Firewall Filter Object Segmentation for Update Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firewall systems inefficiently update firewall filters by sending entire lists of rules, even if only a subset has been modified, leading to unnecessary resource usage and increased time for updating across multiple devices.
Innovation Solution
Implementing a system where firewall filters are maintained as objects, allowing devices to identify and send only modified, added, or deleted objects to update the firewall filter, rather than the entire list of rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire list of firewall rules is sent to update firewall filters, then all devices receive complete filter information, but resource usage and update time increase unnecessarily
Solution Approach 1:
The firewall filter is segmented into individual rule objects, allowing the system to identify and transmit only the specific objects that have been modified, added, or deleted between versions, rather than transmitting the entire filter list. This segmentation enables selective updates that reduce transmission time and resource usage while maintaining filter completeness.
Solution Approach 2:
The system extracts only the modified, added, or deleted rule objects from the firewall filter version comparison. By taking out only the necessary changes rather than the entire filter, the system reduces the amount of data that needs to be transmitted and processed, directly addressing the time and resource efficiency problem.
2Reliability
If the entire list of firewall rules is sent to update firewall filters, then all devices receive complete filter information, but network and processing resources are wasted
Solution Approach 1:
The firewall filter is divided into discrete rule objects that can be independently identified and transmitted. This segmentation allows the system to send only the specific objects that have changed, reducing network bandwidth consumption and processing resources while ensuring that all necessary filter information is still delivered to maintain completeness.
Solution Approach 2:
The system performs partial action by transmitting only the subset of rule objects that have been modified, added, or deleted, rather than transmitting the complete filter list. This partial transmission approach reduces resource usage significantly while still achieving the necessary update effect through selective object delivery.
3Reliability
If firewall filters are updated with all rules, then devices have complete filter information, but update efficiency decreases
Solution Approach 1:
By segmenting the firewall filter into individual rule objects, the system can efficiently compare between versions and identify only those objects that have changed. This segmentation enables targeted updates that maintain filter accuracy while dramatically improving update efficiency by avoiding the transmission and processing of unchanged rules.
Solution Approach 2:
The system uses object copying where modified, added, or deleted rule objects are identified through version comparison and only those specific copies are transmitted for update. This selective copying approach ensures that devices receive accurate filter information while improving update efficiency by reducing the volume of data that must be processed.
Data Source
AI summary
A device may determine, based on one or more first objects of a first version of a firewall filter, a set of first firewall rules and may determine, based on one or more second objects of a second version of the firewall filter, a set of second firewall rules. The device may determine, based on the set of first firewall rules and the set of second firewall rules, modification information related to the firewall filter, wherein the modification information indicates at least one difference between the set of first firewall rules and the set of second firewall rules. The device may identify, based on the modification information, at least one object, of the one or more first objects or the one or more second objects, is a modification or has been added or deleted and may send the at least one object to an additional device.