System and method for accelerating multiple-field classification rule linear search

Abstract

A system and method for accelerating the linear search of multi-field classification rules, the method includes: searching the flow matching information record table of the flow where the message is located according to the elements in the flow matching comparison field extracted from the message, if there is no matching flow matching Information records, starting from the first rule of the linear list of multi-domain classification rules, perform a linear search for these rules in sequence, and when the first rule matching the message is encountered or the end of the table is found, the search is ended and the message matching result is generated, and in the stream Record the linear list number of the multi-domain classification rule and the flow matching rule label corresponding to the flow matching result in the matching information record table; otherwise, start the linear list of the multi-domain classification rule from the rule corresponding to the flow matching rule label in the flow matching information record Search, when encountering the rule matching the first message or finding the end of the table, end the search and generate a message matching result; output the message matching result. Therefore, the present invention can shorten the search interval and speed up the search speed.

Description

technical field [0001] The invention relates to the technical field of network access control, in particular to a system and method for accelerating linear search of multi-domain classification rules. Background technique [0002] In the network security system, the most important security element is the access control control point at the entrance and exit of the network communication channel. In order to classify or filter packets, network devices need to configure a series of matching rules to identify objects to be filtered. After a specific object is identified, the corresponding message can be allowed or prohibited to pass according to the preset policy. A linear list of multi-domain classification rules is used to implement these functions, and an access control list (Access Control List, ACL for short) is one of the linear lists of multi-domain classification rules. [0003] Access control lists are matching lists applied to router interfaces. These matching lists ...

AI Technical Summary

Problems solved by technology

At the same time, the number of matching fields in the pre-matching records is large, no matter which search method is used to organize these pre-matching records, the pre-matching process will require a lot of extra work

[0012] 2) Not all modules can consider using this method to speed up the lookup of the access control list

For example, in network quality of service (QoS for short) classification, the same ACL may be referenced multiple times in a single direction of a port, and a linear search must be performed in strict order. This type of pre-matching technology cannot be applied

[0013] 3) The access control list supports multi-domain classification, but only a small number of access control list rules use all the classification domains, and the pre-matching method has a waste of performance for the usually used access control list rules with only one or two classification domains

The access control list is referenced by multiple modules as a common module, and the usage is complicated

If similar pre-matching records are also cached in the above way, the amount of matching operation context information that needs to be cached will be large, which will additionally increase the burden of pre-matching lookups

Images