Policy Search Engine Speculation Unit for Network Policy Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for computer network policy search face challenges in handling the rapid increase in network bandwidth and complexity of network policies, leading to increased processing time and resource utilization, despite the use of hardware and software accelerators.
Innovation Solution
A policy search engine (PSE) with a speculation unit and a policy search processor (PSP) that identifies candidate policies through metadata-based screening and executes policy-search-specific instructions to efficiently traverse decision trees and evaluate rules, using hash-based or Deterministic Finite Automata (DFA) pattern matching for high-speed policy matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the number of network policies is increased to handle more complex security requirements, then the security coverage and detection capability are improved, but the packet processing time and computational resource consumption increase
Solution Approach 1:
The patent segments the large set of network policies into multiple smaller policy sets or policy groups. The policy search processor traverses these segmented policies in an organized manner, breaking down the complex search task into manageable portions. This segmentation reduces the time required to process packets by avoiding a linear search through all policies simultaneously.
Solution Approach 2:
The patent implements preliminary actions by performing policy pre-screening and metadata-based filtering before full policy evaluation. The speculation unit performs preliminary matching using packet metadata to identify candidate policies that may apply, eliminating the need to evaluate all policies against every packet. This preliminary action significantly reduces processing time while maintaining security coverage.
2Reliability
If the number of network policies is increased to handle more complex security requirements, then the security coverage and detection capability are improved, but the computational resource consumption increases
Solution Approach 1:
The patent extracts and utilizes packet metadata (such as source IP, destination IP, port numbers, protocol type) to perform preliminary policy screening. By extracting only the necessary metadata for candidate policy identification rather than performing full policy evaluations, the system significantly reduces computational resource consumption while maintaining comprehensive security coverage through subsequent detailed evaluation of only relevant policies.
Solution Approach 2:
The speculation unit performs preliminary policy filtering using packet metadata to identify candidate policies before full evaluation. This preliminary action consumes minimal computational resources compared to complete policy evaluation, yet it narrows down the search space significantly, reducing overall resource consumption while ensuring all applicable policies are eventually evaluated.
3Ease of manufacture
If traditional packet filtering methods are used to match packets against network policies, then the implementation is simple and straightforward, but the processing speed decreases and resource utilization increases
Solution Approach 1:
The patent introduces a policy search engine as an intermediary component between packet reception and policy evaluation. This intermediary includes a speculation unit that performs metadata-based pre-screening and a policy search processor that efficiently traverses organized policy sets. This intermediary layer adds implementation complexity but dramatically improves processing speed by filtering out non-matching policies before full evaluation.
Solution Approach 2:
The policy search engine performs preliminary actions by pre-processing and organizing policies into traversable structures, and by performing metadata-based candidate identification before full policy evaluation. This preliminary organization and filtering accelerates packet processing while maintaining implementation feasibility through modular architecture.
Data Source
AI summary
Systems and methods for accelerating computer network policy searching are provided. According to one embodiment, a packet is received by a policy search engine (PSE) of a packet processing device. A set of candidate policies are identified from among multiple policies of the packet processing device by screening the multiple policies by a speculation unit of the PSE based on metadata associated with the received packet. Finally, a matching policy for the received packet is identified by a policy search processor (PSP) of the PSE by executing policy-search-specific instructions and general purpose instructions.