Hardware Firewall Chaining Technique for Rule Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hardware implementations of firewalls are limited by a maximum number of rules per filter, which restricts the complexity of filters needed for high-speed packet processing, and increasing this limit leads to increased hardware complexity and scalability issues.
Innovation Solution
The implementation of a chaining technique using special action types such as split-filter and next-filter actions allows multiple filters to be logically connected, overcoming the rule limit by treating additional rules as continuations of the current filter, enabling more complex filtering without increasing hardware complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If hardware implementation of firewall is used to achieve high-speed packet processing, then processing speed is improved, but the complexity of filters is limited by maximum quantity of rules
Solution Approach 1:
The patent divides a complex filter with many rules into multiple separate hardware filters, each containing a subset of rules. These segmented filters are then chained together using split-filter actions, allowing the system to handle complex filtering requirements while maintaining hardware speed advantages.
Solution Approach 2:
The patent introduces a new dimension to filter processing by implementing multi-dimensional chaining techniques. Filters are organized in chains where each filter can reference and continue from previous filters, creating a hierarchical structure that exceeds the traditional single-filter rule limit while maintaining hardware implementation benefits.
2Adaptability or versatility
If maximum quantity of rules per hardware filter is increased to handle complex filtering, then filter complexity is improved, but hardware complexity increases
Solution Approach 1:
Instead of increasing the rule capacity of a single hardware filter, the patent segments the filter into multiple smaller hardware filters with standard rule capacities. This segmentation approach maintains individual filter simplicity while achieving overall system complexity through the chaining mechanism.
Solution Approach 2:
The patent creates universal hardware filter components that can be reused and chained in various configurations. Each filter unit serves multiple functions by being part of different chains and supporting split-filter actions, reducing the need for specialized high-capacity hardware while achieving equivalent or greater filtering capability.
Data Source
AI summary
A firewall device may include a forwarding component that includes a filter block. The filter block may obtain a first hardware-implemented filter, where a hardware implementation limits the first hardware-implemented filter to a maximum quantity of rules; determine whether a last rule associated with the accessed hardware-implemented filter includes a split-filter action, where the split-filter action identifies a second hardware-implemented filter; and link the second hardware-implemented filter to the first hardware-implemented filter to make the second hardware-implemented filter a logical continuation of the first hardware-implemented filter, in response to determining that the last rule includes the split-filter action. The filter block may further determine whether a particular rule of the first hardware-implemented filter includes a next-filter action, where the next filter action identifies a third hardware-implemented filter; and process the third hardware-implemented filter independently of the sequence of hardware attachment points.