Patent ID: 8171539

Claim:
A method for implementing a firewall in a network infrastructure component having a memory, the firewall comprising a plurality of rules, the method comprising: generating a search tree for the plurality of rules, the search tree being stored in the memory, wherein generating the search tree comprises: assigning first field bounds and a first set of rules of the plurality of rules to a first node stored in a first region of a range of memory addresses; dividing the first node into a plurality of child nodes based on an intersection of the first set of rules and the first field bounds, each child node of the plurality being stored in a respective region of the range of memory addresses; assigning child field bounds to each respective child node, wherein each respective child field bounds is a subset of the intersection of the first set of rules and the first field bounds; and assigning a respective subset of the first set of rules to each respective child node based on the respective child field bounds, wherein each respective subset intersects the respective child field bounds for the respective child node; receiving a first packet by the network infrastructure component; identifying a first child node of the plurality of child nodes based on values for one or more fields of the first packet; and applying the respective subset of rules assigned to the first child node to the first packet.