NIC Packet Classification Filter Ingress Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In modern computing devices, the complex filtering and inspection of network packets lead to excessive CPU core usage, which is costly for both cloud service users and providers, especially in high-speed data transmission scenarios.
Innovation Solution
A system and method for filtering network packets on ingress using a network interface controller (NIC) that compares packets to classification filters, associates them with identifiers, and sends these identifiers to the operating system to determine operations, thereby reducing the need for deep packet inspection and minimizing CPU usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complex filtering and inspection of network packets is performed, then packet classification accuracy is improved, but CPU core usage increases
Solution Approach 1:
The patent segments the packet filtering and inspection tasks across multiple CPU cores, distributing the processing load. Each core handles specific filtering operations independently, reducing the burden on any single core while maintaining comprehensive packet inspection capabilities.
Solution Approach 2:
The system performs preliminary packet filtering and classification using classification filters before full packet inspection. By pre-processing packets and identifying those requiring detailed inspection, the system reduces the overall CPU processing burden while maintaining accurate classification.
2Productivity
If more processor cores are used to process network packets, then packet processing capability is improved, but operational cost increases
Solution Approach 1:
The patent implements dynamic CPU core allocation where the number of active processor cores adjusts based on network traffic load. During low-traffic periods, fewer cores are active, reducing operational costs. During high-traffic periods, more cores are activated to maintain processing capability, optimizing the balance between productivity and cost.
Solution Approach 2:
The system changes operational parameters by adjusting the depth of packet inspection and the number of active filtering rules based on traffic characteristics. For routine traffic, shallow inspection is used; for suspicious or high-priority traffic, deeper inspection is performed, optimizing resource utilization and reducing overall operational costs.
3Reliability
If deep network packet inspection is performed, then security monitoring is improved, but processing speed decreases
Solution Approach 1:
The patent applies partial inspection by examining only specific portions of packets based on classification results. Rather than inspecting every packet in full detail, the system performs deep inspection only on packets that match suspicious patterns or require security scrutiny, while allowing other packets to pass through with minimal inspection, thus maintaining both security and speed.
Data Source
AI summary
Technologies for filtering network packets on ingress include a network interface controller (NIC) to retrieve classification filters based on packet classification identifying information of a network packet received by the NIC, wherein each of the classification filters is usable to identify rules for identifying any operations to be performed on at least a portion of the received network packet. The NIC is further configured to compare the first classification filter to the packet classification identifying information to determine whether the determined packet classification identifying information meets criteria of the first classification filter. Additionally, the NIC is configured to associate a classification filter identifier of the first classification filter with the received network packet and send the received network packet and the classification filter identifier of the first classification filter to a processor of an apparatus associated with the NIC. Other embodiments are described herein.