads to inefficiencies in vulnerability analysis across multiple analysis engines with different processing performance.
Innovation Solution
A distributed processing apparatus and method using a circular queue with a bucket structure that stores packet data and use information, allowing each analysis engine to perform vulnerability analysis on a shared packet copy, reducing the need for multiple packet copies and lock contention by using a packet address to manage access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet copying is performed to ensure data integrity in multiple analysis engines, then data stability is improved, but packet processing speed deteriorates due to lock contention and copy delay
Solution Approach 1:
The patent applies selective packet copying based on vulnerability detection results. Instead of copying all packets to multiple analysis engines, the system copies only packets that require vulnerability analysis after the first analysis engine processes them. This reduces unnecessary copying and lock contention while maintaining data integrity for packets that need further analysis.
Solution Approach 2:
The patent implements dynamic packet processing where the processing path changes based on vulnerability detection results. Packets are dynamically directed to different analysis engines based on their characteristics and the results of initial analysis, allowing the system to adaptively manage packet flow and reduce lock contention by processing packets in parallel when safe.
2Reliability
If lock processing is performed to ensure copy time and data stability, then data integrity is improved, but analysis processing speed is delayed due to lock contention
Solution Approach 1:
The patent performs preliminary vulnerability analysis using the first analysis engine before directing packets to subsequent analysis engines. This preliminary action determines whether packets require further analysis, allowing the system to prepare packet routing decisions in advance and reduce lock contention by minimizing the number of packets that need to be copied and processed by multiple engines.
3Productivity
If multiple analysis engines process packets in parallel, then analysis throughput is improved, but packet copying and lock contention increase
Solution Approach 1:
The patent applies different processing strategies to different packets based on their characteristics and vulnerability detection results. Not all packets are treated uniformly; instead, the system identifies which packets require vulnerability analysis and directs only those to multiple analysis engines, while other packets can be processed more simply, reducing overall copying complexity.
Data Source
AI summary
Disclosed is an apparatus for distributed processing of an identical packet in high-speed network security equipment, including: a plurality of analysis modules for each determining whether vulnerability analysis is required by analyzing a received packet; a circular queue for receiving the packet from an analysis module initially determining that the vulnerability analysis is required and storing the received packet as a bucket structure; and a plurality of analysis engines for each performing different vulnerability analyses for the packet acquired from the circular queue based on a packet address of the bucket structure, in which the bucket structure includes a packet data storage unit and packet use information storage units which are as many as the plurality of analysis engines, and the packet use information storage units store packet use information of the plurality of respective analysis engines, respectively.