Firewall Packet Classification Using Hierarchical Rule Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional rule-based computer security firewalls face performance issues due to increasing complexity, requiring organizations to compromise between rule base complexity and data throughput, often at the cost of security.
Innovation Solution
A method and system for determining data packet flow using bit classification, where a processor analyzes specific bits within a packet to assign a classification value and apply corresponding results, allowing or denying packet passage based on predefined tables, thereby reducing the need for complex rule sets and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule base complexity is increased to improve security, then security is improved, but data throughput deteriorates due to more system and processor overhead
Solution Approach 1:
The patent segments the rule base into multiple hierarchical levels (global rules, local rules, and packet-specific rules). By dividing the complex rule set into manageable segments organized in a tree structure, the system can evaluate rules more efficiently without sacrificing security coverage. This segmentation allows the firewall to process packets through progressively specialized rule sets rather than evaluating all rules uniformly, thereby maintaining security while improving throughput.
Solution Approach 2:
The patent implements preliminary action by pre-compiling and organizing rules into hierarchical tables before packet processing. The global rules and classification criteria are prepared in advance in a structured format that enables rapid lookup and decision-making. This preliminary organization of rule data allows the system to quickly determine packet classification without performing complex real-time evaluations, thus improving data throughput while maintaining comprehensive security checks.
2Reliability
If rule base complexity is increased to improve security, then security is improved, but system overhead increases
Solution Approach 1:
The patent segments the rule base into multiple hierarchical levels (global rules, local rules, and packet-specific rules). By dividing the complex rule set into manageable segments organized in a tree structure, the system can evaluate rules more efficiently without sacrificing security coverage. This segmentation allows the firewall to process packets through progressively specialized rule sets rather than evaluating all rules uniformly, thereby maintaining security while improving throughput.
Solution Approach 2:
The patent changes the parameter organization of rules from a flat, monolithic structure to a hierarchical tree structure with multiple levels of abstraction. This parameter reorganization transforms the rule base into a more efficient data structure that reduces the computational complexity of rule evaluation. By changing how rules are structured and accessed (from sequential evaluation to hierarchical lookup), the system reduces processor overhead while maintaining comprehensive security coverage.
3Reliability
If comprehensive rule evaluation is performed to maintain security standards, then security is maintained, but processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-compiling and organizing rules into hierarchical tables before packet processing. The global rules and classification criteria are prepared in advance in a structured format that enables rapid lookup and decision-making. This preliminary organization of rule data allows the system to quickly determine packet classification without performing complex real-time evaluations, thus improving data throughput while maintaining comprehensive security checks.
Solution Approach 2:
The patent introduces dynamic adaptivity by allowing the rule evaluation process to adjust based on packet characteristics and classification needs. The hierarchical rule structure enables the system to dynamically select which rule sets to evaluate based on the packet's progression through the classification tree. This dynamic approach avoids unnecessary evaluation of irrelevant rules, reducing processing time while ensuring that appropriate security checks are performed for each packet type.
Data Source
AI summary
A method for determining a flow of data is described. The method includes determining whether a packet including a first number of at least one bit within a first set is assigned a classification value based on the at least one bit within the first set and determining a result to be applied to the packet upon determining that the packet is assigned the classification value. The method further includes analyzing, by a processor, at least one bit of a second number within a second set of the packet upon determining that the packet cannot be assigned the classification value based on the first number of at least one bit of the packet.