Context-Aware Distributed Firewall Using Binary Prefix Tree
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Software Defined Datacenter (SDDC) environments, traditional firewalls face inefficiencies due to large rule sets that burden firewall engines and consume significant memory, as every network packet must be inspected against the entire rule set, and rules are replicated across all protected virtual machines (VMs).
Innovation Solution
A context-aware distributed firewall scheme is implemented, where each hypervisor or virtualization software uses a search structure, such as a binary prefix tree, to identify and apply only relevant firewall rules to each VM based on its network addresses, reducing the number of rules loaded and inspected, thereby saving memory and processing time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the complete set of firewall rules is applied to every VM, then comprehensive security coverage is achieved, but memory consumption and processing burden increase significantly
Solution Approach 1:
The patent segments the complete firewall rule set into context-specific subsets for each VM based on network address relevance. The search structure (binary prefix tree) enables each VM to have only the rules applicable to its specific network addresses, dividing the monolithic rule set into manageable, relevant portions that reduce memory consumption while maintaining security coverage.
2Reliability
If the complete set of firewall rules is applied to every VM, then comprehensive security coverage is achieved, but firewall engine processing burden increases
Solution Approach 1:
The patent extracts only the relevant subset of firewall rules applicable to each specific VM from the complete rule set. By using the search structure to identify and apply only the rules matching the VM's network addresses, the system removes unnecessary rule inspections, thereby reducing processing burden and improving packet inspection efficiency while maintaining comprehensive security coverage.
3Adaptability or versatility
If firewall rules are replicated to every protected VM, then distributed firewall protection is achieved, but memory usage across the system increases
Solution Approach 1:
The patent implements local quality by customizing the firewall rule set for each VM based on its specific network addresses. Instead of uniformly replicating the complete rule set to every VM, each VM receives a tailored subset of rules relevant to its context, achieving distributed firewall protection while minimizing total memory usage across the system.
4Ease of operation
If every firewall controller receives all rules for the entire datacenter, then centralized management is simplified, but the burden on individual controllers increases
Solution Approach 1:
The patent applies preliminary action by pre-processing the complete firewall rule set into a search structure (binary prefix tree) at the centralized controller. This pre-organization enables efficient identification and distribution of only the relevant rules to each VM's firewall controller, simplifying centralized management while reducing the processing complexity and burden on individual controllers.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A context-aware distributed firewall scheme is provided. A firewall engine tasked to provide firewall protection for a set of network addresses applies a reduced set of firewall rules that are relevant to the set of addresses associated with the machine. A hypervisor implements a search structure that allows each virtual machine's filter to quickly identify relevant rules from all of the received rules. The search structure is constructed as a binary prefix tree, each node corresponding to an IP CIDR (Classless Inter-Domain Routing) block. A query for relevant rules traverses nodes of the search structure according to a queried IP address and collect all rules that are associated with the traversed nodes.