System, method and computer software products for network firewall fast policy look-up

A method for processing a policy-lookup for network protection by employing a policy table comprising a plurality of policy-table entries PTE(ip), where ip=1, 2, 3, . . . N and N is a positive integer representing a total number of said PTE(ip), with each PTE(ip) comprising data for defining a plurality of destination address ranges between a first destination address DA1(ip) and a second destination address DA2(ip), a source address ranges between a first source address SA1(ip) and second source address SA(ip), a destination port group ranging between a first destination port DP1(ip) and second destination port DP2(ip) and a source port group ranging between a first source port SP1(ip) and a second source port SP2(ip), said method comprising steps of:

• generating an array of destination address segments by arranging ranges represented by {DA1(ip), DA2(ip)}, for ip=1, 2, 3, . . . N, according to a destination address sequential order thus generating a plurality of destination address segments S1(Idas) between first destination address A11 (Idas) and second destination address A12(Idas) where Idas is a series of destination address sequence number (DASN) and Idas=1, 2, 3, . . . IIdas, and IIdas is a positive integer less than or equal to 2N−1;
• generating an array of source address segments by arranging ranges represented by {SA1(ip), SA2(ip)}, for ip=1, 2, 3, . . . N, according to a source address sequential order thus generating a plurality of source address segments S2(Isas) between a first source address A21(Isas) and a second source address A22(Isas), where Isas is a series of source address sequence number (SASN) and Isas=1, 2, 3, . . . IIsas, and IIsas is a positive integer less than or equal to 2N−1;
• forming a source-destination address mapping table (SDAMT) comprising a plurality of SDAMT table entries SDA(Isas, Idas) with Isas=1, 2, 3, . . . IIsas, and Idas=1, 2, 3, . . . IIdas and SD(Isas, Idas)=ip1 wherein ip1 is a policy-table entry counter of a first policy table entry wherein said S2(Isas) is included a range defined by SA1(ip1) and SA2(ip1), and said S1(Idas)is included in a range defined by DA1(ip1), DA2(ip1);
• generating an array of destination port segments by arranging ranges represented by {DP1(ip), DP2(ip)}, for ip=1, 2, 3, . . . N, according to a destination address sequential order thus generating a plurality of destination address segments P1(Idps) between a first destination port P11 (Idps) and a second destination port P12(Idps), where Idps is a series of destination port sequence number (DPSN) and Idps=1, 2, 3, . . . IIdps, and IIdps is a positive integer less than or equal to 2N−1;
• generating an array of source port segments by arranging ranges represented by {SP1(ip), SP2(ip)}, for ip=1, 2, 3, . . . N, according to a source address sequential order thus generating a plurality of source address segments S2(Isps) between a first source port P21(Isps) and a second source port P22(Isps), where Isps is a series of source address sequence number (SPSN) and Isps=1, 2, 3, . . . IIsps, and IIsps is a positive integer less than or equal to 2N−1;
• and
• forming a source-destination port mapping table (SDPMT) comprising a plurality of SDPMT table entries SDP(Isps, Idps) with Isps=1, 2, 3, . . . IIsps, and Idps=1, 2, 3, . . . IIdps and SDP(Isps, Idps)=ip2 wherein ip2 is a policy-table entry counter of a first policy table entry wherein said S2(Isps) is included a range defined by SP1(ip2) and SP2(ip2), and said S2(Idps)is included in a range defined by DP1(ip2), DP2(ip2).