Firewall Policy Bitmaps for Low-Latency Packet Rule Lookup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewall systems experience significant latency in processing communication packets due to the time-consuming search for processing rules in large network address-based rulesets, even with techniques like hashing or longest prefix matching.
Innovation Solution
Encoding firewall rules into bit arrays (bitmaps) where each bit corresponds to a processing rule, allowing for fast determination of packet processing rules using bitwise operations, reducing the need for complex computations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional firewall ruleset search methods are used, then comprehensive security coverage is maintained, but packet processing latency increases significantly
Solution Approach 1:
The patent transforms the firewall ruleset from a traditional list of network addresses into a bitmap data structure where each bit represents a processing rule. This changes the data representation parameter from textual/address-based to binary bit-based, enabling much faster processing. The firewall service encodes the ruleset as a bitmap array where bits are set or cleared based on network address conditions, allowing rapid bitwise operations to determine packet processing actions without searching through traditional ruleset entries.
2Productivity
If firewall ruleset is encoded into bit arrays, then packet processing speed increases, but device complexity increases
Solution Approach 1:
The patent segments the firewall ruleset into multiple bitmap arrays, with each array representing a specific set of processing rules. The bitmap data structure is divided into manageable segments where each bit corresponds to a specific network address or address range. This segmentation allows the complex ruleset to be processed through systematic bitwise operations on smaller data structures, reducing the complexity of individual processing steps while maintaining overall comprehensive security coverage.
Data Source
AI summary
Aspects of the present disclosure involve systems, methods, for encoding a firewall ruleset into one or more bit arrays for fast determination of processing of a received communication packet by a firewall device associated with a network. Through this bitmap, a number of computation operations needed to determine a processing rule for a received packet is significantly reduced compared to the traditional approach of using a hash or a longest prefix match technique. Rather, determining a processing rule for a received packet may include determining a bit value within one or more arrays. In one implementation, a firewall rule may be encoded into a 64-bit array of bit values in which each bit of the array corresponds to a particular processing rule for a particular network address. The firewall rule may be encoded into a bitmap array of bit values by asserting a particular bit within the array.