Rule Engine Hash Table Lookup Key Generation for Packet Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Rule engines in packet-based communication networks face performance issues due to the time required to check multiple rules, memory usage, and slow memory accesses, especially when handling a large number of rules.
Innovation Solution
A method and system for a rule engine that generates lookup keys from packet fields, accesses a data structure correlating key values with records indicating further tests to determine rule matches, using hash tables, TRIE, TCAM, and Bloom filters to efficiently check packets against multiple rules without locking the memory unit, allowing for real-time packet filtering with minimal resource dependence on the number of rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a rule engine checks all rules sequentially to ensure accurate packet filtering, then the matching accuracy is improved, but the processing speed deteriorates
Solution Approach 1:
The patent segments the rule set into multiple groups or categories, allowing the rule engine to check packets against relevant rule groups in parallel or in a optimized sequence rather than checking all rules sequentially. This segmentation enables the system to maintain high accuracy by checking all applicable rules while significantly improving processing speed through selective and parallel evaluation of rule segments.
2Adaptability or versatility
If the rule engine increases the number of rules to handle more packet types, then the filtering capability is improved, but the memory usage and access time worsen
Solution Approach 1:
The patent introduces hierarchical organization of rules with multiple levels of specificity, adding a dimensional structure to the rule storage. Rules are arranged in tiers from general to specific, allowing the engine to quickly eliminate packets using broad category rules while storing detailed specific rules in a structured manner that optimizes memory access patterns and reduces the effective memory footprint for common packet types.
3Reliability
If the rule engine performs comprehensive rule checking on every packet, then the security coverage is improved, but the processing time increases
Solution Approach 1:
The patent implements preliminary packet classification and filtering stages that perform preliminary actions on packets before they reach the full rule engine. Quick-filter rules and common pattern matching are executed in advance, allowing the comprehensive rule checking to be applied only to packets that require detailed inspection, thereby maintaining full security coverage while reducing average processing time for the overall packet stream.
4Productivity
If the rule engine uses complex data structures to optimize rule lookup, then the rule checking speed is improved, but the device complexity increases
Solution Approach 1:
The patent employs dynamic rule compilation and caching mechanisms that adapt the data structure based on the actual rule set and packet traffic patterns. The system dynamically generates optimized lookup structures from the configured rules, allowing the same rule engine to efficiently handle different rule sets without requiring manual reconfiguration of complex data structures. This dynamic adaptation maintains high checking speed while reducing the apparent complexity for rule deployment.
Data Source
AI summary
A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.