Pre-classifier Layers for Network Security Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The enforcement of network security policies becomes complex and resource-intensive due to the 'filter explosion' caused by multidimensional filters, leading to increased memory and processor usage, difficulty in modifying policies, and inefficiencies in match lookup techniques.
Innovation Solution
The implementation of unidimensional pre-classifier layers that pre-classify network traffic and populate a bit array, reducing the number of filters needed and enabling efficient techniques like hashing and trie matching, thereby reducing resource consumption and simplifying policy modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multidimensional filters are used to enforce network security policy, then security protection effectiveness is improved, but device complexity and resource consumption increase due to filter explosion
Solution Approach 1:
The patent segments the network security filter into multiple hierarchical layers (e.g., transport layer, network layer, data link layer). Each layer independently processes specific protocol attributes and generates classification results that are passed to the next layer, avoiding the need to process all attributes simultaneously in a single complex filter.
Solution Approach 2:
The patent introduces a hierarchical layering dimension to organize filter processing. Instead of handling multidimensional filters in a flat structure, the system processes filters sequentially across multiple layers, where each layer adds a new dimension of processing for specific protocol attributes appropriate to that layer.
2Reliability
If multidimensional filters are used to enforce network security policy, then security protection effectiveness is improved, but memory and processor resource consumption increase
Solution Approach 1:
The patent segments the network security filter into multiple hierarchical layers (e.g., transport layer, network layer, data link layer). Each layer independently processes specific protocol attributes and generates classification results that are passed to the next layer, avoiding the need to process all attributes simultaneously in a single complex filter.
Solution Approach 2:
The patent performs preliminary classification at upper layers (e.g., transport layer) before lower layers process the traffic. Classification results from upper layers are reused by lower layers, preventing redundant processing of the same traffic multiple times across different filter layers and reducing overall computational resources required.
3Reliability
If multidimensional filters are used to enforce network security policy, then comprehensive security coverage is improved, but ease of operation deteriorates due to difficulty in modifying policies
Solution Approach 1:
The patent segments the network security filter into multiple hierarchical layers (e.g., transport layer, network layer, data link layer). Each layer independently processes specific protocol attributes and generates classification results that are passed to the next layer, avoiding the need to process all attributes simultaneously in a single complex filter.
Solution Approach 2:
The patent implements dynamic policy modification capability where security policies can be added, removed, or modified without requiring complete reconfiguration of the entire filter system. The hierarchical structure allows individual layers to be independently configured and updated, enabling flexible policy changes while maintaining comprehensive security coverage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer system enforces network security policy by pre-classifying network traffic. Unidimensional pre-classifier filters analyze network traffic to populate a pre-classifier bit array. Rather than having filter explosion with the creation of multidimensional filters, the pre-classifier bit array is used by other layers and/or filters to enforce network security policy. Further, reclassification of network traffic due to network security changes is streamlined due to the inclusion of pre-classifier layers and the pre-classifier bit array.