Distributed Packet Filtering Using Bloom Filters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized network solutions for filtering packets based on blacklist or whitelist functionalities often result in performance bottlenecks, high costs, and complexity, struggling to keep up with line-rate speeds and manage network throughput effectively.
Innovation Solution
Implementing a distributed packet filtering system using network devices such as routers and switches equipped with Bloom filters and TCAM filters, which offload the burden from centralized SDN controllers, firewalls, or gateways, allowing for efficient and flexible filtering of packets at the edge of the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized network solutions (SDN controllers, firewalls, gateways) are used for packet filtering, then filtering functionality is provided, but performance bottlenecks occur and network throughput decreases
Solution Approach 1:
The patent divides the centralized filtering system into distributed filtering components deployed at multiple network devices (routers, switches). Each device runs local filtering services that independently process packets, eliminating the single-point bottleneck of centralized controllers and maintaining high network throughput while providing reliable filtering functionality.
Solution Approach 2:
The filtering functionality is extracted from the centralized SDN controller and firewalled gateway infrastructure and implemented as standalone filtering services on regular network devices. This extraction allows filtering operations to occur in parallel across multiple devices rather than sequentially through a single centralized point, resolving the throughput bottleneck.
2Reliability
If centralized filtering is implemented, then packet filtering is achieved, but system complexity and costs increase
Solution Approach 1:
The patent implements filtering services on standard network devices that already perform routing and switching functions. By making these devices multi-functional (handling both traditional networking tasks and packet filtering), the system avoids the complexity of dedicated centralized filtering appliances while maintaining reliable filtering capability through the existing device infrastructure.
Solution Approach 2:
Each network device autonomously performs filtering operations locally without requiring constant coordination with centralized controllers. The filtering services on each device independently make filtering decisions based on local configuration, reducing system complexity by eliminating complex inter-device communication and coordination protocols required by centralized architectures.
3Reliability
If filtering is performed at centralized locations, then security policies are enforced, but processing speed decreases
Solution Approach 1:
The patent segments the filtering workload across multiple geographically distributed network devices rather than concentrating it at a single centralized location. This segmentation enables parallel processing of packets at different network nodes, maintaining high packet processing speed while ensuring security policies are consistently enforced through coordinated filtering rules deployed to all devices.
Solution Approach 2:
The patent introduces a lightweight configuration management system that acts as an intermediary between centralized policy definition and distributed filtering execution. This intermediary efficiently distributes filtering rules to local devices and collects statistics, enabling fast local filtering decisions while maintaining centralized policy control without the speed penalty of centralized packet inspection.
Data Source
AI summary
Examples include a network device to filter a packet for a packet type. The network device includes a filter to receive the packet and to determine whether the packet is a defined packet type. The network device also includes a Bloom filter to receive the packet from the filter based on the determination that the packet is a defined packet type and to determine whether the packet is a matched packet or an unmatched packet. A processing resource of the network device may receive the packet from the Bloom filter based on the determination that the packet is a matched packet and to determine whether the packet is an exact match.