Geoprocessing Packet Filtering via Spatial Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security systems face inefficiencies due to the time-consuming process of comparing packet information to large rule databases, particularly for whitelist or blacklist-based blocking, leading to delays and resource inefficiencies.
Innovation Solution
The implementation of geoprocessing-based packet processing using minimum bounding rectangles (MBRs) and spatial algorithms within an R-tree data structure to accelerate rule searching and matching, allowing for faster filtering and forwarding of packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional packet inspection methods are used with large rule databases, then network security coverage is improved, but processing time increases significantly
Solution Approach 1:
The patent segments the large rule database into hierarchical zones using geographic information systems (GIS). IP addresses are mapped to geographic locations and organized into nested zones (e.g., country-level, region-level, city-level zones). This segmentation allows the system to quickly eliminate entire zones that don't contain matching rules, rather than checking every individual rule in the database.
Solution Approach 2:
The patent introduces a spatial dimension to traditional packet filtering by mapping IP addresses to geographic coordinates and organizing rules in a two-dimensional spatial database. This transforms the traditional one-dimensional linear search through rule databases into a multi-dimensional spatial query problem, enabling faster retrieval through geometric operations and spatial indexing structures.
2Reliability
If comprehensive rule databases are maintained for security, then security effectiveness is improved, but computing resource requirements increase
Solution Approach 1:
The rule database is segmented into hierarchical geographic zones with varying levels of detail. Frequently accessed zones are maintained with high precision, while less frequently accessed zones use coarser granularity. This segmentation reduces the overall computational burden by allowing the system to work with smaller, more manageable subsets of the complete rule set.
Solution Approach 2:
The system performs preliminary actions by pre-processing and geocoding IP addresses into spatial coordinates before runtime packet filtering. Geographic boundary data is pre-computed and stored in optimized spatial indexes. This preliminary preparation eliminates the need for complex real-time calculations during packet processing, significantly reducing runtime computing resource requirements.
3Ease of manufacture
If linear search through rule databases is used, then implementation simplicity is maintained, but processing speed decreases
Solution Approach 1:
The patent transforms the linear search problem into a spatial query problem by organizing rules in a two-dimensional geographic space. This allows the use of efficient spatial indexing structures and geometric algorithms that can quickly eliminate large portions of the search space, achieving speeds orders of magnitude faster than linear search while maintaining reasonable implementation complexity through the use of established GIS technologies.
Data Source
AI summary
The present disclosure describes systems and methods for geoprocessing-based packet processing and network security. Filter parameters, such as Internet Protocol (IP) addresses or other such information, may be used to define one or more minimum bounding rectangles (MBR). Parameters of an incoming packet may be compared to the MBR data using spatial algorithms, such as a coordinate search within an R-tree data structure. The identified MBRs within the tree may be used to apply corresponding filtering and/or forwarding rules to the packet. This may significantly accelerate rule searching and matching algorithms, reducing delays and computing resource requirements and accelerating network security processing.