Hierarchical Policy Tree for Fast Network Security Lookup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IPSec policy retrieval methods, such as linked lists and hash tables, face inefficiencies due to overlapping policies and the need for fast deterministic policy lookup in network security systems, while hardware solutions like TCAM are costly and limited in capacity.
Innovation Solution
The method involves creating Subnet Elements (SE), IP Address Trees (IT), Attribute Trees (AT), and Priority Trees (PT) to efficiently store and search for policies based on priority, allowing early termination of searches when a higher-priority policy is found, thereby reducing the number of comparisons needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If software approaches like linked lists or hash tables are used for policy retrieval, then implementation cost is reduced, but search time increases and throughput decreases
Solution Approach 1:
The policy database is segmented into multiple hierarchical levels (root level, intermediate levels, and leaf levels). Each level contains policy selectors organized in a tree structure, allowing the search process to be divided into multiple stages. This segmentation enables parallel processing and reduces the number of policies examined at each stage, thereby improving throughput while maintaining software implementation.
Solution Approach 2:
Policies are pre-organized into a hierarchical tree structure with selectors distributed across multiple levels before the search begins. The root level contains broad selectors, and more specific selectors are placed at deeper levels. This preliminary organization allows the search algorithm to quickly eliminate large portions of the policy database by comparing packet selectors against the hierarchical structure, reducing search time and improving throughput.
2Measurement precision
If the number of policy selectors is increased to improve matching accuracy, then policy selection precision improves, but search time increases
Solution Approach 1:
The hierarchical tree structure segments the policy selectors into multiple levels. The root level contains fewer, broader selectors that provide initial filtering, while intermediate and leaf levels contain more specific selectors. This segmentation allows the system to use many selectors for accurate matching without requiring all selectors to be examined simultaneously, as the hierarchical structure enables early termination when a match is found at any level.
Solution Approach 2:
The search algorithm performs partial examination of policy selectors by traversing the hierarchical tree and stopping when a match is found. It does not need to examine all selectors in the database, but only those relevant to the packet being processed. This partial action approach maintains high matching accuracy while reducing the average search time by avoiding unnecessary comparisons.
3Loss of time
If hardware solutions like TCAM are used for fast policy lookup, then search time is reduced, but device cost and complexity increase
Solution Approach 1:
The patent creates a software-based copy of the TCAM functionality by implementing a hierarchical policy tree structure that mimics the fast lookup behavior of hardware TCAM. The tree structure organizes policy selectors in a way that enables efficient traversal and matching, replicating the constant-time lookup capability of TCAM using software data structures and algorithms, thereby achieving similar performance without the hardware complexity and cost.
4Device complexity
If policies are stored in a flat structure for simplicity, then device complexity is reduced, but search efficiency decreases
Solution Approach 1:
The policy database is transformed from a flat structure into a hierarchical tree structure segmented into multiple levels. Each level contains policy selectors organized by specificity and priority. This segmentation improves search efficiency by enabling the algorithm to traverse from general to specific selectors, eliminating the need to examine all policies in a flat structure, thereby achieving faster search without excessive complexity.
Solution Approach 2:
The patent adds a hierarchical dimension to the policy storage structure by organizing selectors across multiple levels (root, intermediate, leaf) rather than in a single flat layer. This dimensional change enables the search algorithm to exploit the hierarchical relationships between selectors, improving search efficiency by allowing early termination and prioritized matching, while the tree structure remains manageable and not excessively complex.
Data Source
AI summary
A method and apparatus for representing policies and searching for polices that match a packet are provided. The policies being represented and searched for include policies that overlap and policies that have “don't care” attributes.