Single Feature Classifier for Network Security Group Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing packet processing systems face challenges in efficiently matching packets against complex network security group (NSG) rules, particularly in software-defined networks (SDN), due to limitations in hardware-based solutions, complexity of matches, and increased processor cycles.
Innovation Solution
The implementation of a single feature classifier that models all NSG rules for a given direction, using a classifier and match-action framework, allows for efficient OR matching against terms in NSG rules, reducing the number of classifiers and minimizing processor cycles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple classifiers are used to match packets against complex NSG rules, then matching accuracy is improved, but device complexity and processor cycles increase
Solution Approach 1:
The patent merges multiple classification rules into a single classifier by organizing them in a tree structure where internal nodes represent field comparisons and leaf nodes represent match actions. This consolidation maintains matching accuracy while reducing the number of separate classifier components needed in the system.
Solution Approach 2:
The patent segments the classification process into hierarchical levels within a single classifier, where each level handles specific packet fields. This segmentation allows complex matching logic to be distributed across tree levels rather than requiring multiple separate classifiers, reducing overall device complexity.
2Adaptability or versatility
If multiple classifiers are used to handle complex NSG rules, then rule coverage is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary organization of classification rules into a tree structure during system initialization. This pre-processing arranges rules in an optimized hierarchy that enables faster lookup during packet processing, reducing processing time while maintaining comprehensive rule coverage.
Solution Approach 2:
The patent transforms the classification problem from a multi-classifier parallel structure to a single classifier with hierarchical depth. By adding the dimension of tree levels and depths, the system achieves comprehensive rule coverage through vertical organization rather than horizontal expansion, reducing processing time.
3Speed
If hardware-based solutions are used for packet matching, then processing speed is improved, but adaptability to complex NSG rules deteriorates
Solution Approach 1:
The patent implements a dynamic classification tree structure that can be efficiently processed by hardware. The tree allows for adaptive rule insertion and modification while maintaining a structure suitable for high-speed lookup, bridging the gap between hardware speed requirements and software flexibility for complex rules.
Data Source
AI summary
Techniques are disclosed for generating a network packet classifier for network security groups. The network packet classifier is processed by a graph-based packet processor in a communications network. The network packet classifier is configured to classify network packets based on features grouped into feature types corresponding to header fields of the network packets. A single feature classifier is generated to model all rules in a network security group for a single data traffic direction. The single feature classifier is generated by grouping header fields, features, and feature match actions for network packets in the communications network.