Uneven-Density Policy Trees for Shallower Firewall Searches
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security policy sets with uneven density pose challenges in creating efficient policy trees due to wide ranges and overlapping policies, leading to deep tree structures and increased hardware costs.
Innovation Solution
A method to optimize policy tree creation by identifying density zones, generating child nodes with normal density zones, and using configurable partition numbers to reduce gaps through bitmap labeling and binary splits, allowing for shallower trees.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a higher partition number (PNR) is used to reduce tree depth, then search efficiency is improved, but hardware cost increases
Solution Approach 1:
The patent applies different partition numbers to different nodes in the policy tree based on local policy density characteristics. High-density regions use lower PNR to avoid excessive replication, while low-density regions can use higher PNR. This localized adaptation optimizes the balance between tree depth and hardware requirements without uniformly increasing hardware cost across the entire system.
Solution Approach 2:
The patent dynamically determines the partition number for each node based on the density of policies in that region, rather than using a fixed or uniformly high PNR. This dynamic adjustment allows the system to achieve good search efficiency only where needed while minimizing hardware costs in regions where high PNR would be wasteful.
2Length of moving object
If a higher partition number (PNR) is used, then tree depth is reduced, but policy replication in child nodes increases
Solution Approach 1:
The patent identifies high-density zones in the policy set and applies lower partition numbers specifically to nodes covering these zones, thereby reducing policy replication in child nodes where it would be most problematic. In low-density zones, higher partition numbers can be used without causing excessive replication, thus achieving overall tree depth reduction without uniformly increasing replication.
Solution Approach 2:
The patent changes the partition number parameter dynamically based on the density characteristics of different policy regions. By adjusting this parameter locally rather than globally, the system reduces tree depth in regions where it benefits search efficiency while avoiding excessive policy replication in regions where policies are already densely packed.
3Ease of manufacture
If simple even cuts are used to split policies, then tree creation is simplified, but gaps in uneven density policy sets cannot be effectively reduced
Solution Approach 1:
The patent introduces asymmetric cutting strategies that adapt to the density distribution of policies. Instead of always applying uniform even cuts, the system uses asymmetric partitioning in high-density regions to better fit the actual policy distribution, thereby reducing gaps and improving search efficiency while maintaining reasonable tree creation complexity through automated density-based decision making.
Solution Approach 2:
The patent performs preliminary analysis of policy density distribution before constructing the tree, identifying high-density and low-density zones in advance. This preliminary action enables the subsequent tree creation process to apply appropriate cutting strategies for each region, reducing gaps more effectively than simple even cuts while automating the complexity of density-based partitioning.
Data Source
AI summary
A policy tree of nodes and leaves is automatically created from a network security policy set, by identifying density zones of policy subsets. Responsive to identifying an uneven density zone in a node of the policy tree, child nodes are generated with normal density zones from the uneven density zones. A policy bitmap is generated from a set of network security policies. A partition number is configured during bitmap labeling for the policy bitmap. A configurable threshold during bitmap labeling is adjustable according to network security policies. Further, a plurality of boundaries between low-density zones and high-density zones utilizing bitmap labeling on the policy bitmap by counting lead zeros and tail zeros.