Routing Apparatus Packet Rule Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network systems using Linux operating systems, the comparison of packet rules, such as ACL and QoS rules, becomes inefficient when the number of rules increases, leading to decreased network processing performance.
Innovation Solution
A method for processing network packets that involves defining and recording packet processing rules with check conditions, allowing for path selection and filtering to identify specific rules, thereby reducing unnecessary comparisons and improving processing speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the number of ACL rules and QoS rules is increased to enhance security control and quality of service, then the security control capability and QoS function are improved, but the time required for packet rule comparison increases, degrading network processing performance
Solution Approach 1:
The patent segments the packet processing rules into different types (ACL rules and QoS rules) and organizes them in separate data structures. The check conditions are divided into condition types (source interface, destination interface, source address, destination address, network service), with each condition type having its own data structure storing rules that match that condition. This segmentation allows the system to process rules more efficiently by focusing on relevant conditions rather than checking all rules sequentially.
Solution Approach 2:
The patent performs preliminary actions by pre-processing and organizing rules into data structures before packet arrival. The rule corresponding module pre-establishes the mapping between check conditions and packet processing rules, so that when a packet arrives, the system can directly query the appropriate data structures without performing comprehensive rule comparison from scratch. This preliminary organization significantly reduces the time needed for rule comparison during actual packet processing.
2Reliability
If the forward hook sequentially compares packets with all ACL rules and QoS rules to ensure comprehensive security control, then the security control thoroughness is improved, but the network processing speed decreases
Solution Approach 1:
The patent applies local quality by making different parts of the rule comparison process have different characteristics. Instead of uniformly checking all rules with the same intensity, the system checks different condition types (source interface, destination interface, source address, destination address, network service) with appropriate specificity. The data structures are organized so that each condition type can be queried independently, allowing the system to apply the right level of detail to each condition based on its importance and the packet's characteristics.
Solution Approach 2:
The patent introduces intermediary data structures (arrays or lists) that map check condition types to their corresponding packet processing rules. These intermediaries act as mediators between the packet and the full rule set, allowing the system to efficiently navigate and query relevant rules without sequentially checking all rules. The rule corresponding module creates these intermediary mappings in advance, enabling fast lookup during packet processing.
3Measurement precision
If all packet processing rules are checked for each incoming packet to ensure accurate rule matching, then the rule matching accuracy is improved, but the processing time and system performance deteriorate
Solution Approach 1:
The patent transitions from a one-dimensional sequential rule checking approach to a multi-dimensional querying approach. Instead of checking rules in a single linear sequence, the system organizes rules across multiple dimensions (condition types: source interface, destination interface, source address, destination address, network service). Each dimension has its own data structure, allowing the system to query across multiple dimensions simultaneously and efficiently find matching rules without sequential inspection of all rules.
Data Source
AI summary
A routing apparatus and a method thereof for processing a network packet are provided. In the present method, a plurality of packet processing rules comprising a plurality of conditions are defined in the routing apparatus, and a relationship between each condition and the relative packet processing rules is recorded. After a packet enters the routing apparatus, it is determines that whether a specific packet processing rule can be found among the packet processing rules according to a plurality of packet information and the predefined relationship. If the specific packet processing rule can be found, the packet is processed by the specific packet processing rule. As a result, the performance of the routing apparatus and the processing speed can be increased.