Function-Parallel Firewall Architecture for QoS and DoS Resilience
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network firewalls face challenges in maintaining Quality of Service (QoS) guarantees and are susceptible to bottlenecks and Denial of Service (DoS) attacks due to increasing traffic loads and complex rule sets, leading to poor network performance and potential disconnection from the outside world.
Innovation Solution
A function-parallel firewall architecture is introduced, where multiple firewall nodes implement different portions of the rule set, allowing for hierarchical distribution and stateful inspection, with a controller managing logical connections to ensure efficient traffic processing and redundancy, thereby maintaining QoS and reducing the impact of DoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single firewall processes all traffic using a complete rule set, then security inspection is thorough, but the firewall becomes a bottleneck and cannot maintain QoS guarantees
Solution Approach 1:
The patent divides the complete firewall rule set into multiple subsets and distributes them across multiple firewall nodes. Each node processes a portion of the traffic in parallel, eliminating the single-point bottleneck while maintaining comprehensive security inspection through coordinated rule evaluation across the distributed system.
Solution Approach 2:
The patent transitions from a single-dimensional sequential processing model to a multi-dimensional parallel processing architecture. By introducing spatial distribution across multiple nodes and organizing rules in a hierarchical structure with multiple levels, the system achieves both thorough inspection and high throughput simultaneously.
2Productivity
If multiple identical firewalls process traffic in parallel (data-parallel architecture), then throughput increases, but QoS cannot be maintained due to queuing delays
Solution Approach 1:
The patent segments the rule set into different subsets assigned to different firewall nodes, creating a function-parallel architecture where each node specializes in evaluating specific rules. This eliminates the need for complex load balancing and queuing mechanisms required in data-parallel systems, thereby reducing packet delay while maintaining high throughput.
Solution Approach 2:
Each firewall node is configured with specific rule subsets tailored to its function, allowing it to process certain types of packets more efficiently. This local optimization enables the system to maintain QoS by directing packets to the most appropriate node based on the rule matching requirements, reducing unnecessary processing and queuing delays.
3Reliability
If firewall rule sets become more complex to enhance security, then security policy coverage improves, but processing time increases and QoS cannot be maintained
Solution Approach 1:
The patent divides complex rule sets into smaller, manageable subsets distributed across multiple nodes. Each node processes a limited portion of the rules, reducing the time required for individual packet inspection while the collective system maintains comprehensive security coverage through the combined rule sets across all nodes.
Solution Approach 2:
The patent introduces a hierarchical dimension to rule organization, with multiple levels of rule subsets. This allows the system to process packets through progressively specialized rule layers, reducing the average inspection time by eliminating the need to evaluate all rules for every packet, while still maintaining complete security policy coverage through the hierarchical structure.
4Productivity
If a firewall is overwhelmed with traffic loads, then it can handle more packets, but it becomes susceptible to DoS attacks and legitimate traffic encounters long delays
Solution Approach 1:
The patent distributes traffic handling across multiple firewall nodes, each processing a subset of rules. This segmentation prevents any single node from being overwhelmed, as the distributed architecture naturally limits the impact of DoS attacks to specific nodes rather than the entire system, maintaining reliability while handling high traffic loads.
Solution Approach 2:
The system incorporates redundant firewall nodes and distributed rule processing capabilities that provide a buffer against DoS attacks. When attack traffic targets specific nodes, other nodes continue processing legitimate traffic, providing beforehand cushioning that maintains system reliability and prevents complete system failure under attack conditions.
Data Source
AI summary
Methods, systems, and computer program products for providing function-parallel firewalls are disclosed. According to one aspect, a function-parallel firewall includes a first firewall node for filtering received packets using a first portion of a rule set including a plurality of rules. The first portion includes less than all of the rules in the rule set. At least one second firewall node filters packets using a second portion of the rule set. The second portion includes at least one rule in the rule set that is not present in the first portion. The first and second portions together include all of the rules in the rule set.