Flow Class Grouping for Combined Firewall and QoS Treatment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems lack efficient mechanisms to apply quality of service (QoS) and firewall rules across multiple flows, particularly for traffic management based on communication protocols, user types, and locations, which limits flexibility and scalability in traffic treatment.
Innovation Solution
The implementation of flow classes with associated treatment rules allows for the grouping and management of flows, enabling the application of combined firewall and QoS treatments. This involves maintaining flow and flow class tables using hash tables for efficient lookup, allowing for constant-time assignment of packets and flows to appropriate treatment rules, and creating new flow classes based on assignment rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If QoS and firewall rules are applied to each individual flow separately, then each flow receives specific treatment, but the system complexity and management overhead increase significantly
Solution Approach 1:
The patent combines multiple individual flow rules into flow classes that can be applied collectively to groups of flows. Instead of managing separate QoS and firewall rules for each flow, the system creates flow classes that aggregate multiple flows and applies treatment rules at the class level, reducing system complexity while maintaining traffic treatment flexibility.
Solution Approach 2:
Flow classes serve multiple functions simultaneously: they group flows by characteristics, apply QoS treatments, enforce firewall rules, and enable scalable traffic management. This multi-functional approach allows a single flow class mechanism to replace multiple separate rule management systems.
2Productivity
If treatment rules are applied to large collections of flows, then management efficiency improves, but the ability to apply specific rules to individual flows decreases
Solution Approach 1:
The patent segments the rule application hierarchy into two levels: flow classes for collective treatment and individual flows for specific treatment. This segmentation allows efficient bulk management through flow classes while preserving the ability to apply flow-specific rules when needed, balancing management efficiency with treatment specificity.
Solution Approach 2:
Different levels of the system apply different granularities of rules: flow classes apply general treatment rules to groups of flows for efficient management, while individual flows can have specific rules applied locally. This local quality approach ensures that collective efficiency and individual specificity coexist without conflict.
3Reliability
If traditional flow table lookup methods are used, then packet routing is determined, but lookup time increases with the number of flows
Solution Approach 1:
The lookup process is segmented into two stages: first lookup the flow class table to determine the applicable flow class, then apply the pre-determined treatment rules for that class. This segmentation reduces the lookup time for individual packets by avoiding a linear search through all flow rules, while maintaining routing accuracy through the two-stage process.
Solution Approach 2:
Treatment rules for flow classes are determined in advance and stored in the flow class table. When a packet arrives, the system performs a preliminary lookup of the flow class and immediately applies the pre-computed treatment rules, eliminating the need for complex real-time rule evaluation and significantly reducing lookup time.
Data Source
AI summary
Flows are grouped into flow classes, each of which is assigned flow class treatment rules, which might combine application of both firewall and QoS treatments. When a flow is identified as a member of a flow class, traffic for that flow can be treated according to treatment rules collectively with other flows assigned to that flow class. New flows not already members of an already-defined flow class are examined according to a set of flow class assignment rules, which have the effect of either identifying the proper flow class for that flow, or creating a new flow class for that new flow. For each flow, a first packet determines flow assignment, after which succeeding packets are treated according that flow. For each flow class, a first flow determines flow class assignment, after which succeeding flows are collectively treated according to that flow class.