Firewall Section Ordering via Binary Search Tree
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-defined data centers face challenges in managing complex firewall configurations for multiple tenants, requiring efficient and scalable methods to update and prioritize firewall rules without interfering with each other.
Innovation Solution
The method divides firewall configurations into sections, allowing each tenant to independently manage their sections with a prioritization system, using a binary search tree to efficiently assign and rebalance priority numbers, and employing a REST-compliant API for concurrent updates and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple tenants update firewall rules simultaneously, then the system can serve multiple tenants concurrently, but conflicts and interference between updates occur
Solution Approach 1:
The firewall configuration is divided into multiple sections, with each section assigned to a specific tenant. This segmentation allows tenants to independently manage their own sections without interfering with other tenants' sections, enabling concurrent updates while preventing conflicts. The system maintains section ownership information to ensure that each tenant can only modify their assigned sections.
2Adaptability or versatility
If firewall configuration is divided into multiple sections, then tenant independence and scalability are improved, but the complexity of managing section ordering and priorities increases
Solution Approach 1:
The system pre-assigns priority values to sections during configuration setup, establishing an initial ordering before runtime operations. This preliminary assignment of priorities simplifies subsequent management operations, as the system only needs to maintain existing priorities rather than dynamically calculate them during concurrent updates.
Solution Approach 2:
The patent introduces a firewall configuration manager as an intermediary component that handles section ordering and priority management. This mediator abstracts the complexity of section management from individual tenant operations, centralizing the logic for maintaining section order and priorities while allowing tenants to independently manage their sections.
3Productivity
If priority numbers are densely allocated to sections, then the ordering is compact and efficient, but adding new sections requires frequent rebalancing and affects existing priorities
Solution Approach 1:
The system allows priority numbers to be sparsely allocated rather than densely packed, creating local variations in spacing between priorities. This sparse allocation strategy enables new sections to be inserted by assigning them available priority values without requiring global rebalancing, thus reducing the time loss associated with reassigning priorities during dynamic updates.
Data Source
AI summary
A novel method for managing firewall configuration of a software defined data center is provided. Such a firewall configuration is divided into multiple sections that each contains a set of firewall rules. Each tenant of the software defined data center has a corresponding set of sections in the firewall configuration. The method allows each tenant to independently access and update/manage its own corresponding set of sections. Multiple tenants or users are allowed to make changes to the firewall configuration simultaneously.