Firewall Host Interprocessor Calls via Shared Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewall systems face challenges in efficiently offloading network flow monitoring and processing, leading to increased complexity and reduced performance as firewall rules and security measures become more intricate.
Innovation Solution
A firewall host utilizes shared memory to pass arguments to and receive results from a locally coupled network processing unit, offloading processing tasks to alleviate monitoring burdens and enhance security operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall rules and security countermeasures become increasingly complex to improve network security, then security effectiveness is improved, but system complexity and processing burden increase
Solution Approach 1:
The patent divides the firewall system into two distinct processing paths: a fast path handled by a network processing unit (NPU) for routine packet forwarding, and a slow path handled by the firewall host for complex security rule evaluation. This segmentation allows complex security rules to be maintained while routine processing remains simple and efficient.
Solution Approach 2:
The patent introduces an intermediary mechanism (shared memory and message passing interface) between the firewall host and NPU that enables efficient collaboration. The NPU acts as an intermediary that handles time-consuming packet forwarding tasks, allowing the firewall host to focus on complex security rule processing without being bottlenecked by forwarding performance.
2Reliability
If firewall rules and security countermeasures become increasingly complex to improve network security, then security effectiveness is improved, but processing performance deteriorates
Solution Approach 1:
The patent segments processing tasks into security-critical functions (handled by firewall host) and performance-critical functions (handled by NPU). This allows complex security rules to be evaluated only when necessary, while the majority of packet processing occurs at high speed through the NPU's fast path, maintaining both security effectiveness and processing performance.
Solution Approach 2:
The NPU performs preliminary packet inspection and forwarding decisions before packets reach the firewall host. By pre-processing packets and handling obvious accept/drop decisions at the NPU level, the system avoids unnecessary complex rule evaluations at the firewall host, thereby maintaining high processing performance while still applying complex security rules when needed.
3Productivity
If firewall offloads monitoring of network flows to other networking hardware to reduce processing burden, then firewall performance is improved, but system complexity increases
Solution Approach 1:
The NPU is designed with multi-functionality, serving both as a high-speed packet forwarder and as a security rule evaluation engine. This universal design allows the NPU to handle multiple tasks (packet forwarding, flow monitoring, and security rule application) without requiring separate dedicated hardware for each function, thereby improving firewall performance while limiting the increase in system complexity.
Solution Approach 2:
The NPU autonomously handles packet forwarding decisions and flow monitoring without requiring constant intervention from the firewall host. The NPU independently evaluates security rules for packets in the slow path and maintains flow state information, reducing the processing burden on the firewall host while keeping the system architecture relatively simple through self-sufficient operation of the NPU.
Data Source
AI summary
A firewall host uses a shared memory to pass arguments to, and receive results from, a remote procedure executing on a locally coupled network processing unit that offloads processing for the firewall.