Indexed Packet Filtering for Scalable Cybersecurity Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber defense systems face inefficiencies in enforcing large and rapidly growing cyber threat intelligence-derived policies due to high computational and memory demands, leading to performance degradation and increased latency, which are exacerbated by increasing network traffic rates and diverse threat indicators.
Innovation Solution
Implementing index data structures such as flat hash maps, ruletrees, and set data structures to efficiently search and enforce packet filtering rules, reducing the need for significant CPU and memory upgrades by optimizing the search process for in-transit packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional packet filtering methods are used to enforce cybersecurity policies, then network security protection is provided, but computational complexity and memory usage increase significantly with growing threat indicators
Solution Approach 1:
The patent segments the large cybersecurity policy into multiple smaller policy sets, each enforced by a separate packet filtering appliance. This division reduces the computational burden on individual devices while maintaining comprehensive security coverage across the network infrastructure.
Solution Approach 2:
The patent introduces a new dimension of policy enforcement by distributing security functions across multiple appliances in series. This spatial distribution transforms the problem from a single-point bottleneck into a distributed system where each appliance handles a manageable subset of rules.
2Reliability
If comprehensive cybersecurity policies with large numbers of packet filtering rules are enforced, then thorough threat detection is achieved, but processing latency increases
Solution Approach 1:
By dividing the comprehensive cybersecurity policy into smaller policy sets distributed across multiple appliances, each appliance processes fewer rules in sequence, thereby reducing the time required for packet filtering while maintaining overall detection thoroughness.
3Reliability
If packet filtering rules are expanded to cover diverse threat indicators, then security coverage is improved, but memory requirements increase
Solution Approach 1:
The patent divides the large set of packet filtering rules into smaller policy sets that can be stored in the limited memory of individual packet filtering appliances. This segmentation enables comprehensive security coverage to be achieved through distributed memory usage across multiple devices.
4Productivity
If network traffic rates increase, then network throughput is improved, but performance degradation occurs due to existing enforcement mechanisms
Solution Approach 1:
The patent segments the packet filtering function across multiple appliances processing packets in series. This distribution prevents any single device from becoming a performance bottleneck, allowing the network to handle increased traffic rates while maintaining stable performance across the distributed enforcement system.
Data Source
AI summary
Methods, apparatuses, systems, and machine-readable media are disclosed for improving packet filtering efficiency by reducing processing time and/or by reducing memory usage. Any of various types of data structures, such as flat hash maps and/or ruletrees, may be used by a packet filtering appliance to search for cybersecurity policy packet filtering rules that should be applied to in-transit packets. The packet filtering appliance may search the index data structures for matches of search objects, in the form of values that the packet filtering appliance extracts from in-transit packets, to threat indicator matching criteria of the policy rules. Each of the index data structures may map rule identifiers (rule IDs) of policy rules to keys that are based on (or that comprise) the matching criteria of those rules.