Merging Filter Rules to Reduce Lookup Cycles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security devices, such as firewalls, face challenges in efficiently managing multiple filter rules, leading to increased lookup cycles and potential performance degradation, which can impact their ability to maintain line-rate performance and provide additional functionalities.
Innovation Solution
The technique involves merging multiple filter rules into a single merged filter, allowing network devices to apply these rules in a reduced number of clock cycles, thereby meeting tight timing constraints and freeing up resources for other components, while maintaining line-rate performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple filter rules are applied separately by different filter matching modules, then comprehensive security coverage is achieved, but the number of lookup cycles increases and performance degradation occurs
Solution Approach 1:
The patent merges multiple filter rules from different filter matching modules into a single consolidated filter rule. This is achieved by combining the matching criteria from multiple filters using logical AND operations and combining the actions using logical OR operations, thereby reducing the number of separate lookups required while maintaining comprehensive security coverage
2Reliability
If multiple filter rules are applied separately, then comprehensive packet filtering is achieved, but tight timing constraints cannot be met
Solution Approach 1:
The patent consolidates multiple filter rules into a single merged filter rule that can be evaluated in one lookup cycle. By combining matching criteria with logical AND and actions with logical OR, the system achieves comprehensive filtering completeness while meeting tight timing constraints through reduced lookup operations
3Reliability
If multiple separate filter rules are maintained, then comprehensive security policies are enforced, but additional functionalities cannot be provided due to resource constraints
Solution Approach 1:
The patent merges multiple filter rules into a single consolidated rule structure that maintains comprehensive security policy enforcement. The merged filter combines matching criteria using logical AND and actions using logical OR, freeing up hardware resources that can then be allocated to provide additional network functionalities
Data Source
AI summary
The invention is directed to techniques for managing filter rules applied to network traffic at a network device. A network device merges multiple filter rules associated with separate filter matching modules to reduce lookup cycles in a forwarding path of the network device. The network device may thus simultaneously apply multiple filter rules in a reduced number of clock cycles. A network device comprises an interface that receives packets from a network, a filter memory that stores a plurality of filters, and a plurality of filter matching modules that apply the filters to packets in a forwarding path of the network device. A filter control module merges two or more filters each associated with a different one of the filter matching modules into a single merged filter, and stores the merged filter to the filter memory. The network device applies the merged filter to packets in the forwarding path.