Method, program and system for efficiently hashing packet keys into a firewall connection table
AssigneeInternational Business Machines Corporation
InventorsEverett Corl, Gordon Davis, Clark Jeffries, Steven Perrin, Hiroshi Takada, Victoria Thio
Life of this patent
Estimating the term…
Abstract
A method for increasing the capacity of a connection table in a firewall accelerator by means of mapping packets in one session with some common security actions into one table entry. For each of five Network Address Translation (NAT) configurations, a hash function is specified. The hash function takes into account which of four possible arrival types a packet at a firewall accelerator may have. When different arrival types of packets in the same session are processed, two or more arrival types may have the same hash value.
Claims32
A method comprising:
- providing in a network device a search facility to which packets received in said network device is to be mapped;
- defining N types of traffic arriving in said network device;
- selecting a set of parameters from each of the N types of traffic;
- generating a set of expressions based upon the selected parameters, said expressions showing relation between the N types of traffic;
- examining the expressions to detect those that would hash to a common value;
- and
- reserving a single location in the search facility to store look-up information for all of the N types of traffic with expressions hashing to the common value.
A method to map packets comprising:
- providing a search facility to which the packets are to be mapped;
- for each packet receive, comparing with a comparator a first parameter with a second parameter, both parameters selected from said each packet;
- if the comparison provides a first result, generating a first hashed value based upon the parameters in the received packet;
- and
- using the first hashed value to access a location in said search facility.
A system including:
- a firewall accelerator in which a look-up facility, to store common information related to selected ones of a predefined set of traffic types and specific information relating to at least one of the selected ones of the predefined set of traffic types, is being provided;
- and
- a controller parsing received packets to determine if a first predetermined relation between parameters in the received packets is found wherein selected parameters from said packet is hashed and hashed value is used as an index into said look-up facility.
A program product comprising:
- a recording medium on which a computer program is embedded, said computer program including instructions for;
- examining traffic arriving at ports of a firewall accelerator;
- selecting a first parameter and a second parameter from a packet in said traffic;
- comparing the first parameter with the second parameter;
- and
- if the first parameter is greater than the second parameter, generating a hashed value from parameters selected from the packet;
- and using the hashed value to access a location with in a look-up facility.
Dependencies are inferred from the claim text.