Method and device for establishing access control list, and data routing method and device

Abstract

The invention provides a method and device for establishing an access control list, a data routing method and a data routing device. The method for establishing an access control list comprises the following steps: respectively setting a corresponding access control list for each attribute in a matching rule; storing all values of the attribute (corresponding to the access control list) in each access control list; and interrelating the access control lists corresponding to the attributes in the matching rule. The device for establishing the access control list comprises a setting module, a storage module and an interrelating module. The invention can save storage resources and improve searching efficiency.

Description

Technical field [0001] The embodiments of the present invention relate to communication technology, and in particular to a method and device for establishing an access control list and a data routing method and device. Background technique [0002] Policy-Based Routing (PBR) provides a more flexible data packet routing and forwarding mechanism than routing and forwarding based only on the destination address. Policy routing can flexibly perform routing selection based on multiple attributes of data, such as source address, destination address, source and destination port, protocol number, Type of Service (TOS) field, and whether it is a fragmented message. [0003] In order to implement policy routing on the routing device, an Access Control List (ACL) needs to be established on the routing device, and all matching rules of the policy routing are saved in the ACL. When subsequent data is received, it is saved according to the ACL. Various matching rules for routing selection. [00...

AI Technical Summary

Problems solved by technology

In the network, there are many types of attributes, and the number of values ​​of attributes is even greater. For example, there may be tens of thousands of values ​​for the source address alone. The amount of information stored by ACE is very large, which greatly wastes storage resources and often exceeds the capacity limit requirements of ACL

[0008] Moreover, when data routing is performed based on the ACL established in the prior art, due to the huge amount of information stored in the ACE in the ACL, it is necessary to search for the ACE that matches the extracted attribute among the huge number of ACEs, which will greatly increase the search time. times, greatly reducing the search efficiency

Images