Network Security Policy Database Reconstruction for Matching Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face inefficiencies in matching security policies due to repeated matching features and actions, leading to low matching efficiency when the number of security policies is large.
Innovation Solution
A method and apparatus that determine whether the number of rules with the same matching feature reaches a preset threshold, reconstructing policies in a second database with matching features as the primary key, and combining policies with the same matching feature to improve matching efficiency and reduce storage space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If policies are stored with policy ID as primary key in first policy database, then policy management is straightforward, but matching efficiency deteriorates due to repeated matching of same matching features across multiple policies
Solution Approach 1:
The patent segments the policy database into two distinct databases: first policy database storing original policies with policy ID as primary key, and second policy database storing reconstructed policies with matching feature as primary key. This segmentation allows separate optimization for different operations - straightforward policy management in first database and efficient matching in second database.
Solution Approach 2:
The patent creates a copy of policy data in a different structure. The second policy database is a reconstructed copy where policies are reorganized with matching feature as primary key and actions stored as two-tuples (policy ID, action). This copying enables efficient matching without altering the original policy storage structure.
2Quantity of substance
If multiple policies with same matching feature are stored separately, then policy detail information is preserved, but storage space is wasted due to redundancy
Solution Approach 1:
The patent merges multiple policies that share the same matching feature into a single reconstructed policy entry in the second policy database. Instead of storing each policy separately, it combines them by storing the matching feature once with a two-tuple containing policy ID and action, eliminating redundant storage of identical matching features while preserving all policy details through the two-tuple references.
3Loss of time
If all policies are matched sequentially by policy ID, then policy execution order is maintained, but matching time increases with large number of policies
Solution Approach 1:
The patent inverts the traditional matching approach by using matching feature as the primary key for lookup instead of sequentially searching by policy ID. This inversion transforms the matching operation from a sequential search through multiple policies into a direct key-based lookup, dramatically reducing matching time while maintaining ease of operation through index-based access.
Data Source
AI summary
According to an example, a network security device determines whether a number of rules with a same matching feature in a first policy database reaches a preset threshold, wherein the first policy database records one or more first policies, each of the first policies comprises a policy identity (ID) and a plurality of rules respectively associated with the policy ID, each of the rules comprises a matching feature and an action associated with the matching feature; and generates a second policy database recording one or more second policies, by reconstructing the first policies in the first policy database when the number of rules with the same matching feature reaches the preset threshold, wherein each of the second policies comprises a matching feature and a target two-tuple comprising a policy id and an action associated with the matching feature.