IP Policy Matching Using Ordered Subranges for Fast Lookup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for policy matching in network security apparatuses that convert IP addresses into network segments and use Trie acceleration tables face issues of long construction times, high memory consumption, and reduced search speed due to the large number of IP addresses involved.
Innovation Solution
Construct an IP policy group based on a set algorithm, dividing IP addresses into non-overlapping subranges and ordering them, using a searching algorithm to match IP addresses with corresponding security policies, such as binary search or balanced binary trees, to improve matching speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a Trie acceleration table is constructed to match IP addresses with security policies, then the matching speed is improved, but the memory consumption increases significantly and construction time is prolonged
Solution Approach 1:
The patent segments the IP address space into hierarchical network segments (e.g., /8, /16, /24 prefixes) and organizes them in a tree structure. Instead of storing all individual IP addresses, it stores only the segment prefixes, thereby reducing memory consumption while maintaining fast matching capability through hierarchical traversal.
Solution Approach 2:
The patent transforms the flat IP address matching problem into a hierarchical dimensional structure by organizing IP addresses into network segments with different prefix lengths. This dimensional transformation allows the system to match IP addresses by traversing hierarchical levels rather than linearly searching through all addresses, improving speed while reducing storage requirements.
2Speed
If a Trie acceleration table is constructed to match IP addresses with security policies, then the matching speed is improved, but the construction time is prolonged
Solution Approach 1:
The patent performs preliminary organization of IP addresses into hierarchical network segments during the configuration phase. By pre-processing and structuring the IP address data into a tree format with proper prefix hierarchies, the system reduces the computational burden during both construction and matching operations, thereby reducing overall construction time while enabling fast matching.
3Quantity of substance
If traditional linear search method is used to match IP addresses with security policies, then the memory consumption is reduced, but the matching speed deteriorates
Solution Approach 1:
The patent divides the IP address space into hierarchical network segments and organizes them in a tree structure. This segmentation allows the system to use minimal memory by storing only segment prefixes rather than all individual IP addresses, while simultaneously improving matching speed through efficient hierarchical traversal compared to linear search.
4Speed
If IP addresses are converted into network segments and organized in a Trie structure, then the matching speed is improved, but the device complexity increases
Solution Approach 1:
The patent segments IP addresses into hierarchical network prefixes and organizes them in a Trie tree structure. While this introduces some structural complexity, the segmentation enables efficient matching by breaking down the problem into manageable hierarchical levels, making the complexity manageable and beneficial for performance.
Solution Approach 2:
The Trie data structure serves multiple functions simultaneously: it stores IP address segments, enables hierarchical organization, supports efficient prefix matching, and facilitates rapid policy lookup. This multi-functionality justifies the structural complexity by providing comprehensive benefits in a single data structure.
Data Source
Figure 1~2
Figure 3~4
AI summary
The present disclosure provides a policy matching method and apparatus. In an example of the present disclosure, a service packet is received. An IP policy group is searched based on a target internet protocol (IP) address of the service packet and by using a searching algorithm matching with the IP policy group. A target security policy is determined based on a target IP address subrange that the target IP address belongs to. A policy matching process is performed on the service packet by using the target security policy. Keys of the IP policy group include one or more IP address subranges obtained by dividing an IP address range that each of the IP addresses belongs to, values of the IP policy group include one or more security policies corresponding to one or more IP address ranges that each of the one or more IP address subranges belongs to.