Fast Update Filter for Network Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network firewall systems face inefficiencies in updating filter rules, requiring recompilation of the entire filter for incremental changes, which affects performance and efficiency.
Innovation Solution
Implementing a method that allows incremental updates to firewall filters through normalization of rule modifications and establishment of backtracking links, enabling changes without recompiling the entire filter, using a longest prefix match and priority ordering system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire filter is recompiled for every rule modification, then the filter maintains consistency and correctness, but the update time and processing overhead increase significantly
Solution Approach 1:
The filter compilation process is segmented into individual rule processing units. Instead of recompiling the entire filter blob for every modification, the system compiles and loads only the specific rule that was modified, while maintaining the existing filter structure in memory. This segmentation allows incremental updates without full recompilation overhead.
Solution Approach 2:
The filter definition is pre-compiled into an intermediate representation that can be selectively updated. The system performs preliminary compilation of individual rules into a format that can be quickly loaded and integrated into the existing filter without requiring full recompilation, thus preparing update units in advance for fast deployment.
2Adaptability or versatility
If the entire filter blob is replaced with a newly compiled version, then all rule changes are incorporated, but the memory usage and processing overhead increase
Solution Approach 1:
The filter is segmented into individual rule entries that can be independently managed in memory. When a rule is modified, only that specific rule segment is updated and reloaded, while the rest of the filter structure remains in memory unchanged. This avoids the memory overhead of loading and processing an entirely new filter blob.
Solution Approach 2:
The system discards only the specific rule blob that needs updating while recovering and retaining the majority of the existing filter structure in memory. This selective discarding and recovery approach minimizes memory allocation and deallocation overhead compared to replacing the entire filter blob.
3Reliability
If conflict checking is performed on the entire filter for every rule modification, then rule consistency is ensured, but the processing time increases
Solution Approach 1:
Conflict checking is applied locally to only the modified rule and its immediate interactions with existing rules, rather than performing global conflict analysis on the entire filter. This localized approach maintains conflict detection reliability for the specific modification while significantly reducing processing time by avoiding unnecessary full-filter analysis.
Data Source
AI summary
A method may include defining a filter for a network device, the filter including a rule and a particular number of prioritized fields, where at least one of the prioritized fields is formatted to accept input as a range of values. The method may also include receiving a rule modification for the filter, the rule modification including at least one input as a range of values, and performing a check for conflicts of the rule modification with the rule in the filter. The method may further include expanding the input range of values to form multiple rules equivalent to the rule modification with the input range of values, establishing backtracking links to integrate the multiple rules with the existing rule, and adding the multiple rules to the filter.