A Seven Tuple Firewall Rule Matching Algorithm Based on Hash Table

The traditional firewall packet filtering process primarily relies on five tuple firewall filtering rules for matching, encompassing the source IP address, destination IP, protocol type, source port, and destination port. However, due to the escalating sophistication of network attacks, the effectiveness of five tuple rules in safeguarding networks is constrained, thereby compromising the security of network communications. In this paper, a seven tuple firewall filtering rule is first proposed, which augments the existing five tuple by incorporating two additional elements: source Mac address and destination Mac address. Subsequently, a thorough analysis is conducted on potential conflicts among seven tuple firewall rules. Employing a divide and conquer strategy, the firewall rules are segmented into four subsets based on the network model: data link layer set, network layer set, transport and application layer set, and combined rule set. Furthermore, a method is proposed for achieving a conflict-free rule set by leveraging the relationships among the rules. Finally, a seven tuple firewall rule matching algorithm is introduced, which relies on a hash table built upon the conflict-free rule set. Compared to five tuple rules, seven tuple rules enable more targeted rule creation for specific devices within the network. Additionally, the algorithm outlined in this paper exhibits a straightforward data structure, facilitates easy rule updates, and boasts significantly faster matching speeds in comparison to traditional algorithms.