摘要:
A method for increasing the capacity of a connection table in a firewall accelerator by means of mapping packets in one session with some common security actions into one table entry. For each of five Network Address Translation (NAT) configurations, a hash function is specified. The hash function takes into account which of four possible arrival types a packet at a firewall accelerator may have. When different arrival types of packets in the same session are processed, two or more arrival types may have the same hash value.
摘要:
A method for increasing the capacity of a connection table in a firewall accelerator by means of mapping packets in one session with some common security actions into one table entry. For each of five Network Address Translation (NAT) configurations, a hash function is specified. The hash function takes into account which of four possible arrival types a packet at a firewall accelerator may have. When different arrival types of packets in the same session are processed, two or more arrival types may have the same hash value.
摘要:
A method for increasing the capacity of a connection table in a firewall accelerator by means of mapping packets in one session with some common security actions into one table entry. For each of five Network Address Translation (NAT) configurations, a hash function is specified. The hash function takes into account which of four possible arrival types a packet at a firewall accelerator may have. When different arrival types of packets in the same session are processed, two or more arrival types may have the same hash value.
摘要:
A method and system for testing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules are used with a key that is capable of matching at least one of the plurality of filter rules. The at least one filter rule corresponds to at least one action. The computer system has a cache including a plurality of bins and a decision tree. The method and system include searching a plurality of stored keys in the cache for the key. Preferably, this search of the cache for the key includes determining whether a stored key exactly matches the key. A plurality of stored filter rules corresponds to the plurality of stored keys. A plurality of stored actions corresponds to the plurality of stored filter rules. The cache stores each of the plurality of stored keys and at least one stored action in each bin of a portion of the bins. The method and system also include obtaining the at least one action from the cache if the key is found in plurality of stored keys and otherwise obtaining the at least one action using the decision tree. Preferably, searches of the decision tree and cache start simultaneously. The decision tree search is terminated if the key is found in the cache. The cache is written to if the at least one action is obtained using the decision tree, but preferably only if the at least one filter rule has a priority of one.
摘要:
A method and system for determining whether to enforce a plurality of filter rules for a packet including a key in a computer network is disclosed. Each of the plurality of filter rules has a priority. The method and system include accumulating statistics for each of the plurality of filter rules. The statistics indicate a frequency of enforcement for each of the plurality of filter rules. The method and system also include placing the plurality of filter rules in an order for testing against the key. The order is based on the frequency of each filter rule of the portion of the plurality of filter rules. Consequently, more frequently enforced filter rules may be tested first.
摘要:
A method and system for storing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules uses at least one range of values in at least one dimension. The method and system include separating a portion of the plurality of filter rules into a plurality of pure subsets of filter rules. Each of the plurality of pure subsets of filter rules includes at least one of the plurality of filter rules. The method and system also include combining a portion of the plurality of pure subsets of filter rules to provide a combined subset and determining whether an efficiency of utilizing the plurality of filter rules is improved by combining the portion of the plurality of pure subsets of filter rules. The method and system further includes storing the plurality of filter rules including storing the portion of the plurality of subsets of filter rules as the combined subset if the efficiency of searching the plurality of filter rules is improved.
摘要:
A method and system for testing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules is used with a key. Each of the plurality of filter rules is capable of being described using a plurality of bits corresponding to a portion of the key. The plurality of bits can include at least one binary value, at least one wildcard, and at least one boundary symbol. The at least one binary value can be a zero or a one. The method and system include selecting a portion of the plurality of filter rules that the key can match by testing part of the key against a portion of the plurality of bits and explicitly testing the key against the portion of the plurality of filter rules. A first bit of the portion of the plurality of bits has a first maximum number of the at least one binary symbol for the plurality of filter rules. Each subsequent bit of the portion plurality of bits has a second maximum number of the at least one binary symbol for a plurality of remaining bits and is selected based on testing of a prior bit. Preferably, the portion of the plurality of bits is tested using a decision tree which includes nodes corresponding to a second portion of the plurality of bits.
摘要:
A method and system for graphically representing relationships between a plurality of filter rules in a computer system is disclosed. The computer system includes a display. Each of the plurality of filter rules has a priority. The method and system include allowing entry of at least one filter rule of the plurality of filter rules and providing a graphical display of a first portion of the plurality of filter rules on the display. Each of the first portion of the plurality of filter rules is displayed hierarchically based on the priority of each of the first portion of the plurality of filter rules. If the first portion of plurality of filter rules includes a plurality of intersecting filter rules, then displaying the plurality of intersecting filter rules in the graphical display to indicate at least one intersection of at least one higher priority filter rule and at least one lower priority filter rule and to indicate that the at least one higher priority filter rule dominates the at least one lower priority filter rule.
摘要:
A method and apparatus for processing network frames using static and dynamic classifiers provides a flexible and modifiable frame classification system. Static and Dynamic classifiers are used in combination within a network processing system to provide the range capability and hardware assist capability of the static classifier, along with the incremental modifications possible with a dynamic classifier. The dynamic classifier is searched first for rules directing processing of a received frame. The static classifier is searched only if a dynamic classifier key for the frame is not found, or the dynamic key actions indicated that the static classifier should also be searched.
摘要:
This process accepts rule domination declarations and subjects rules to a computer program which either finds a type of administrative error (cyclic domination) or assigns a priority number to each rule so that any two rules which intersect (some key fits both rules) have necessarily different priority numbers. In the case that priority numbers are assigned, the process goes on to check for a second type of administrative error, namely inclusion of a first rule in a second (every key which fits the first rule also fits the second), and with the second having higher priority (so that the first is never referenced). If neither error occurs, then the number of different priority numbers is minimized. Every key when tested by such a rule set with neither error must fit either no rules at all or must fit exactly one rule with highest priority. In the latter case, the action of the unambiguously determined rule can then be applied to the packet represented by the key.