Access control list realization method and apparatus thereof

Abstract

The invention discloses an access control list (ACL) realization apparatus with low cost and power consumption. The ACL realization apparatus comprises an ACL generation module, a memory, an ACL searching module, and a multidimensional rule processing module. The ACL generation module is used for respectively carrying out hash operation on high M bit portions at left end points in all rule regions, using the end points with a same operation result as leaf nodes to form a same tree-shaped data structure, obtaining a plurality of tree-shaped data structures and storing the obtained structures in the memory. The ACL searching module is used for extracting a key word of a to-be-searched data packet, carrying out hash operation on high M bit portions, finding out a corresponded tree-shaped data structure to carry out searching and obtaining a corresponded rule, wherein M is larger than 0 and is less than N and the N is the width of a rule. And the multidimensional rule processing module is used for deposing a multidimensional rule into a plurality of one-dimensional rules, respectively searching the rules and combining the plurality of one-dimensional rules. In addition, the invention also correspondedly discloses an ACL realization method.

Description

technical field [0001] The invention belongs to the technical field of communication, and in particular relates to a method and a device for realizing an access control list. Background technique [0002] The data packets are divided into different flows according to the specific key fields of the data packets, for example, the source IP (internet protocol, Internet Protocol) address and the destination IP address of the data packets are classified, and the same type of data packets is called a flow. After being divided into streams, various processes can be performed on the stream, such as discarding or forwarding, rate limiting, and priority reassignment, etc. This process is called an action. Usually, a rule plus a corresponding action is called an ACL (Access Control List, access control list) entry. [0003] According to general industry standard composition rules, there are 5 key fields, usually also called 5-tuples. These 5 keywords are: source address of IP message,...

AI Technical Summary

Problems solved by technology

The advantage of using TCAM to implement access control list is that it is simple to implement, but TCAM also has many shortcomings

First of all, TCAM compares the keyword to be searched with each entry of TCAM in the same clock cycle, so the power consumption is relatively large; the second is that the cost of TCAM devices is high and expensive; the third is due to the implementation of TCAM devices, The rule base implemented by TCAM cannot be too large

Images