Compressed CIDR Rule Generation via Binary Tree Address Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network applications such as firewalls and routers face performance degradation due to the need to compare a large number of user-configurable rules for incoming packets, especially during attacks involving multiple IP addresses, leading to increased processing time and reduced efficiency.
Innovation Solution
A method is introduced to compress a set of input addresses into a smaller set of Classless Internet Domain Routing (CIDR) expressions using a binary tree structure, allowing for the generation of rules that include the input addresses and zero or more additional addresses, with a tolerance value determining the acceptable level of over-coverage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a large number of user-configurable rules are maintained for network security and routing, then network security and routing accuracy are improved, but processing time increases and performance degrades
Solution Approach 1:
The patent merges multiple individual IP address rules into compressed CIDR (Classless Inter-Domain Routing) rules. Instead of maintaining separate rules for each IP address, the system combines them into aggregated network ranges, reducing the total number of rules while preserving security coverage. This merging process directly reduces processing time by decreasing the number of rule comparisons needed.
Solution Approach 2:
The patent transforms the representation of IP addresses from individual host addresses to network prefix formats with variable length subnet masks. By changing the parameter representation from specific host IPs to aggregated network ranges with prefix lengths, the system achieves both security maintenance and performance improvement through reduced rule sets.
2Reliability
If a large number of user-configurable rules are maintained for network security and routing, then network security and routing accuracy are improved, but device complexity increases
Solution Approach 1:
The patent merges multiple individual IP address rules into compressed CIDR (Classless Inter-Domain Routing) rules. Instead of maintaining separate rules for each IP address, the system combines them into aggregated network ranges, reducing the total number of rules while preserving security coverage. This merging process directly reduces processing time by decreasing the number of rule comparisons needed.
Solution Approach 2:
The patent transforms the representation of IP addresses from individual host addresses to network prefix formats with variable length subnet masks. By changing the parameter representation from specific host IPs to aggregated network ranges with prefix lengths, the system achieves both security maintenance and performance improvement through reduced rule sets.
3Measurement precision
If individual IP address rules are used instead of compressed rules, then measurement precision of blocked addresses is improved, but quantity of rules increases
Solution Approach 1:
The patent applies partial compression by allowing some IP addresses to be represented individually while others are compressed into CIDR ranges. The system can selectively compress rules based on criteria such as tolerance thresholds, ensuring that precision is maintained for critical addresses while reducing the rule count for less critical ones. This partial approach balances precision requirements with rule quantity reduction.
Solution Approach 2:
The patent transforms the representation of IP addresses from individual host addresses to network prefix formats with variable length subnet masks. By changing the parameter representation from specific host IPs to aggregated network ranges with prefix lengths, the system achieves both security maintenance and performance improvement through reduced rule sets.
Data Source
AI summary
Techniques for compressing a set of input addresses to generate a set of one or more rules for various network applications and tools such as routers, firewalls, and others. A tree is generated based upon a set of input addresses. A set of one or more rules may be generated based upon the generated tree and a tolerance value. The set of one or more rules may identify one or more address segments that include the input addresses and may also include one or more additional addresses. In one embodiment, the set of one or more rules may be one or more Classless Internet Domain Routing (CIDR) expressions. The set of one or more rules may be provided to various network applications and tools for further processing.