Unified Policy Execution for Network Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network devices face performance deterioration due to redundant and duplicate operations in policy execution processes, especially with increasing complexity and multiple service applications, leading to inefficient packet processing and rule verification.
Innovation Solution
A network device with a mixed orchestrator, condition matcher, and rule matcher is introduced, which performs mixed orchestration on service rules to extract conditions, remove duplicates, and generate mapping relationships, allowing for unified condition matching and rule verification, thereby reducing redundant operations and improving performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple service applications and policy rules are processed independently in each service, then service functionality is maintained, but device performance deteriorates due to redundant duplicate operations
Solution Approach 1:
The patent merges multiple independent service processing procedures into a unified policy execution framework. The policy execution module consolidates packet processing, condition matching, and rule verification across multiple services (IPS, URLF, ADC) into a single coordinated process, eliminating redundant operations while maintaining all service functionalities
Solution Approach 2:
The patent creates a universal policy execution module that serves multiple service applications simultaneously. This module performs packet processing, condition matching, and rule verification for all services through a single multi-functional mechanism, rather than having separate processing chains for each service
2Ease of operation
If packet processing is performed independently for each service, then service-specific requirements are met, but redundant scanning operations increase processing time
Solution Approach 1:
The patent performs packet processing and information extraction once as a preliminary action before condition matching for multiple services. The packet processing module extracts relevant information from packets in advance, making it available for all subsequent service-specific condition matching operations without re-scanning the packets
Solution Approach 2:
The patent combines multiple packet scanning operations into a single unified scanning process. Instead of each service (IPS, URLF, ADC) independently scanning packets, the system performs one comprehensive scan that collects all necessary information for all services simultaneously
3Adaptability or versatility
If condition matching and rule verification are duplicated for each service, then service independence is maintained, but operational efficiency decreases
Solution Approach 1:
The patent segments the policy execution process into distinct functional modules: packet processing module, condition matching module, and rule verification module. Each module handles a specific task, and the modules work in sequence to process multiple services without duplicating operations within each module
Solution Approach 2:
The patent introduces an intermediary policy execution module that sits between packet reception and service-specific processing. This intermediary consolidates condition matching and rule verification operations, then distributes results to various services, eliminating the need for each service to independently perform these operations
Data Source
AI summary
A policy processing method and network device. The method includes: performing a mixed orchestration on all service rules corresponding to multiple services, so as to construct multiple condition sets; performing, according to the constructed multiple condition sets, unified condition matching on packet feature information of a received network packet, and outputting a condition matching result set; and calling, a service application to execute a policy action corresponding to each condition identifier in the condition matching result set. In solutions of the embodiments of the present invention, by performing a mixed orchestration on multiple service rules, all service rules are organized in a unified manner, information required by all services is extracted in one packet scanning process, and only one matching and rule verification process is required. Thereby, redundant operations between multiple services are reduced, and device integration and performance are improved.