Stateless Marking for Stateful Firewall Rule Processing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Hardware switches face limitations in managing stateful session and rule changes due to memory and resource constraints, leading to high latency and CPU utilization in processing firewall rules, especially with dynamic security group memberships in datacenters.

Innovation Solution

Combining stateless and stateful features by provisioning IP sets/security groups/containers into hardware switches to mark incoming packets, allowing stateful engines to process rules efficiently, with stateless lookups performed on hardware and stateful processing in software, leveraging CAM/TCAM for fast lookups and rule matching.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If stateful session management is implemented in hardware switches, then processing speed is improved, but memory and resource constraints prevent supporting sufficient connection flows

Engineering Contradiction:

Improvepacket processing speedVSAvoidnumber of supported connection flows

Core Design Contradiction:

SpeedVSQuantity of substance

Solution Approach 1:

The patent segments packet processing into two distinct phases: stateless lookup phase handled by hardware switch for fast initial classification, and stateful processing phase handled by software for comprehensive session management. This segmentation allows hardware to operate within its memory constraints while software handles the full complexity of stateful processing for all connection flows.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces packet markings as an intermediary mechanism that bridges hardware and software processing. Hardware switches mark packets with security group identifiers during stateless lookup, and these markings serve as input for software-based stateful processing. This intermediary approach enables efficient handoff between hardware and software domains.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If security group based rules are processed in software, then flexibility and adaptability are improved, but processing latency and CPU resource utilization increase

Engineering Contradiction:

Improvesecurity group management flexibilityVSAvoidpacket processing latency

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The patent implements preliminary action by having hardware switches perform stateless lookup and apply packet markings before packets reach software processing. Security group identifiers are determined and marked in advance during hardware processing, so software receives pre-classified packets with security group information already attached, reducing its processing burden and latency.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces the mechanical approach of processing all security group rules sequentially in software with a hybrid approach where hardware performs parallel stateless lookup and marking. This substitution of processing mechanics dramatically reduces the time burden on software while maintaining full security group management capabilities.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Productivity

If all firewall rules are processed in hardware, then processing speed is improved, but device complexity and resource requirements increase

Engineering Contradiction:

Improvepacket processing throughputVSAvoidhardware resource requirements

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent extracts the complex stateful processing functions from hardware and relocates them to software. Only the simpler stateless lookup and marking functions remain in hardware, which has sufficient resources for these operations. This extraction allows hardware to operate at high speed without being burdened by the complexity of full stateful processing.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies local quality by optimizing hardware for stateless operations where speed is critical, while allowing software to handle stateful operations where flexibility is more important. Each processing domain is tailored to its strengths: hardware provides fast parallel lookup and marking, while software provides comprehensive session management and rule evaluation.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS9729512B2Use of stateless marking to speed up stateful firewall rule processing

Publication Date: 2017.08.08 VMWARE INC

AI summary

A novel method for stateful packet classification that uses hardware resources for performing stateless lookups and software resources for performing stateful connection flow handshaking is provided. To classify an incoming packet from a network, some embodiments perform stateless look up operations for the incoming packet in hardware and forward the result of the stateless look up to the software. The software in turn uses the result of the stateless look up to perform the stateful connection flow handshaking and to determine the result of the stateful packet classification.