Dual Bitmap Security Policy Correlation for Network Gateways
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number and complexity of security policies in network gateway and firewall systems lead to unsustainable costs in terms of storage space and throughput latency, making it challenging to efficiently correlate received information packets with applicable security policies.
Innovation Solution
The implementation of a dual bitmap scheme that accounts for bit position mergers and policies common to multiple bit positions, allowing for efficient correlation and identification of security policies applicable to received information packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the number of security policies is increased to enhance security coverage, then security policy applicability is improved, but storage space requirements and processing latency increase
Solution Approach 1:
The patent segments security policies into distinct categories (e.g., access control policies, security policies, routing policies) and organizes them in separate tables (access-control-policy-table, security-policy-table, routing-policy-table). This segmentation allows the system to manage large numbers of policies efficiently by processing them in organized groups rather than as a flat list, reducing storage overhead and improving retrieval efficiency.
Solution Approach 2:
The patent introduces a hierarchical dimension to policy storage by organizing policies into multiple levels: global policies applied to all packets, and per-destination policies applied selectively. This dimensional organization allows the system to represent policy relationships in a multi-level structure that reduces the effective storage requirement while maintaining comprehensive security coverage.
2Reliability
If the number of security policies is increased to enhance security coverage, then security policy applicability is improved, but processing throughput latency increases
Solution Approach 1:
The patent performs preliminary classification of packets into distinct types (e.g., unicast, multicast, broadcast) before policy application. This preliminary action allows the system to pre-determine which policy tables and search algorithms should be applied, avoiding unnecessary policy evaluation for certain packet types and reducing overall processing latency.
Solution Approach 2:
By segmenting policies into distinct tables and applying them selectively based on packet type, the system reduces the number of policies that need to be evaluated for each packet. The access-control-policy-table handles authentication decisions, while security-policy-table and routing-policy-table handle routing and security filtering, allowing parallel processing and reducing throughput latency.
3Quantity of substance
If bit positions are merged to reduce policy replication, then storage efficiency is improved, but policy correlation accuracy may be compromised
Solution Approach 1:
The patent applies different levels of bit position merging based on the specific policy table and packet type. For example, access control policies may use coarser bit merging while security policies use finer granularity. This local quality approach allows the system to optimize storage efficiency in policy tables where merging is safe while maintaining accuracy in tables where precise correlation is critical.
Solution Approach 2:
The patent implements dynamic policy selection based on packet characteristics. The system dynamically determines which bit positions to merge and which to preserve based on the packet type, destination address, and policy table being accessed. This dynamic approach allows the system to adapt the merging granularity to the specific processing context, balancing storage efficiency with correlation accuracy.
Data Source
AI summary
Systems, devices, and methods are discussed for identifying security policies applicable to a received information packet based upon a dual bitmap scheme accounting for bit position mergers and/or policies common to multiple bit positions.