Network Security Device for Mid-Flow Packet Policy Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security devices, such as firewalls, face reduced effectiveness and efficiency in mid-flow situations where the first network packet received is not the initial packet of a network flow, especially in cloud-based environments with load-balancing, leading to inefficiencies in enforcing network traffic policies.
Innovation Solution
The technology utilizes network topology information and attributes of network packets to enhance the evaluation process by employing normal and reverse ruleset evaluations, along with tie-breaker and priority mechanisms to determine the appropriate rule match for network packets in mid-flow scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network security devices use traditional ruleset evaluation methods, then the device complexity remains low, but the reliability of enforcing network traffic policies deteriorates in mid-flow situations
Solution Approach 1:
The patent applies reverse ruleset evaluation by switching the source and destination addresses of network packets and re-evaluating them against the ruleset. This inversion mechanism enables the security device to correctly identify and enforce policies for mid-flow packets that would otherwise be misclassified, thereby improving policy enforcement reliability without requiring complete redesign of the evaluation architecture
Solution Approach 2:
The patent modifies packet attributes (specifically source and destination addresses) to generate alternative representations of the same packet. By changing these parameters and re-evaluating against the ruleset, the system can accurately determine the correct policy match even when the original packet evaluation fails due to mid-flow conditions, thus improving reliability while maintaining operational simplicity
2Measurement precision
If network security devices perform comprehensive ruleset evaluation for all packets, then the measurement precision of packet classification improves, but the productivity of the device deteriorates
Solution Approach 1:
The patent performs reverse ruleset evaluation only for packets that fail to match during the initial evaluation or are identified as mid-flow packets. This partial application of the more complex evaluation method only where necessary maintains high classification accuracy for challenging cases while avoiding the performance penalty of comprehensive re-evaluation for all packets, thus preserving overall processing speed
Solution Approach 2:
The system uses feedback from the initial ruleset evaluation to determine whether reverse evaluation is needed. By analyzing the results of the first evaluation and identifying packets that require additional processing, the system can selectively apply the more thorough measurement approach only when necessary, balancing accuracy with processing efficiency
3Reliability
If network security devices handle mid-flow packets using conventional methods, then the ease of operation is maintained, but the reliability of security enforcement deteriorates
Solution Approach 1:
The reverse evaluation mechanism automatically handles mid-flow packets by inverting their address fields and re-evaluating them against the ruleset. This automated inversion process eliminates the need for manual intervention or complex processing logic, maintaining ease of operation while significantly improving the reliability of security enforcement for mid-flow scenarios
Data Source
AI summary
Operations of a security device are provided herein. The operations may include receiving, via a first network interface, a network packet, and evaluating attributes of the received network packet against a ruleset to identify a first rule match, wherein the attributes comprise an identifier of the first network interface, a source address, and a destination address. The operations may further include comparing the attributes of the received network packet against a table listing one or more network devices associated with the first network interface or a second network interface. The operations may further include switching the attributes of the received network packet by changing the identifier of the first network interface to an identifier of the second network interface and swapping the source address and the destination address, and evaluating the switched attributes of the received network packet against the ruleset to identify a second rule match. The switched attributes of the received network packet may be compared against the table, and one of the first rule match or the second rule match may be selected based on the comparisons of the network packet attributes and the switched network packet attributes against the table. The received network packet may be processed according to the selected one of the first rule match or the second rule match.