Stateful Network Switch Rule Logic With Timed Packet Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network switches lack the ability to efficiently manage packet processing rules without relying on external processors, particularly for protocols without built-in handshake mechanisms, leading to increased workload on external systems like firewalls.
Innovation Solution
Implementing a network switch with a rule logic and memory that includes a counter mechanism, using content addressable memory (CAM) for high-speed rule lookups and a countdown timer to manage rule validity, allowing stateful packet processing without external processor involvement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network switches use traditional packet forwarding methods without dynamic rule management, then device complexity is reduced, but productivity decreases due to increased workload on external firewalls and inability to enforce dynamic security policies
Solution Approach 1:
The patent merges firewall rule enforcement capabilities directly into the network switch by integrating a rule logic unit that can inspect packets, match them against stored rules, and enforce actions without external processor involvement. This combines previously separate functions (switching and firewall processing) into a single device, improving productivity while managing complexity through integrated design
Solution Approach 2:
The patent implements preliminary action by pre-loading security rules into the switch's rule logic unit before packet processing begins. The switch proactively enforces these rules at the data link layer, performing security checks in advance rather than relying on external firewalls to process packets later, thereby improving processing efficiency
2Reliability
If network switches enforce dynamic packet processing rules autonomously, then reliability of security policy enforcement is improved, but device complexity increases due to additional rule logic and memory requirements
Solution Approach 1:
The patent implements self-service by enabling the network switch to autonomously manage its own rule set without requiring constant external processor intervention. The rule logic unit independently inspects packets, matches them against stored rules, and enforces actions based on predefined criteria, allowing the device to serve itself in rule enforcement while maintaining high reliability
Solution Approach 2:
The patent applies dynamics by implementing a timer unit that automatically updates rule validity periods and activates/deactivates rules based on elapsed time. This dynamic rule management allows the switch to adapt security policies over time without manual intervention, improving reliability while managing complexity through automated temporal control
3Adaptability or versatility
If network switches inspect packet content for rule matching, then adaptability to dynamic security policies is improved, but speed of packet processing decreases due to increased inspection overhead
Solution Approach 1:
The patent applies partial action by implementing selective packet inspection where the rule logic unit only examines specific packet fields relevant to active rules rather than performing exhaustive deep packet inspection on all packets. This allows the switch to maintain adaptability to dynamic policies while minimizing processing overhead and preserving forwarding speed for packets that don't require full inspection
4Ease of operation
If network switches use external processors for rule management, then ease of operation is improved, but loss of time increases due to external communication overhead
Solution Approach 1:
The patent extracts the time-critical rule enforcement function from external processors and places it directly within the network switch's rule logic unit. While rule configuration can still be performed externally for ease of operation, the actual packet inspection and rule matching occurs locally within the switch, eliminating communication overhead and time delays associated with external processor involvement
Data Source
Figure 1~2
Figure 3
AI summary
A network switch is disclosed. The network switch includes an input port and an output port. The network switch further includes a rule logic and a memory for storing a configurable counter. The rule logic is configured to inspect a packet received via the input port and attempt to find a rule for the packet and if the rule is found, to reset the counter and process the packet according to a preconfigured follow up action associated with the rule and if the rule is not found, to route the packet according to a default rule. The rule logic is configured to identify the packet for a follow up action based at least on a subset of content of the packet including a header and a payload of the packet. The counter may hold a time value or the number of packets from a same source to a same destination, a number of bytes received from the same source to a same destination, or a user configurable parameter to control the rule validity period.