Conditional filtering for time-deterministic firewall
AssigneesHirschmann Automation and Control GmbH, Hochschule Esslingen
InventorsTobias Heer, Lukas Bechtel
Life of this patent
Estimating the term…
Abstract
The invention relates to a method for allowing data packets in a network to arrive at the recipient at definable times. The method requires a firewall in a computer network. Each data packet which is transmitted through the firewall to a recipient is assigned a time budget for processing in the firewall. After the time budget has expired, the firewall performs a firewall action for each data packet, which can be executed as sending to the recipient or discarding the packet. The time budget may be less than the processing time required by the firewall to completely process all filter rules, and thus forms a termination condition for processing the data packet in the firewall.
Claims15
A method for allowing data packets in a network to arrive at a recipient at specified times, the method performed with a firewall in a computer network, the firewall containing filter rules, the method comprising:
- upon receipt at an input of the firewall of a data packet addressed to the recipient, recording an arrival time for the data packet;
- assigning to the data packet a time budget for processing of the data packet in the firewall;
- applying the filter rules to the data packet until either (i) all of the filter rules applicable to the data packet are processed or (ii) expiration of the time budget;
- and
- upon expiration of the time budget before completion of processing of the filter rules:
- performing a predefined firewall action for the data packet, the predefined firewall action comprising forwarding the data packet to an output of the firewall or discarding the data packet;
- and
- marking the data packet and/or a stored copy of the data packet with metadata indicating an index of a last-processed rule.
The method according to 9, further comprising post-processing, after the predefined firewall action, the copy of the data packet from the buffer to complete processing of the outstanding filter rules of the firewall, starting at the index of the last-processed rule.
Dependencies are inferred from the claim text.