Dynamic ACL Adjustment for Network Security Throughput
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network appliances, such as intrusion prevention systems, introduce latency and have slower throughput compared to traditional high-speed network devices like routers and switches, which can negatively impact real-time applications and shared resources.
Innovation Solution
Implementing logic embedded in application-specific integrated circuits (ASICs) on network devices to dynamically adjust access control lists (ACLs) based on information from checking functionalities, allowing for efficient collaboration between network devices and security appliances, thereby improving the efficacy of security operations without penalizing shared resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network appliances examine each packet to determine security-related actions, then security detection capability is improved, but throughput and latency are worsened
Solution Approach 1:
The patent segments traffic handling into two paths: fast-path processing for known-good traffic through hardware-based ACLs in high-speed network devices, and slow-path processing for suspicious traffic through software-based inspection in network appliances. This segmentation allows most traffic to bypass the security appliance while maintaining security oversight.
Solution Approach 2:
The patent implements preliminary action by pre-configuring access control lists with known-bad traffic patterns before traffic arrives. High-speed network devices can immediately filter and drop malicious traffic using these pre-computed ACLs without requiring real-time analysis by slower security appliances.
2Adaptability or versatility
If network appliances replicate bridging and routing functions, then network security services are improved, but processing speed is worsened
Solution Approach 1:
The patent introduces high-speed network devices as intermediaries between the network appliance and the network infrastructure. The appliance generates security policies and ACL rules, but the high-speed network devices execute the actual packet filtering and forwarding decisions, leveraging their optimized hardware forwarding planes.
Solution Approach 2:
The patent replaces the mechanical software-based packet processing in network appliances with hardware-based ACL enforcement in high-speed network devices. The ACL rules are implemented in ASICs or other hardware logic that can perform packet matching and forwarding at line rate, substituting slow software processing with fast hardware operations.
3Reliability
If ports are disabled to block suspicious traffic, then security protection is improved, but resource availability is worsened
Solution Approach 1:
The patent applies local quality by implementing fine-grained ACL rules that target specific malicious traffic patterns rather than disabling entire ports. The ACLs can differentiate between legitimate and malicious traffic from the same source, allowing selective blocking that preserves resource availability while maintaining security.
Solution Approach 2:
The patent changes the parameter of traffic filtering from binary port enable/disable to multi-dimensional ACL rule matching. ACLs can match on multiple parameters including source/destination IP, port, protocol, and packet characteristics, enabling precise control over which traffic flows are blocked while allowing legitimate traffic to continue.
Data Source
AI summary
Network devices and methods are provided for packet processing. One method includes using logic embedded in an application specific integrated circuit on a network device to dynamically adjust an access control list. According to the method, the access control list is adjusted in response to information received from a checking functionality related to packets received by the network device from a particular port. The method also includes handling packets later received from the particular port according to the adjusted access control list.