Network Policy Range Segmentation for Verification Complexity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network analysis methods face infeasibility in verifying all combinations of traffic flow characteristics due to the complexity of IP addressing and port configurations, resulting in an overwhelming number of unique address pairs and port combinations that need to be evaluated.
Innovation Solution
A method and system that process network configuration to identify policy criteria and segregate the input space into non-overlapping sets of ranges, minimizing the number of combinations to be verified by defining minimal sets for each criteria such as protocol, source and destination IP addresses, and ports, thereby reducing the complexity of network behavior verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all combinations of traffic flow characteristics are verified, then complete network behavior verification is achieved, but computational complexity becomes infeasible
Solution Approach 1:
The patent segments the continuous input space of traffic flow characteristics into discrete ranges. For example, IP addresses are divided into range sets where each range represents a group of addresses that behave identically under given policies. This segmentation transforms the verification problem from checking individual address-port combinations to verifying representative values from each range, dramatically reducing computational complexity while maintaining verification completeness.
Solution Approach 2:
The patent changes the parameter representation from specific IP addresses and port numbers to ranges of these values. By transforming the verification criteria from exact matches to range-based matching, the system reduces the state space from 2^64 possible IP pairs to a manageable number of range combinations, making comprehensive verification feasible.
2Productivity
If discrete ranges are created for each policy criterion, then verification combinations are reduced, but the number of ranges to manage increases
Solution Approach 1:
The patent merges multiple policy criteria (source IP, destination IP, source port, destination port, protocol) into a unified range verification framework. Instead of managing separate range sets for each criterion independently, the system integrates them into a cohesive verification process where ranges are defined and managed collectively, reducing the overall management burden while maintaining the benefits of discretization.
Data Source
AI summary
A network configuration is processed to identify each policy and the criteria associated with each policy. The criteria of the policies are processed to identify a non-overlapping set of ranges of the criteria parameter, each range being associated with a particular policy or set of policies. In a preferred embodiment, the criteria include the protocol, the source and destination IP addresses, and the source and destination ports, and a default range is defined for each criteria parameter.