Patent Application
20050177544
The present invention is directed at an improved method for filtering data packets by determining if an incoming data packet IP address is present in a list of IP addresses.
Every day, countless data packets are transmitted from one computer to another within computer networks. Each data packet contains a source IP address, which is the where the data packet originated. Each data packet also contains a destination IP address, which is the ultimate destination for the data packet. Both IP addresses are a series of numbers separated by decimals, such as 172.168.4.2. A firewall uses the IP addresses to determine whether to permit a data packet to pass through the firewall. A computer network may have dozens of firewalls, each designed to permit or deny certain types of data packets. Because of the large quantity of data packets processed by each firewall, even small improvements in the processing time per data packet can have significant improvements in the overall efficiency of a single firewall, and thus, the computer network as a whole. Similarly, because Internet routers also use IP address filtering as a method for routing data packets, an increase in router efficiency can be realized by an improvement in filtering efficiency. Therefore, a need exists for an improved method for filtering data packet IP addresses.
One portion of the IP address filtering process is determining whether the incoming IP address is present in a list of IP addresses. Firewalls can have exclusion lists and/or inclusion lists. In other words, when a firewall receives a data packet, the firewall may determine whether the data packet source IP address is present in a list of allowable data packet IP addresses, determine if the source IP address is present in a list of prohibited data packet IP addresses, or a combination of the two. If the IP address is present in the list of allowable IP addresses and not in the list of prohibited IP addresses, the firewall permits the data packet to pass through the firewall. Otherwise, the firewall denies the data packet passage past the firewall. Thus, the firewall must determine whether an incoming numbered list (i.e. a destination IP address) is present in a numbered list data set (i.e. a list of IP addresses), regardless of whether the numbered list data set is allowable or prohibited numbered lists. For example, the firewall determines whether the incoming numbered list 1.3.2.4 is present in the numbered list data set 1.2.3.4, 1.4.3.2, 1.2.2.2, 1.3.2.4, and 4.2.3.6. The prior art method for determining whether the incoming numbered list is present in a numbered list data set is to create a tree containing all of the numbered lists in the numbered list data set. An example of a prior art tree for the numbered list data set above is illustrated in
One of the problems with the tree method for determining whether an incoming numbered list is present in a numbered list data set is that any of the numbered lists from the numbered list data set may contain a wildcard character. A wildcard character is a keyboard character that can be used to represent one or many characters. For example, the asterisk (*) typically represents one or more characters and the question mark (?) typically represents a single character. When a numbered list from the numbered list data set contains a wildcard character, there is at least one level of recursion in the process of determining whether an incoming numbered list is present in the numbered list data set. In other words, at each level in the tree, the firewall must make two determinations: whether any of the nodes represent a wildcard and whether the incoming numbered list matches any of the nodes. If a level contains a matching node and a wildcard node, then the firewall must traverse two paths down from that level. The presence of a wildcard at a lower level would create even more paths for the firewall to trace. Thus, wildcards in the tree lead to an increasing amount of computational steps and an undesirable increase in the time required to determine whether an incoming numbered list is present in a numbered list data set.
Consequently, a need exists in the art for an improved method for determining whether an incoming numbered list is present in a numbered list data set. Moreover, a need exists in the art for a method for determining whether an incoming numbered list is present in a numbered list data set that does not require extra computational steps when the numbered list data set contains a wildcard character. Finally, a need exists for a method for determining whether an incoming numbered list is present in a numbered list data set in which the method eliminates the need for recursive computational sets.
The present invention, which meets the needs identified above, is an improved method for filtering data packets through a firewall. The method improves over the prior art by allowing a firewall to determine whether an incoming numbered list is present in a numbered list data set in less time than the prior art methods. The present invention is particularly preferable when the numbered list data set and/or the incoming numbered list contain a wildcard character.
The software embodiment of the present invention comprises an Array Creation Program (ACP) and an Array Matching Program (AMP). The ACP assigns an ID to each of the numbered lists in the numbered list data set. The ID is a sequentially increasing power of two (i.e. 20=1, 21=2, 22=4, 23=8, 24=16 . . . ). The ACP then creates a plurality of arrays from the numbered list data set. The ACP modifies the array values based on the numbers in the numbered lists. The ACP only has to create the arrays when the firewall associated with the present invention receives an updated or modified numbered list data set.
When the firewall associated with the present invention receives an incoming numbered list, the AMP analyzes the numbers in the incoming numbered list to determine the hexadecimal values in the array fields associated with the numbers in the incoming numbered list. The AMP uses a counter and a Boolean AND operation to compare the incoming numbered list to the arrays. If the counter ever becomes zero, the AMP indicates that there is no match. After the processing is complete, a non-zero counter indicates that the incoming numbered data list is present in the numbered list data set. The location and quantity of ones (1) present in the binary version of the counter indicates the location of the match and the number of times the incoming numbered list is present in the numbered list data set.
The present invention also includes a Hashtable Creation Program (HCP) and a Hashtable Matching Program (HMP). The HCP is similar to the ACP, with the exception that the HCP creates hashtables instead of arrays for the numbered list data set. The HCP also creates a wildcard array. Hashtables utilize less memory than arrays when there is a large quantity of numbered lists in the numbered list data set. For example, hashtables would be preferable to arrays when processing IPv6 addresses (version 6 IP addresses), which range from zero (0) to 232 (4,294,967,296). However, arrays would be preferable to hashtables when processing IPv4 (version 4 IP addresses, which range from zero (0) to two hundred fifty five (255).
The HMP operates similarly to the AMP, but uses two counters to compare the incoming numbered list to the hashtables and the wildcard hashtable. If the first counter becomes zero, the HMP indicates that there is no match. After the processing is complete, a non-zero counter indicates that the incoming numbered data list is present in the numbered list data set. The location and quantity of ones (1) present in the binary version of the counter indicates the location of the match and the number of times the incoming numbered list is present in the numbered list data set.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
As used herein, the term “array” shall mean a data construct comprising a plurality of fields referenced by indexes, in which each field stores a value such as a binary, decimal, or hexadecimal number.
As used herein, the term “computer” shall mean a machine having a processor, a memory, and an operating system, capable of interaction with a user or other computer, and shall include without limitation firewalls, desktop computers, notebook computers, tablet personal computers, personal digital assistants (PDAs), servers, handheld computers, and similar devices.
As used herein, the term “field” shall mean an individual element within an array or a hashtable.
As used herein, the term “hashtable” shall mean a data construct comprising a plurality of fields referenced by keys, in which each field stores a value such as a binary, decimal, or hexadecimal number.
As used herein, the term “ID” shall mean an integer assigned to one of the numbered lists in a numbered list data set, wherein the ID is calculated by raising a fixed base number to a sequentially increasing power. The fixed base is typically two. The sequentially increasing power starts with zero and continues until each numbered list in the numbered list data set has been assigned an ID.
As used herein, the term “incoming numbered list” shall mean a numbered list that is compared to a numbered list data set. The present invention determines whether the incoming numbered list is present in the numbered list data set.
As used herein, the term “index” shall mean an integer or other character that allows direct access into an array without the need for a sequential search through the collection of fields.
As used herein, the term “key” shall mean an integer or other character that allows direct access into a hashtable without the need for a sequential search through the collection of fields.
As used herein, the term “MAXV” shall mean the maximum value of a number in a numbered list in a numbered list data set or an incoming numbered list. MAXV is chosen by a person of ordinary skill in the art such as an administrator of the present invention.
As used herein, the term “number” shall mean one of a plurality of integers separated by decimals in a numbered list.
As used herein, the term “numbered list” shall mean a plurality of numbers separated by decimals. A common example of a numbered list is an IP address.
As used herein, the term “numbered list data set” shall mean a plurality of numbered lists. The present invention determines whether the incoming numbered list is present in the numbered list data set.
As used herein, the term “recursion” shall mean the need to perform a plurality of similar computational steps from a single decision point in a computer program. Recursion is generally not preferable because of the increased computational time and increased probability of error.
As used herein, the term “translate” shall mean to convert between different bases for a number such as the binary, decimal, and hexadecimal bases.
As used herein, the term “value” shall mean the field entry from an array or hashtable.
As used herein, the term “wildcard” shall mean a keyboard character that can be used to represent one or many characters. The asterisk (*) typically represents one or more characters and the question mark (?) typically represents a single character.
As used herein, the term “wildcard array” shall mean an array or hashtable created to identify the location of wildcards in a numbered list data set.
The internal configuration of a firewall, including connection and orientation of the processor, memory, and input/output devices, is well known in the art. The present invention may be a method, a stand alone firewall program, or a plug-in to an existing firewall program. Persons of ordinary skill in the art are aware of how to configure firewall programs, such as those described herein, to plug into an existing firewall program. Referring to
Numbered list data set 120 is a database or computer file containing a plurality of numbered lists. Each numbered list comprises a plurality of numbers separated by decimals. Incoming numbered list 140 is a numbered list that needs to be routed to another computer. Incoming numbered list 140 is similar to the numbered lists in numbered list data set 120. Numbered list data set arrays are a plurality of arrays created by ACP 200 of the present invention. Numbered list data set hashtables 180 are a plurality of hashtables created by HCP 400 of the present invention. Wildcard array 190 is an array that identifies the location of wildcards in the numbered list data set when HCP 400 creates hashtables 180.
As part of the present invention, memory 100 can be configured with numbered list data set 120, incoming numbered list 140, numbered list data set array 160, numbered list data set hashtables 180, wildcard array 190, ACP 200, AMP 300, HCP 400, and/or HMP 500. Processor 106 can execute the instructions contained in ACP 200, AMP 300, HCP 400, and/or HMP 500. Processor 106 and memory 100 are part of a firewall such as firewall 92 in
In alternative embodiments, numbered list data set 120, incoming numbered list 140, numbered list data set array 160, numbered list data set hashtables 180, wildcard array 190, ACP 200, AMP 300, HCP 400, and/or HMP 500 can be stored in the memory of computers. Storing numbered list data set 120, incoming numbered list 140, numbered list data set array 160, numbered list data set hashtables 180, wildcard array 190, ACP 200, AMP 300, HCP 400, and/or HMP 500 in the memory of computers allows the processor workload to be distributed across a plurality of processors instead of a single processor. Further configurations of numbered list data set 120, incoming numbered list 140, numbered list data set array 160, numbered list data set hashtables 180, wildcard array 190, ACP 200, AMP 300, HCP 400, and/or HMP 500 across various memories are known by persons of ordinary skill in the art.
The present invention utilizes binary (base 2), decimal (base 10), and hexadecimal (base 16) numbers in its calculations. Each group of numbers is useful for specific purposes. For example, binary numbers are useful for performing Boolean operations. Decimal numbers are useful for humans to comprehend. Hexadecimal numbers are useful because computers process bytes (eight bits), which can be represented by a two digit hexadecimal number. In order to avoid confusion between hexadecimal and decimal numbers, hexadecimal numbers are followed by an H or preceded by &, $, or 0x. Table 1 below summarizes the translation between decimal numbers 0 through 5 and their binary and hexadecimal counterparts.
Persons of ordinary skill in the art are aware of how to translate between decimal, binary, and hexadecimal numbers.
When performing Boolean operations between binary numbers, the ones (1) represent true fields and the zeros (0) represent false fields. A Boolean AND operation determines whether all of the elements in a set are true. The results of the four different combinations of the Boolean AND operation are presented in Table 2 below.
Thus, in a Boolean AND operation, the result will be false unless all of the elements of the operation are true. The Boolean AND operation is valid for any number of elements. Similarly, a Boolean OR operation determines whether any of the elements in a set are true. The results of the four different combinations of the Boolean OR operation are presented in Table 3 below.
Thus, in a Boolean OR operation, the result will be true unless all of the elements of the operation are false. The Boolean OR operation is valid for any number of elements.
ACP 200 then creates a list of indexes and arrays (208). ACP 200 creates a number of arrays equal to the quantity of numbers in the numbered lists in the numbered list data set. For example, if the numbered list data set contains numbered lists with four numbers (i.e. 1.2.3.4), then ACP 200 creates four arrays. Each array is one field wide and MAXV fields long, where MAXV is the maximum value of a number in a numbered list in a numbered list data set or an incoming numbered list. MAXV is a number chosen by a person of ordinary skill in the art such as an administrator of the present invention.
ACP 200 then proceeds to the first numbered list in the numbered list data set (210). ACP 200 processes the numbered list in an orderly method. Generally, the numbered lists are presented horizontally with each numbered list on a separate line. Therefore, when proceeding from one numbered list to another, ACP 200 proceeds to the numbered list on the next line. Persons of ordinary skill in the art are aware of other methods for processing the numbered lists. ACP 200 also proceeds to the first array (212). The array may be like numbered list data set array 160 illustrated in
If at step 216, ACP 200 determines that the number is not a wildcard, then ACP 200 performs a Boolean OR operation on the ID and the array value with an index equal to the number (224). In other words, at step 224 ACP 200 performs only one Boolean OR operation in the present array. ACP 200 then proceeds to step 228.
At step 228, ACP 200 determines whether there are numbers remaining in the present numbered list (228). If ACP 200 determines that there are numbers remaining in the numbered list, then ACP 200 proceeds to the next number in the numbered list (230) and the next array (232) and returns to step 216. The next number in a numbered list is the leftmost number that has not been processed by steps 216 through 226. The next array is the leftmost array that has not been processed by steps 216 through 226. If at step 228 ACP 200 determines that there are not any numbers remaining in the present numbered list, then ACP 200 determines whether there are any numbered lists remaining (234). If ACP 200 determines that there are numbered lists remaining, then ACP 200 proceeds to the next numbered list in the numbered list data set (236). The next numbered list is the highest numbered list that has not been processed by steps 212 through 232. ACP 200 then returns to step 212. If at step 234 ACP 200 determines that there are not any numbered lists remaining, then ACP 200 ends (238).
At step 312, AMP 300 determines whether the present number in the incoming numbered list is the first number in the numbered list (312). If AMP 300 determines that the present number in the incoming numbered list is the first number in the numbered list, then AMP 300 sets the counter equal to the present array value with an index equal to the present number (314). AMP 300 then proceeds to step 324. If at step 312 AMP 300 determines that the present number in the incoming numbered list is not the first number in the numbered list, then AMP 300 obtains the present array value with an index equal to the present number (316). AMP 300 then performs a Boolean AND operation on the counter and the value from step 316, generating a new counter (320). In other words, the counter is set equal to the hexadecimal result of the Boolean AND operation. AMP 300 then proceeds to step 324.
At step 324, AMP 300 determines whether the counter is equal to zero (324). If AMP 300 determines that the counter is equal to zero, then AMP 300 indicates that the incoming numbered list is not present in the numbered list data set (334) and ends (336). If AMP 300 determines that the counter is not equal to zero, then AMP 300 determines whether there are numbers remaining in the incoming numbered list (326). If AMP 300 determines that there are numbers remaining in the incoming numbered list, then AMP 300 proceeds to the next number in the incoming numbered list (328). AMP 300 then proceeds to the next array (330) and returns to step 312. If at step 326 AMP 300 determines that there are not any numbers remaining in the incoming numbered list, then AMP 300 indicates that the incoming numbered list is present in the numbered list data set (332) and ends (336).
In an alternative embodiment, AMP 300 counts the quantity of ones (is) present in the binary version of the counter when AMP 300 ends. The location and quantity of ones (1) present in the binary version of the counter indicates the location of the match and the number of times the incoming numbered list is present in the numbered list data set.
A hashtable is a data construct that stores a set of items. Hashtables utilize less memory than arrays when there is a large quantity of numbered lists in the numbered list data sets. Each item in the hashtable has a key that identifies the item. Items are found, added, and removed from the hashtable by using the key. Table 4 outlines the differences between arrays and hashtables.
In their implementation, hashtables take the key and apply a mathematical hash function to “randomize” the keys and then use the hash to find the location in the hashtable. Good hashtable implementations will automatically resize the hashtable in memory if extra space is needed, or if too much space has been allocated. Hashtables are useful for: sets of data that need swift random access, with non-integral keys or non-contiguous integral keys, or where items will be frequently added or removed. Hashtables should not be used for: sets that need to be sorted, very small datasets (less than sixteen items), or data that does not need random access. In these situations, an array is more efficient. For example, hashtables would be referable to arrays when processing IPv6 addresses (version 6 IP addresses), which range from zero (0) to 232. However arrays would be referable to hashtables when processing IPv4 (version 4 IP addresses, which range from zero (0) to two hundred fifty five (255).
HCP 400 then creates a list of keys and hashtables (408). HCP 400 creates a number of hashtables equal to the quantity of numbers in the numbered lists in the numbered list data set. For example, if the numbered list data set contains numbered lists with four numbers (i.e. 1.2.3.4), then HCP 400 creates four hashtables. Each hashtable is one field wide contains a key for each number present in that particular number position. The hashtables ignore the wildcard characters. For example, if the numbered list data set is 1.2.3.4, 1.2.*.5, 1.1.3.4, and *.*.5.4, then the first hashtable would only have a key of one because the first number position does not contain any other numbers but one.
HCP 400 then creates the wildcard array (409). The wildcard array may be like wildcard array 190 depicted in
HCP 400 then proceeds to the first numbered list in the numbered list data set (410). HCP 400 processes the numbered list in an orderly method. Generally, the numbered lists are presented horizontally with each numbered list on a separate line. Therefore, when proceeding from one numbered list to another, HCP 400 proceeds to the numbered list on the next line. Persons of ordinary skill in the art are aware of other methods for processing the numbered lists. HCP 400 also proceeds to the first hashtable (412). The hashtable may be like numbered list data set hashtable 160 illustrated in
HCP 400 then determines whether the number is a wildcard (416). If HCP 400 determines that the number is a wildcard, then HCP 400 performs a Boolean OR operation on the ID and the wildcard array value with an index equal to the present number position (420). In other words, at step 440 HCP 400 performs only one Boolean OR operation in the present array. If HCP 400 is processing the first number in a numbered list, then the number position is one. HCP 400 then proceeds to step 428.
If at step 416, HCP 400 determines that the number is not a wildcard, then HCP 400 performs a Boolean OR operation on the ID and the hashtable value with a key equal to the number (424). In other words, at step 424 HCP 400 performs only one Boolean OR operation in the present array. HCP 400 then proceeds to step 428.
At step 428, HCP 400 determines whether there are numbers remaining in the present numbered list (428). If HCP 400 determines that there are numbers remaining in the numbered list, then HCP 400 proceeds to the next number in the numbered list (430) and the next hashtable (432) and returns to step 416. The next number in a numbered list is the leftmost number that has not been processed by steps 416 through 426. The next hashtable is the leftmost hashtable that has not been processed by steps 416 through 426. If at step 428 HCP 400 determines that there are not any numbers remaining in the present numbered list, then HCP 400 determines whether there are any numbered lists remaining (434). If HCP 400 determines that there are numbered lists remaining, then HCP 400 proceeds to the next numbered list in the numbered list data set (436). The next numbered list is the highest numbered list that has not been processed by steps 412 through 432. HCP 400 then returns to step 412. If at step 434 HCP 400 determines that there are not any numbered lists remaining, then HCP 400 ends (438).
At step 512, HMP 500 determines whether the present number in the incoming numbered list is the first number in the numbered list (512). If HMP 500 determines that the present number in the incoming numbered list is the first number in the numbered list, then HMP 500 sets the first counter equal to the present hashtable value with a key equal to the present number (514). HMP 500 obtains the wildcard array value with an index equal to the present number position (i.e. the first number) (516). HMP 500 then performs a Boolean OR operation on the first counter and the value from step 516, generating a new first counter (520). In other words, the first counter is set equal to the hexadecimal result of the Boolean OR operation. HMP 500 then proceeds to step 536.
If at step 512 HMP 500 determines that the present number in the incoming numbered list is not the first number in the numbered list, then HMP 500 sets the second counter equal to the present hashtable value with an key equal to the present number (524). HMP 500 obtains the wildcard array value with an index equal to the present number position (i.e. the second, third, or forth number) (526). HMP 500 then performs a Boolean OR operation on the second counter and the value from step 526, generating a first result (530). HMP 500 then performs a Boolean AND operation on the first result and the first counter, generating a new first counter (532). In other words, the first counter is set equal to the second hexadecimal result of the Boolean AND operation. HMP 500 then proceeds to step 536.
At step 536, HMP 500 determines whether the first counter is equal to zero (536). If HMP 500 determines that the first counter is equal to zero, then HMP 500 indicates that the incoming numbered list is not present in the numbered list data set (544) and ends (548). If HMP 500 determines that the first counter is not equal to zero, then HMP 500 determines whether there are numbers remaining in the incoming numbered list (538). If HMP 500 determines that there are numbers remaining in the incoming numbered list, then HMP 500 proceeds to the next number in the incoming numbered list (540). HMP 500 then proceeds to the next hashtable (542) and returns to step 512. If at step 538 HMP 500 determines that there are not any numbers remaining in the incoming numbered list, then HMP 500 indicates that the incoming numbered list is present in the numbered list data set (546) and ends (548).
In an alternative embodiment, HMP 500 counts the quantity of ones (Is) present in the binary version of the counter when HMP 500 ends. The location and quantity of ones (1) present in the binary version of the counter indicates the location of the match and the number of times the incoming numbered list is present in the numbered list data set.
Persons of ordinary skill in the art will appreciate that the present invention may be configured to process incoming numbered lists that contain wildcard characters. If an incoming numbered list contains a wildcard character, a person of ordinary skill in the art could modify AMP 300 or HMP 500 to recognize the wildcard character. Upon recognition of the wildcard character, the present invention would perform a Boolean OR operation between the counter (in the case of AMP 300) or the first counter (in the case of HMP 500) and a value equal to sum of the IDs for the numbered lists in the numbered list data set (i.e. decimal 15 or binary 1111 in the example presented herein). The Boolean OR operation would be performed prior to determining if the counter or first counter is equal to zero.
With respect to the above description, it is to be realized that the optimum dimensional relationships for the parts of the invention, to include variations in size, materials, shape, form, function, manner of operation, assembly, and use are deemed readily apparent and obvious to one of ordinary skill in the art. The present invention encompasses all equivalent relationships to those illustrated in the drawings and described in the specification. The novel spirit of the present invention is still embodied by reordering or deleting some of the steps contained in this disclosure. The spirit of the invention is not meant to be limited in any way except by proper construction of the following claims.
