Counting Bloom Filter Packet Classification for Network Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network devices face inefficiencies in packet processing due to memory and computational resource usage, as well as latency issues, when using session tables to determine whether a packet is the first or subsequent packet of a transport protocol connection, which can lead to ineffective detection and management of security threats like denial of service attacks.

Innovation Solution

The implementation of a counting Bloom filter (CBF) in network devices to classify packets as first or subsequent packets by extracting n-tuple values from packet headers, calculating hash values, and maintaining connection rate meters, allowing for efficient processing and mitigation of denial of service attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If session tables are used to determine whether a packet is the first or subsequent packet of a connection, then packet classification accuracy is improved, but memory resource usage increases

Engineering Contradiction:

Improvepacket classification accuracyVSAvoidmemory resource usage

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent uses a Bloom filter as a compact copy or representation of the session table data structure. Instead of storing complete session table entries in memory, the Bloom filter creates a probabilistic copy that uses significantly less memory while maintaining the ability to determine whether a packet is the first or subsequent packet of a connection.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent changes the data structure parameters from traditional session tables to a Bloom filter implementation. This involves transforming the storage mechanism from key-value pairs to hash-based bit arrays, fundamentally altering how connection state information is represented and accessed in memory.

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If session tables are used to determine packet classification, then connection tracking accuracy is improved, but processing latency increases

Engineering Contradiction:

Improveconnection tracking accuracyVSAvoidprocessing latency

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent extracts only the essential classification information needed for packet processing from the full session table data structure. The Bloom filter captures only the minimum necessary data to determine whether a packet is the first or subsequent packet, eliminating the need to process or store complete session table entries and thus reducing processing latency.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The Bloom filter performs preliminary classification of packets before they reach the main processing pipeline. By pre-computing hash values and storing connection signatures in the Bloom filter, the system can quickly determine packet classification status without performing full session table lookups, thereby reducing overall processing latency.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If session tables are used for connection tracking, then security threat detection capability is improved, but computational resource usage increases

Engineering Contradiction:

Improvesecurity threat detection capabilityVSAvoidcomputational resource usage

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent employs a Bloom filter that uses inexpensive hash computations and simple bit array operations instead of complex session table management. The Bloom filter structure allows for efficient insertion and query operations that consume fewer computational resources while maintaining the ability to detect security threats such as DoS attacks.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Solution Approach 2:

The patent replaces the mechanical session table lookup mechanism with a Bloom filter-based probabilistic data structure. This substitution eliminates the need for complex data structure management, hashing collisions resolution, and memory allocation/deallocation operations associated with traditional session tables, thereby reducing computational resource usage.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11223562B1Selectively processing packets based on their classification by a counting bloom filter as a first packet or a subsequent packet of a transport protocol connection

Publication Date: 2022.01.11 FORTINET INC

AI summary

Systems and methods for selectively processing packets based on their classification by a CBF are provided. According to one embodiment, a network device receives a packet, extracts n-tuple values from the header of the packet that are indicative of a particular transport protocol connection with which the packet is associated, determines whether the particular transport protocol connection represents an active transport protocol connection represented within the CBF by searching the CBF based on the n-tuple values. When the packet is a first packet of a new connection, counters maintained by the CBF corresponding to the n-tuple values are incremented. When a decrement event is detected for one or more of the counters, they are decremented. Finally, the packet is processed in accordance with its classification as a first packet of a new connection or a subsequent packet of an existing connection.