Packet Filtering Using Linked Binary Search Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current packet filtering systems face challenges in efficiently processing packets at high speeds due to limited time available for examination, as they need to quickly determine whether a packet poses a threat or requires action, especially at 10 Gbps rates where only 67.2 nanoseconds are available per packet.
Innovation Solution
A hardware-based packet filtering system utilizing linked zero-based binary search trees, which allows for fast lookups and filtering by sorting and arranging comparison words into binary search trees, enabling efficient classification and action on packets based on their contents, such as source or destination IP addresses, while using flags and masks to optimize processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional packet filtering methods are used, then filtering accuracy can be maintained, but filtering speed becomes insufficient at high transmission rates
Solution Approach 1:
The patent segments the packet filtering problem into multiple binary search trees, each handling a specific range of packet values. This division allows parallel processing of different packet ranges, significantly increasing filtering speed while maintaining accuracy. Each BST is optimized for a specific segment of the search space, enabling faster lookups compared to a single large filtering structure.
Solution Approach 2:
The patent performs preliminary actions by pre-sorting and organizing filter rules into binary search trees before packet filtering begins. This preprocessing step creates an optimized data structure that enables rapid packet classification during actual filtering operations, reducing the time available per packet while maintaining filtering accuracy.
2Reliability
If more filtering rules are added to improve security coverage, then filtering accuracy improves, but processing complexity increases
Solution Approach 1:
The patent divides the filtering system into multiple binary search trees, each managing a specific range of filter rules. This segmentation reduces the complexity of individual trees while maintaining comprehensive security coverage through the collective set of trees. Each BST handles a manageable subset of rules, making the overall system less complex than a single large filtering structure.
Solution Approach 2:
The patent introduces a new dimension to the filtering system by organizing rules into a multi-dimensional binary search tree structure. This dimensional organization allows efficient indexing and retrieval of filtering rules, reducing system complexity while improving reliability through structured rule management.
Data Source
AI summary
A packet filtering system uses linked zero-based binary search trees to filter received packets. The binary search trees may be generated from filter conditions defining filter parameters for filtering packets.