Prioritization for time-deterministic firewalls
The invention relates to a method for allowing data packets in a network to arrive at the recipient at definable times. The method requires a firewall in a computer network. Each data packet is processed within the firewall according to filter rules. Each data packet which is transmitted through the firewall to a recipient is assigned a prioritization for processing in the firewall. Each data packet is transmitted after the filter rules have been processed, but this transmission can be interrupted as soon as another data packet with a higher prioritization arrives at the firewall. The data packet, the processing of which was interrupted, is then stored in the buffer for processing at a later time.
1 . A method for allowing a stream of data packets in a network to arrive at a recipient at definable times, with a firewall in a computer network, the firewall including filter rules and a packet buffer in the firewall, the method comprising:
assigning, for each received data packet, a packet-specific, time-aware prioritization that is computed from a target arrival time and a measured arrival-time deviation, the measured arrival-time deviation being a deviation of a measured arrival time and the target arrival time;
processing the filter rules for the data packet in accordance with the time-aware prioritization, wherein processing of the filter rules for a currently processed data packet is preemptively interrupted upon receipt of a further data packet whose time-aware prioritization indicates a strictly smaller arrival-time deviation threshold;
storing, with a preemption tag, the currently processed data packet for which processing was interrupted in the packet buffer together with a record of an unexecuted filter-rule identifiers and a timestamp taken at an input of the firewall; and
resuming processing for the stored data packet directly at a first unexecuted filter rule indicated by the preemption tag, and applying a firewall action to the data packet only after the unexecuted filter rules have been processed.
2 . The method according to claim 1 , wherein the firewall action includes forwarding the data packet to an output of the firewall.
3 . The method according to claim 1 , wherein the firewall action includes discarding the data packet.
4 . The method according to claim 1 , wherein the firewall action includes marking the data packet with the preemption tag.
5 . The method according to claim 4 , wherein the preemption tag encodes the identities of unexecuted filter rules that have not yet been processed by the firewall at the moment of preemption, without advancing packet processing to a subsequent stage.
6 . The method according to claim 1 , wherein a respective stored data packet is removed from the packet buffer upon resumption and is deleted from the packet buffer only after the firewall action is determined, thereby preventing loss of state associated with the preemption tag.
7 . The method according to any claim 1 , wherein a timestamp is recorded for each data packet upon arrival at the input of the firewall, and the arrival-time deviation used in the time-aware prioritization is computed from the recorded timestamp and the target arrival time specified for the recipient.
8 . The method according to claim 1 , wherein data packets stored in the packet buffer are ordered according to their time-aware prioritization, and stored packets having equal prioritization are sub-ordered by input timestamp.
9 . The method according to claim 1 , wherein the firewall performs time-aware prioritization for each data packet.
10 . The method according to claim 1 , wherein the time-aware prioritization of each said data packet is carried out by further network participants, without modifying an order of the filter rules of the firewall.
11 . The method according to claim 1 , wherein the time-aware prioritization is added to the data packet.
12 . The method according to claim 1 , wherein a plurality of processing operations are carried out simultaneously by the firewall.
13 . The method according to claim 12 , wherein the interruption of the processing of a data packet takes place if one of the plurality of processing operations is processing a lower-priority data packet.
14 . The method according to claim 1 , wherein the packet buffer comprises a non-volatile memory.