Firewall Rule Prefix Tree for Reducing Computational Cost
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network firewall systems face high computational costs due to the sequential evaluation of numerous rules, where many rules and their criteria are evaluated even if no rule applies, or if a rule is located far down the sequence, and common criteria are repeatedly evaluated.
Innovation Solution
Organizing network firewall rules into a prefix tree data structure (trie) to reduce the number of criteria evaluated by grouping rules with common prefixes and ignoring sections that do not match the flow, thereby minimizing computational costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall rules are evaluated sequentially to ensure highest precedence rule is applied, then correctness of flow control is improved, but computational cost increases significantly
Solution Approach 1:
The patent segments the flat sequential rule list into a hierarchical tree structure where rules are organized by common criteria prefixes. This segmentation allows the system to evaluate only relevant rule sections for each flow, avoiding unnecessary evaluation of unrelated rules while maintaining correctness through the hierarchical organization that preserves precedence relationships.
Solution Approach 2:
The patent performs preliminary action by pre-organizing firewall rules into a tree data structure during rule configuration, grouping rules by common criteria prefixes. This preliminary organization enables efficient runtime evaluation by allowing the system to quickly identify and evaluate only the relevant rule sections that match incoming flows, rather than sequentially checking all rules.
2Reliability
If all rules and their criteria are evaluated for every flow, then completeness of rule checking is improved, but processing time increases
Solution Approach 1:
The patent extracts and eliminates unnecessary rule evaluations by organizing rules into a tree structure where common criteria prefixes are shared. When evaluating a flow, the system extracts and evaluates only the relevant rule sections that match the flow's characteristics, taking out the evaluation of unrelated rules entirely while maintaining completeness for applicable rules.
Solution Approach 2:
The patent segments the complete rule set into hierarchical sections based on common criteria prefixes. This segmentation allows the system to evaluate only the necessary rule sections for each incoming flow, maintaining completeness of rule checking for applicable rules while avoiding redundant evaluation of unrelated rule sections.
3Device complexity
If rules are stored in sequential order, then simplicity of rule management is improved, but storage efficiency decreases
Solution Approach 1:
The patent merges rules that share common criteria prefixes into shared tree nodes, combining their storage representation. Instead of storing each rule's complete criteria independently, the system merges common prefix criteria into shared nodes, reducing redundant storage while maintaining the ability to manage and evaluate rules efficiently through the hierarchical structure.
Data Source
AI summary
A firewall receives a flow of data from a first computing resource destined to a second computing resource and searches, in a memory, a prefix tree data structure, the prefix data structure comprising a linked plurality of nodes corresponding to normalized criteria for each of a plurality of rules, for any rule in the plurality of rules that applies to controlling the received flow of data between the first computing resource and the second computing resource. If the search is successful, a set of rules in the prefix tree data structure is identified that apply to controlling the received flow of data from the first computing resource to the second computing resource in response to the searching. One of those rules in the set is then selected to control the received flow of data from the first computing resource to the second computing resource. Action is taken with respect to the received flow of data, for example, allowing or denying transmission of the received flow of data from the first computing resource to the second computing resource, according to the selected rule.