Stateful Packet Filtering via Source Address Flow Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Networking devices face a trade-off between simple, high-performance filtering and smarter, lower-performance stateful filtering, with existing systems lacking efficient mechanisms to manage packet flows based on historical data and requiring significant resources for high-performance operations.
Innovation Solution
The implementation of a stateful packet filtering system that modifies source addresses with flow identifiers, uses a security mechanism for lookup, and employs an ageing technique to quickly discard packets from known flows, allowing only the first packet of a flow to pass through while discarding subsequent packets from alternative paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If stateful filtering is implemented to make intelligent decisions based on flow history, then filtering intelligence and reliability improve, but device complexity and processing resources increase
Solution Approach 1:
The patent segments the stateful filtering function by separating flow identification (using simplified source address modification) from the actual filtering decision. This allows the high-performance simple filtering to operate on modified addresses while state information is maintained separately, resolving the contradiction between filtering intelligence and device complexity
Solution Approach 2:
The patent introduces a security mechanism as an intermediary that handles the complex stateful filtering logic. The security mechanism acts as a mediator between the incoming packets and the filtering decision, allowing the main filtering path to remain simple and high-performance while complexity is offloaded to the security lookup system
2Measurement precision
If state information is maintained for all flows to enable intelligent filtering, then filtering accuracy improves, but processing time and performance decrease
Solution Approach 1:
The patent extracts the essential state information needed for filtering by modifying only the source address field to include flow identifiers. This extraction approach maintains accurate flow identification without requiring complete state information for all flows, thereby preserving packet processing speed while improving filtering accuracy
Solution Approach 2:
The patent applies partial action by maintaining state information only for flows that require it, rather than all flows. The security mechanism selectively stores and checks state information, allowing accurate filtering for critical flows while ignoring less important traffic, thus maintaining high processing speed
3Productivity
If packets from known flows are discarded to prevent redundancy, then network efficiency improves, but false discarding of legitimate packets may occur
Solution Approach 1:
The patent implements dynamic filtering decisions based on flow state. The security mechanism dynamically determines whether to discard packets based on real-time state information, allowing the system to adapt to changing network conditions and distinguish between redundant packets and legitimate new flow packets, thus improving network efficiency while maintaining packet delivery reliability
Solution Approach 2:
The patent uses feedback from the security mechanism's state tracking to make intelligent filtering decisions. The system continuously monitors flow state and uses this feedback to determine whether packets should be discarded, preventing false discarding of legitimate packets while maximizing network efficiency through intelligent redundancy removal
Data Source
AI summary
A method for filtering packets, the method including receiving a plurality of packets, each packet of the plurality of packets including a source address, and for each one packet of the plurality of packets, processing the one packet by performing the following: modifying the source address of the one packet to include at least an identifier of a flow to which the one packet belongs. Related apparatus and methods are also provided.