Firewall Match Vector Partitioning for Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls face limitations in processing large filters and enforcing numerous filter rules due to hardware constraints, leading to increased latency and storage issues, as they struggle to efficiently manage and apply filters beyond a certain size or quantity of rules.
Innovation Solution
The method involves partitioning a match vector describing a filter into segments and generating a summary vector that identifies segments containing match bits, allowing the firewall to efficiently process and store filters of arbitrary size by comparing relevant segments across multiple match vectors to determine applicable filter rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the firewall processes large filters with numerous filter rules, then the filtering capability and security coverage are improved, but the hardware constraints cause increased latency and storage requirements
Solution Approach 1:
The match vector is divided into multiple segments, each representing a portion of the filter rules. This segmentation allows the firewall to process only relevant segments containing match bits rather than the entire match vector, reducing processing time and latency while maintaining the ability to handle large numbers of filter rules
Solution Approach 2:
The patent extracts and stores only the relevant segments of match vectors that contain match bits into a summary vector. This extraction eliminates unnecessary data processing and reduces the time required to determine applicable filter rules, directly addressing the latency issue while preserving complete filtering capability
2Reliability
If the firewall stores complete match vectors for all filter rules, then the filtering accuracy is maintained, but the storage requirements increase significantly
Solution Approach 1:
The patent extracts only the essential information (match bits indicating applicable filter rules) from the complete match vectors and stores them in a compressed summary vector structure. This extraction maintains filtering accuracy by preserving the critical match information while eliminating redundant data, thereby reducing storage requirements
Solution Approach 2:
Different portions of the match vector are treated differently based on their content. Segments containing match bits are preserved and stored in the summary vector, while segments without match bits are discarded. This local quality approach ensures filtering accuracy is maintained for relevant rules while reducing overall storage requirements
3Reliability
If the firewall processes all filter rules for each packet, then the filtering completeness is ensured, but the processing speed decreases
Solution Approach 1:
The match vector is segmented into multiple portions, and the firewall processes only the relevant segments that contain match bits rather than examining all filter rules. This segmentation maintains filtering completeness by ensuring all applicable rules are captured in the summary vector while significantly improving processing speed by reducing the search space
Solution Approach 2:
The summary vector is pre-computed and stored, containing only the relevant match information from the complete match vectors. When a packet arrives, the firewall performs a quick lookup in the pre-prepared summary vector rather than processing all filter rules from scratch, ensuring filtering completeness while dramatically improving processing speed
Data Source
AI summary
A method may include obtaining a match vector that indicates one or more filter rules that are potentially applicable to a packet. The method may include partitioning the match vector into a plurality of segments. The method may include generating a summary vector that identifies one or more portions of the match vector that include one or more match bits. A match bit may indicate one of the one or more filter rules that is potentially applicable to the packet. The method may include obtaining a relevant segment of the match vector. The relevant segment may include at least one of the portions of the match vector identified by the summary vector. The method may include determining a filter rule to apply based on the match vector and based on the one or more match bits. The method may include applying the filter rule to the packet.