Firewall Rule Bit Arrays for Faster Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewall systems face significant latency in processing communication packets due to the time-consuming process of searching through large rulesets to determine the appropriate processing rule, even with techniques like hashing or longest prefix matching.
Innovation Solution
Encoding firewall rules into bit arrays (bitmaps) where each bit corresponds to a processing rule, allowing for rapid determination of packet processing rules using bitwise operations, reducing the need for extensive computations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional firewall ruleset search methods (hashing or longest prefix matching) are used, then rule lookup capability is maintained, but significant transmission time is spent searching the ruleset, slowing packet transmission speed
Solution Approach 1:
The patent transforms the firewall ruleset from a traditional list of network addresses and processing rules into a bitmap data structure where each bit represents a processing rule. This parameter change from linear/search-based representation to bit-level representation enables constant-time rule lookup by directly accessing the bitmap at the appropriate bit position, eliminating the need for sequential search through the ruleset and significantly reducing lookup time while maintaining full rule matching capability
Solution Approach 2:
The patent replaces the mechanical search process (hashing or longest prefix matching algorithms that require multiple computations) with a direct bit access mechanism. Instead of executing computations to find matching rules, the system uses the network address to directly calculate and access the corresponding bit position in the bitmap, substituting complex computational mechanics with simple direct memory access to achieve faster packet processing
2Productivity
If firewall ruleset is stored as list of network addresses and processing rules, then complete rule processing capability is maintained, but significant time is spent searching for processing rules, reducing transmission efficiency
Solution Approach 1:
The patent fundamentally changes how the ruleset is represented by converting it into a bitmap structure where each bit corresponds to a processing rule. This allows the system to maintain complete rule processing capability while reducing the time to find processing rules from sequential search to direct bit access, thereby improving packet processing efficiency
Solution Approach 2:
The patent segments the ruleset into individual bits within a bitmap structure, where each bit independently represents a processing rule. This segmentation allows for parallel processing and direct random access to any rule without scanning through previous rules, enabling efficient packet processing by accessing only the relevant bit position based on the network address
Data Source
AI summary
Aspects of the present disclosure involve systems, methods, for encoding a firewall ruleset into one or more bit arrays for fast determination of processing of a received communication packet by a firewall device associated with a network. Through this bitmap, a number of computation operations needed to determine a processing rule for a received packet is significantly reduced compared to the traditional approach of using a hash or a longest prefix match technique. Rather, determining a processing rule for a received packet may include determining a bit value within one or more arrays. In one implementation, a firewall rule may be encoded into a 64-bit array of bit values in which each bit of the array corresponds to a particular processing rule for a particular network address. The firewall rule may be encoded into a bitmap array of bit values by asserting a particular bit within the array.