Firewall Connection Management via Dynamic Timeout Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing connections in firewalls, particularly under high loads, are inefficient as they consume significant processor resources and can lead to packet loss and interruption of established connections due to the need to constantly search for and remove obsolete connections, and do not account for Network Address Translation (NAT) or groups of logically related connections.
Innovation Solution
A method that dynamically adjusts connection timeouts based on firewall load, prioritizes established connections, and manages groups of connections, using a connection table that includes information about packet transformations and application-layer protocols, allowing for periodic clearing of obsolete connections rather than at every packet processing, thereby reducing processor resource consumption and enhancing resistance to DoS/DDoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the firewall constantly searches for and removes obsolete connections at every packet processing, then the connection table is kept clean, but processor resources are exhausted and packet processing is slowed down
Solution Approach 1:
The patent implements periodic cleaning of the connection table instead of continuous cleaning at every packet processing step. The firewall periodically removes obsolete connections from the connection table, which reduces the processor resource consumption while maintaining connection table cleanliness. This periodic action allows the system to balance between keeping the table clean and maintaining high packet processing speed.
2Quantity of substance
If the firewall removes obsolete connections frequently, then connection table size is reduced, but established connections may be interrupted due to table overflow
Solution Approach 1:
The patent implements preliminary action by proactively removing obsolete connections before they can cause table overflow and interrupt established connections. The firewall periodically identifies and removes connections that have been obsolete for a certain duration, preventing the connection table from overflowing with unused connections. This preliminary cleaning action protects the stability of established connections while managing the connection table size effectively.
3Extent of automation
If the firewall uses LRU algorithm to remove obsolete connections, then the connection management is automated, but processor resources are consumed significantly
Solution Approach 1:
The patent applies partial action by implementing connection cleanup only for obsolete connections that have exceeded a predefined timeout threshold, rather than applying the LRU algorithm to all connections in the table. This selective cleaning approach automates connection management for the most critical case (obsolete connections) while avoiding the excessive processor resource consumption that would result from applying LRU to the entire connection table, especially under high load conditions.
4Productivity
If the firewall drops packets when input buffer overflows, then network overload is managed, but established connections are broken
Solution Approach 1:
The patent implements preliminary action by proactively removing obsolete connections from the connection table before the input buffer overflows and before packet dropping occurs. This preliminary cleaning prevents the connection table from becoming full, which in turn prevents the firewall from having to drop packets due to table overflow. By taking this preliminary action, the system avoids the harmful effect of breaking established connections while still managing network overload through other means.
Data Source
AI summary
The disclosure relates to a method for managing connections in a firewall. The method includes receiving packets from an external network; generating a connection table; determining the total number of currently established connections; determining a level of firewall load by comparing the number of established connections with a threshold; identifying new and established connections based on two-way exchange of packets between a client and server; identifying closed connections based on processing ICMP error messages or flags in a TCP header; and dynamically determining current timeout values for connections from the network protocol type, the connection state, and the firewall load level. The method also includes modifying the last packet processing timestamp if any packet is passed within a given connection or a group of connections; and removing the connection if the last packet processing timestamp differs from the current time by a value greater than the timeout of said connection.