Container-Linking Trie for Dynamic Packet Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current packet classification methods are inefficient when dealing with container-based rules, as they require enumerating or looking up numerous rules for each incoming packet, leading to slow search times and increased computational complexity.
Innovation Solution
A container-linking data structure is used, organized as a prefix tree (Trie), which links addresses to containers and rules, allowing for dynamic updates and minimizing the need to examine containers directly, along with additional search structures for ports and protocols to efficiently find the highest priority matching rule.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If container-based rules are used in packet classification, then the system can support network virtualization and distributed firewall, but the search time and computational complexity increase significantly
Solution Approach 1:
The patent segments the container-based rule set into multiple disjoint subsets, organizing them into a tree structure where each node represents a subset of rules. This segmentation allows the classification process to navigate through the tree rather than examining all rules sequentially, significantly reducing search time while maintaining support for virtualized network environments.
Solution Approach 2:
The patent introduces a hierarchical tree structure dimension to organize container-based rules, transforming the flat, sequential rule examination into a multi-dimensional search space. This allows packet classification to proceed by traversing the tree structure based on packet characteristics, reducing the computational complexity from examining all N rules to examining only a subset along the traversal path.
2Reliability
If all rules are enumerated for container-based classification, then complete matching coverage is achieved, but the number of rules explodes combinatorially
Solution Approach 1:
The patent extracts the container identity and characteristics from the full set of container-based rules, using these extracted features as navigation keys in the tree structure. This allows the system to maintain complete matching coverage by preserving all rule-container relationships while representing them compactly through the tree, avoiding combinatorial explosion of explicit rule enumeration.
Solution Approach 2:
The patent performs preliminary organization of container-based rules into the tree structure during system initialization or configuration phase. This preliminary action pre-computes the hierarchical relationships and navigation paths, so that during actual packet classification, the system only needs to traverse the pre-built tree rather than dynamically evaluating all possible rule combinations, thus maintaining reliability while reducing complexity.
3Measurement precision
If sequential rule examination is performed with priority numbers, then correct priority-based matching is ensured, but the processing speed decreases
Solution Approach 1:
The patent assigns different priorities to different branches or nodes in the classification tree, allowing high-priority rules to be positioned at shallower levels or more accessible nodes. This local quality differentiation enables the traversal algorithm to encounter high-priority matches earlier in the process, maintaining priority-based matching accuracy while improving overall classification speed by avoiding deep traversal for common high-priority cases.
Data Source
AI summary
A novel algorithm for packet classification that is based on a novel search structure for packet classification rules is provided. Addresses from all the containers are merged and maintained in a single Trie. Each entry in the Trie has additional information that can be traced back to the container from where the address originated. This information is used to keep the Trie in sync with the containers when the container definition dynamically changes.