Firewall system for controlling data flow between computing resources

1 . A computer-implemented method performed at a firewall device, comprising:

receiving a plurality of rules for controlling a flow of data between computing resources;

identifying a respective set of criteria that exists in each of the plurality of rules, wherein a number and a sequence of the respective set of criteria in one rule of the plurality of rules differs from a number and a sequence of the respective set of criteria in another rule of the plurality of rules;

selecting a respective subset of the respective set of criteria that exists in each of the plurality of rules and that exists in common across each of the plurality of rules, resulting in an identical respective subset of the respective set of criteria for each of the plurality of rules;

ordering in an identical sequence the criteria in the identical respective subset of the respective set of criteria for each of the plurality of rules, resulting in a revised plurality of rules where in each rule in the revised plurality of rules comprises a same number of criteria that are sequenced in a same order;

storing the revised plurality of rules in a memory accessible to the firewall device, organized as a prefix tree data structure comprising a linked plurality of nodes corresponding to the revised plurality of rules;

receiving a flow of data from a first computing resource that is destined to a second computing resource;

searching the prefix tree data structure stored in the memory accessible to the firewall device for any rule in the revised plurality of rules that applies to controlling the received flow of data from the first computing resource to the second computing resource;

identifying one or more of the revised plurality of rules in the prefix tree data structure that apply to controlling the received flow of data from the first computing resource to the second computing resource in response to searching the prefix tree data structure for any rule in the revised plurality of rules that applies to controlling the received flow of data from the first computing resource to the second computing resource;

selecting a rule in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource; and

controlling the received flow of data from the first computing resource to the second computing resource according to the selected rule.

2 . The computer-implemented method of claim 1 , wherein ordering in the identical sequence the criteria in the identical respective subset of the respective set of criteria for each of the plurality of rules, resulting in the revised plurality of rules where in each rule in the revised plurality of rules comprises the same number of criteria that are sequenced in the same order is performed to optimize searching the prefix tree data structure for any rule in the revised plurality of rules that applies to controlling the flow of data between computing resources.

3 . The computer-implemented method of claim 1 , wherein selecting the rule in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource comprises selecting the rule in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource based on an associated precedence value for the rule.

4 . The computer-implemented method of claim 3 , further comprising storing an associated precedence for each rule in the revised set of rules in one of a leaf node of the linked plurality of nodes corresponding to the rule and an entry in a hash lookup table associated with the prefix tree data structure.

5 . The computer-implemented method of claim 1 , wherein controlling the received flow of data from the first computing resources to the second computing resource according to the selected rule comprises taking an action with respect to the received flow of data, the action selected from a group of actions consisting of: blocking transmission, and allowing transmission, of the received flow of data from the first computing resource to the second computing resource according to the selected rule.

6 . The computer-implemented method of claim 5 , further comprising storing an associated action for each rule in the revised plurality of rules in a leaf node of the linked plurality of nodes corresponding to the rule.

7 . A computing system, comprising:

one or more processors;

a memory storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving at the computing system a plurality of rules for controlling a flow of data between computing resources;

identifying a respective set of criteria that exists in each of the plurality of rules, wherein a number and a sequence of the respective set of criteria in one rule of the plurality of rules differs from a number and a sequence of the respective set of criteria in another rule of the plurality of rules into a respective sequence of criteria;

selecting a respective subset of the respective set of criteria that exists in each of the plurality of rules and that exists in common across each of the plurality of rules, resulting in an identical respective subset of the respective set of criteria for each of the plurality of rules;

ordering in an identical sequence the criteria in the identical respective subset of the respective set of criteria for each of the plurality of rules, resulting in a revised plurality of rules wherein each rule in the revised plurality of rules comprises a same number of criteria that are sequenced in a same order; and

storing the revised plurality of rules in the memory, organized as a prefix tree data structure comprising a linked plurality of nodes corresponding to the revised plurality of rules;

receiving at the computing system a flow of data from a first computing resource that is destined to a second computing resource;

searching the prefix tree data structure stored in the memory for any rule in the revised plurality of rules that applies to controlling the received flow of data from the first computing resource to the second computing resource;

identifying at the computing system one or more of the revised plurality of rules in the prefix tree data structure that apply to controlling the received flow of data from the first computing resource to the second computing resource in response to searching the prefix tree data structure for any rule in the revised plurality of rules that applies to controlling the received flow of data from the first computing resource to the second computing resource;

selecting at the computing system a rule in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource; and

controlling at the computing system the received flow of data from the first computing resource to the second computing resource according to the selected rule.

8 . The computing system of claim 7 , wherein ordering in the identical sequence the criteria in the identical respective subset of the respective set of criteria for each of the plurality of rules, resulting in the revised plurality of rules wherein each rule in the revised plurality of rules comprises the same number of criteria that are sequenced in the same order is performed to optimize searching the prefix tree data structure for any rule in the revised plurality of rules that applies to controlling the flow of data between computing resources.

9 . The computing system of claim 7 , wherein selecting at the computing system the rule in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource comprises selecting the rule in the identified one or more of the revised plurality of rules that has a highest precedence among the rules in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource.

10 . The computing system of claim 7 , wherein controlling at the computing system the received flow of data from the first computing resources to the second computing resource according to the selected rule comprises taking an action at the computing system with respect to the received flow of data, the action selected from a group of actions consisting of: blocking transmission, and allowing transmission, of the received flow of data from the first computing resource to the second computing resource according to the selected rule.

11 . One or more non-transitory computer-readable media storing computer-executable instructions for an event query host that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving at the event query host a plurality of rules for controlling a flow of data between computing resources;

identifying a respective set of criteria that exists in each of the plurality of rules into a respective sequence of criteria, wherein a number and a sequence of the respective set of criteria in one rule of the plurality of rules differs from a number and a sequence of the respective set of criteria in another rule of the plurality of rules;

selecting a respective subset of the respective set of criteria that exists in each of the plurality of rules and that exists in common across each of the plurality of rules, resulting in an identical respective subset of the respective set of criteria for each of the plurality of rules:

ordering in an identical sequence the criteria in the identical respective subset of the respective set of criteria for each of the plurality of rules, resulting in a revised plurality of rules wherein each rule in the revised plurality of rules comprises a same number of criteria that are sequenced in a same order; storing the revised plurality of rules in a memory accessible to the event query host, organized as a prefix tree data structure comprising a linked plurality of nodes corresponding to the revised plurality of rules;

receiving at the event query host a flow of data from a first computing resource that is destined to a second computing resource; searching the prefix tree data structure stored in the memory accessible to the event query host for any rule in the revised plurality of rules that applies to controlling the received flow of data from the first computing resource to the second computing resource;

identifying at the event query host one or more of the revised plurality of rules in the prefix tree data structure that apply to controlling the received flow of data from the first computing resource to the second computing resource in response to searching the prefix tree data structure for any rule in the revised plurality of rules that applies to controlling the received flow of data from the first computing resource to the second computing resource;

selecting at the event query host a rule in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource; and

controlling at the event query host the received flow of data from the first computing resource to the second computing resource according to the selected rule.

12 . The one or more non-transitory computer-readable media of claim 11 , wherein ordering in the identical sequence the criteria in the identical respective subset of the respective set of criteria for each of the plurality of rules, resulting in the revised plurality of rules wherein each rule in the revised plurality of rules comprises the same number of criteria that are sequenced in the same order is performed to optimize searching the prefix tree data structure for any rule in the revised plurality of rules that applies to controlling the flow of data between computing resources.

13 . The one or more non-transitory computer-readable media of claim 11 , wherein selecting at the event query host the rule in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource comprises selecting the rule in the identified one or more of the revised plurality of rules that has a highest precedence among the rules in the identified one or more of the revised plurality of rules to control the received flow of data from the first computing resource to the second computing resource.

14 . The one or more non-transitory computer-readable media of claim 11 , wherein controlling at the event query host the received flow of data from the first computing resources to the second computing resource according to the selected rule comprises one of blocking transmission and allowing transmission of the received flow of data from the first computing resource to the second computing resource according to the selected rule.