Firewall Filter Rule Synchronization via Hash Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewall filter synchronization across restarts in Linux kernel-based systems is inefficient, leading to vulnerabilities due to potential mismatches between configured and applied filter rules, which can result in system vulnerabilities and resource-intensive re-syncing processes.
Innovation Solution
Computing and storing hash values for filter information allows for efficient synchronization by comparing hash values before and after restarts, updating rules only if changes are detected, thereby minimizing the need for full re-programming of filter rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full re-programming of filter rules is performed after restart, then synchronization reliability is improved, but system performance and resource usage deteriorate
Solution Approach 1:
Instead of performing full re-programming of all filter rules after restart, the patent applies partial action by only updating rules that have actually changed. The system compares hash values of filter information before and after restart, and only re-programs the specific rules that show differences, thereby avoiding unnecessary full re-programming overhead while ensuring synchronization reliability.
Solution Approach 2:
The patent computes and stores hash values of filter information as a preliminary action before restart occurs. This pre-computed hash information enables rapid comparison after restart to determine which rules need updating, eliminating the need for time-consuming full re-programming while maintaining reliable synchronization.
2Reliability
If full re-programming of filter rules is performed after restart, then synchronization completeness is improved, but resource consumption deteriorates
Solution Approach 1:
The system performs only the necessary partial action of re-programming changed rules rather than all rules. By using hash value comparison to identify only the specific rules that require updates, the system achieves complete synchronization for changed rules while consuming minimal resources, avoiding the wasteful full re-programming approach.
Solution Approach 2:
The patent extracts only the essential information needed for synchronization verification (hash values) and uses it to identify and update only the specific rules that have changed. This extraction approach separates the verification function from the full re-programming process, achieving complete synchronization with reduced resource consumption.
3Productivity
If hash value comparison is used for synchronization, then processing efficiency is improved, but system complexity deteriorates
Solution Approach 1:
The patent introduces hash values as an intermediary element that simplifies the synchronization process. Instead of directly comparing entire filter rule sets (which would be complex and time-consuming), the hash values serve as compact intermediaries that enable efficient comparison while maintaining synchronization accuracy, thus improving processing efficiency with minimal added complexity.
Solution Approach 2:
The system transforms the complex filter rule information into a simplified parameter representation (hash value). This parameter transformation enables efficient comparison operations while preserving the essential information needed for synchronization verification, achieving high processing efficiency without significant system complexity increase.
Data Source
AI summary
Filter synchronization across a restart of a firewall filter application for converting filter information for filters into corresponding iptables filter table rules, is ensured by (1) computing a hash value for filter information derived from a filter using the filter or information derived from the filter, (2) determining an iptables filter table rule using the filter information for the filter, (3) associating the hash value with the corresponding iptables filter table rule, and (4) adding the determined iptables filter table rule and the hash value to iptables filter table rules in a Linux kernel. When a restart of the firewall filter application is detected, (1) a current instance of filter information derived from a current instance of the filter is obtained, (2) a hash value for the current instance of filter information is computed using the current instance of the filter or information derived from the current instance of the filter, (3) the hash value for the filter information is obtained from the iptables rules, and (4) whether the hash value for the current instance of the filter information is the same as the hash value for the filter information is determined. If it is determined that the hash value for the current instance of the filter information is not the same as the hash value for the filter information, then (1) a new iptables rule for the current instance of the filter information is determined, and (2) the iptables filter rule and the hash value in the iptables rules is replaced with the new iptables rule and the hash value for the current instance of the filter information.