ACL optimization method and system, electronic equipment and computer storage medium

Abstract

The invention belongs to the technical field of communication, and provides an ACL optimization method and system, electronic equipment and a computer storage medium. The method aims at solving the problems that in the prior art, along with the increase of the number of rules, a linear search mode becomes slower and slower, and the data packet processing speed and the overall network performance are affected; and in the re-numbering process, the original rule is temporarily invalid, so that the short service interruption is caused. Comprising the following steps: constructing a matching hash table and an action hash table, when a data packet arrives, obtaining all matching fields of the data packet, matching all the matching fields with the matching hash table, correspondingly obtaining all rule codes, and combining all the rule codes into a bitmap; performing priority processing on the bitmap to obtain a rule code with the highest priority; and taking the rule code with the highest priority as a key, searching a corresponding action in the action hash table, and processing the data packet according to the action.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to an ACL optimization method, system, electronic equipment and computer storage medium. Background Art

[0002] ACL is the abbreviation of Access Control List. ACL contains a series of conditional statements, which are actually a series of rules containing "allow" or "deny". In other words, ACL is a set of one or several sets of rules defined by humans so that the device can determine whether to execute the actions specified by the user.

[0003] When a data packet enters a network device, the device matches it according to the configured ACL rules. The matching process usually starts with the rule with the smallest RULEID, and once a matching rule is found, it stops searching further and performs the corresponding action (such as allow or deny) based on the rule. Therefore, the order in which the rules are arranged is very important for how the data packet is processed.

[0004] In the prior art, the step size determines the difference between two adjacent rule IDs when the system automatically assigns IDs to ACL rules. Setting an appropriate step size allows users to more flexibly add, delete, or modify rules in an existing ACL without worrying about confusion caused by reordering. For example, if a smaller step size is initially set but it is later found that new rules need to be inserted frequently, the step size can be adjusted to leave enough space for future use.

[0005] The prior art has the following technical problems:

[0006] 1.ACL rules are matched from small to large according to RULEID. The current matching process is linear, that is, starting from the first rule, one by one is checked until a matching rule is found or all rules are traversed. In this case, the worst time complexity is O(N), where N is the number of ACL rules. As the number of rules increases, the linear search method will become slower and slower, affecting the packet processing speed and overall network performance.

[0007] 2. When a new rule needs to be inserted between existing rules, the step size needs to be adjusted to make room. Directly modifying the step size will cause all affected rules to be renumbered, triggering the deletion and reconstruction of related driver entries. During the renumbering process, the original rules will be temporarily invalid, resulting in a brief service interruption. Summary of the invention

[0008] The present invention provides an ACL optimization method, system, electronic device and computer storage medium, aiming to solve the technical problems existing in the above-mentioned prior art that as the number of rules increases, the linear search method will become slower and slower, affecting the data packet processing speed and the overall network performance; and during the renumbering process, the original rules will be temporarily invalidated, resulting in a short service interruption.

[0009] The technical solution of the present invention to solve the above technical problem is as follows: an ACL optimization method, comprising:

[0010] Constructing a matching hash table and an action hash table, wherein the matching hash table stores a mapping between matching fields in the ACL rule and corresponding rule codes, and the action hash table stores a mapping between rule codes in the ACL rule and corresponding actions;

[0011] When a data packet arrives, all matching fields of the data packet are obtained, all matching fields are matched with the matching hash table, all corresponding rule codes are obtained, and all rule codes are merged into a bitmap;

[0012] Prioritizing the bitmap to obtain a rule code with the highest priority;

[0013] The rule encoding with the highest priority is used as the key, the corresponding action is searched in the action hash table, and the data packet is processed according to the action.

[0014] The beneficial effects of adopting the above technical solution are as follows: the present invention improves the matching efficiency by using a hash table for matching, optimizing the previous O(N) time complexity to a time complexity close to O(1), reduces the delay of data packet processing, and improves network performance.

[0015] Furthermore, the above construction of the matching hash table and the action hash table specifically includes:

[0016] Obtain all ACL rules and preprocess them to obtain the matching fields, rule codes, and actions of the ACL rules;

[0017] The matching field of each ACL rule is used as a key, and the corresponding rule code is stored as a value in the matching hash table; the rule code of each ACL rule is used as a key, and the corresponding action is stored as a value in the action hash table.

[0018] The beneficial effect of adopting the above technical solution is that the present invention makes the addition, deletion and modification of ACL rules more efficient through preprocessing and construction of hash tables, and will not significantly affect the performance due to changes in the number of ACL rules.

[0019] Furthermore, the matching fields of the above ACL rule include: source IP, destination IP, source port, destination port and protocol.

[0020] The beneficial effect of adopting the above technical solution is that the present invention includes common matching fields and can meet the needs of most network traffic control.

[0021] Furthermore, the above-mentioned matching hash table includes: a source IP hash table, a destination IP hash table, a source port hash table, a destination port hash table and a protocol hash table; wherein the source IP hash table is used to store the source IP address and the corresponding rule code; the destination IP hash table is used to store the destination IP address and the corresponding rule code; the source port hash table is used to store the source port number and the corresponding rule code; the destination port hash table is used to store the destination port number and the corresponding rule code; the protocol hash table is used to store the protocol type and the corresponding rule code.

[0022] The beneficial effect of adopting the above technical solution is that the present invention further improves the search efficiency by storing different matching fields through multiple sub-hash tables respectively.

[0023] Furthermore, the above-mentioned merging of all rule codes into a bitmap specifically includes:

[0024] Convert each matched rule encoding into binary representation and set the corresponding position in the bitmap to 1.

[0025] The beneficial effect of adopting the above technical solution is that the present invention quickly merges and represents multiple matching rules in a bitmap manner, thereby simplifying subsequent priority processing.

[0026] Further, the above-mentioned priority processing of the bitmap specifically includes:

[0027] The bitmap&=-bitmap operation is performed on the bitmap to obtain the lowest bit 1 in the bitmap, thereby obtaining the rule code with the highest priority.

[0028] The beneficial effects of adopting the above technical solution are: the present invention ensures efficient and accurate priority processing of rule numbers and avoids complicated sorting and traversal operations.

[0029] Furthermore, the above-mentioned actions include Drop and Pass, wherein if the action is Drop, the data packet is discarded, and if the action is Pass, the data packet is allowed to pass.

[0030] The beneficial effects of adopting the above technical solution are: the present invention provides a flow control function through action definition, which meets most network security and management requirements.

[0031] In a second aspect, in order to solve the above technical problem, the present invention further provides an ACL optimization system, comprising:

[0032] A hash table construction module, used to construct a matching hash table and an action hash table, wherein the matching hash table stores a mapping between matching fields in the ACL rule and corresponding rule codes, and the action hash table stores a mapping between rule codes in the ACL rule and corresponding actions;

[0033] A matching module, used for obtaining all matching fields of a data packet when the data packet arrives, matching all matching fields with the matching hash table, obtaining all corresponding rule codes, and merging all rule codes into a bitmap;

[0034] A priority processing module, used for performing priority processing on the bitmap to obtain a rule code with the highest priority;

[0035] The action module is used to encode the rule with the highest priority as the key, find the corresponding action in the action hash table, and process the data packet according to the action.

[0036] In a third aspect, in order to solve the above-mentioned technical problem, the present invention further provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the ACL optimization method of the present application is implemented when the processor executes the computer program.

[0037] In a fourth aspect, in order to solve the above technical problem, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the ACL optimization method of the present application is implemented.

[0038] Compared with the prior art, the present invention has the following advantages:

[0039] 1. The present invention improves the matching efficiency by using a hash table for matching, optimizing the previous O(N) time complexity to a time complexity close to O(1). It reduces the delay of data packet processing and improves network performance.

[0040] 2. The present invention makes the addition, deletion and modification of ACL rules more efficient through preprocessing and construction of hash tables, and will not significantly affect the performance due to changes in the number of ACL rules.

[0041] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A schematic diagram of a process of an ACL optimization method according to an embodiment of the present invention is shown;

[0044] Figure 2 A schematic diagram of the structure of an ACL optimization system according to an embodiment of the present invention is shown;

[0045] Figure 3 A schematic structural diagram of an electronic device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Figure 1 A schematic diagram of a flow chart of an ACL optimization method according to an embodiment of the present invention is shown. Figure 1 As shown, an ACL optimization method according to an embodiment of the present invention includes:

[0048] Constructing a matching hash table and an action hash table, wherein the matching hash table stores a mapping between matching fields in the ACL rule and corresponding rule codes, and the action hash table stores a mapping between rule codes in the ACL rule and corresponding actions;

[0049] When a data packet arrives, all matching fields of the data packet are obtained, all matching fields are matched with the matching hash table, all corresponding rule codes are obtained, and all rule codes are merged into a bitmap;

[0050] Prioritizing the bitmap to obtain a rule code with the highest priority;

[0051] The rule encoding with the highest priority is used as the key, the corresponding action is searched in the action hash table, and the data packet is processed according to the action.

[0052] The present invention improves the matching efficiency by using a hash table for matching, optimizing the previous O(N) time complexity to a time complexity close to O(1), reduces the delay of data packet processing, and improves network performance.

[0053] Optionally, building a matching hash table and an action hash table specifically includes:

[0054] Obtain all ACL rules and preprocess them to obtain the matching fields, rule codes, and actions of the ACL rules;

[0055] The matching field of each ACL rule is used as a key, and the corresponding rule code is stored as a value in the matching hash table; the rule code of each ACL rule is used as a key, and the corresponding action is stored as a value in the action hash table.

[0056] Among them, the present invention makes the addition, deletion and modification of ACL rules more efficient through preprocessing and construction of hash tables, and will not significantly affect the performance due to changes in the number of ACL rules.

[0057] Optionally, the matching fields of the ACL rule include: source IP, destination IP, source port, destination port and protocol.

[0058] Among them, the present invention includes common matching fields and can meet the needs of most network traffic control.

[0059] Optionally, the matching hash table includes: a source IP hash table, a destination IP hash table, a source port hash table, a destination port hash table and a protocol hash table; wherein the source IP hash table is used to store the source IP address and the corresponding rule code; the destination IP hash table is used to store the destination IP address and the corresponding rule code; the source port hash table is used to store the source port number and the corresponding rule code; the destination port hash table is used to store the destination port number and the corresponding rule code; the protocol hash table is used to store the protocol type and the corresponding rule code.

[0060] The present invention further improves the search efficiency by storing different matching fields in a plurality of sub-hash tables.

[0061] Optionally, the step of merging all rule codes into a bitmap specifically includes:

[0062] Convert each matched rule encoding into binary representation and set the corresponding position in the bitmap to 1.

[0063] The present invention quickly merges and represents multiple matching rules in a bitmap manner, thereby simplifying subsequent priority processing.

[0064] Optionally, performing priority processing on the bitmap specifically includes:

[0065] The bitmap&=-bitmap operation is performed on the bitmap to obtain the lowest bit 1 in the bitmap, thereby obtaining the rule code with the highest priority.

[0066] In this embodiment, in ACL matching, the rule numbers are arranged in order, and the rule with a lower number has a higher priority. Therefore, the rule number corresponding to the lowest bit 1 in the bitmap is the matching rule with the highest priority.

[0067] Among them, the present invention ensures that the priority processing of rule numbers is efficient and accurate, and avoids complicated sorting and traversal operations.

[0068] Optionally, the action includes Drop and Pass, wherein if the action is Drop, the data packet is discarded, and if the action is Pass, the data packet is allowed to pass.

[0069] Among them, the present invention provides a flow control function through action definition, meeting most network security and management requirements.

[0070] Embodiment 1:

[0071] The ACL rules are:

[0072] acl test

[0073] rule 1drop src_ip 192.168.3.0 / 24

[0074] rule 5 permit protocol 6 dst_port 53,80

[0075] rule 9 permit protocol 17 dst_port 53

[0076] In order to improve the matching efficiency, we preprocess all ACL rules and split the chain rules for storage. After splitting, we get 5 sub-hash tables (source IP hash table, destination IP hash table, source port hash table, destination port hash table and protocol hash table) and action hash table. The sub-hash tables are shown in Tables 1 to 5 below, and the action hash table is shown in Table 6.

[0077]

[0078] Table 1

[0079]

[0080] Table 2

[0081]

[0082] Table 3

[0083]

[0084] Table 4

[0085]

[0086] Table 5

[0087]

[0088] Table 6

[0089] Among them, for ACL rule 1, only the source address matches, the source address 192.168.3.0 / 24 is used as the key, and the rule number 0x1 is used as the value, which is stored in src ip Map;

[0090] For ACL rule 5, there are two matching items: destination port and protocol. Destination ports 53 and 80 are used as keys, rule number 0x5 is used as value, and are stored in dst port Map. Protocol number 6 (TCP) is used as key, rule number 0x5 is used as value, and are stored in protocol Map.

[0091] For ACL rule 9, there are two matching items: destination port and protocol. Destination port 53 is used as the key, rule number 0x9 is used as the value, and is stored in the dst port Map. Protocol number 17 (UDP) is used as the key, rule number 0x9 is used as the value, and is stored in the protocol Map.

[0092] When constructing the action hash table, the rule number is used as the key and the action is used as the value and stored in the action Map.

[0093] There is a data packet, as shown in Table 7:

[0094] src ip dst ip src port dst port protocol bitmap 192.168.4.1 192.168.4.100 1000 53 17 - 0x110 NULL NULL 0x111 0x101 0x100 192.168.4.1 192.168.4.100 1000 53 6 - 0x110 NULL NULL 0x111 0x11 0x10

[0095] Table 7

[0096] Get all the matching fields of the data packet and get the source IP: 192.168.4.1; destination IP: 192.168.4.100; source port: 1000; destination port: 53; protocol: 17 (UDP).

[0097] Search the rule number in the sub-hash table, specifically:

[0098] 1. Find the source IP:

[0099] Looking up 192.168.4.1 in the src ip map, no direct match is found, but 192.168.3.0 / 24 is found!

[0100] 2. Find the destination IP:

[0101] Looking up 192.168.4.100 in the dst ip map, no match found.

[0102] 3. Find the source port:

[0103] Looking up 1000 in src port map, no match found.

[0104] 4. Find the destination port:

[0105] Look up 53 in the dst port map and find a match Ox1 01.

[0106] 5. Find the agreement:

[0107] Look up 17 (UDP) in the proto map and find a match 0x100.

[0108] Then all matching rule numbers are combined into a bitmap. The result is calculated to be 0x101.

[0109] Then, the highest priority rule number is obtained through the bitmap&=-bitmap operation. The result of bitmap&-bitmap is Ox1 (because the binary representation of Ox101 is 00010001)

[0110] Using Ox1 as the key, look up the corresponding action in the action hash table: the value is DROP, so the packet should be discarded.

[0111] Based on Figure 1 Based on the same principle as the method shown in , the embodiment of the present invention also provides an ACL optimization system, such as Figure 2 As shown in, including:

[0112] A hash table construction module, used to construct a matching hash table and an action hash table, wherein the matching hash table stores a mapping between matching fields in the ACL rule and corresponding rule codes, and the action hash table stores a mapping between rule codes in the ACL rule and corresponding actions;

[0113] A matching module, used for obtaining all matching fields of a data packet when the data packet arrives, matching all matching fields with the matching hash table, obtaining all corresponding rule codes, and merging all rule codes into a bitmap;

[0114] A priority processing module, used for performing priority processing on the bitmap to obtain a rule code with the highest priority;

[0115] The action module is used to encode the rule with the highest priority as the key, find the corresponding action in the action hash table, and process the data packet according to the action.

[0116] The ACL optimization system of the embodiment of the present invention can execute the ACL optimization method provided by the embodiment of the present invention, and the implementation principle is similar. The actions performed by each module and unit in the ACL optimization system in each embodiment of the present invention correspond to the steps in the ACL optimization method in each embodiment of the present invention. For the detailed functional description of each module of the ACL optimization system, please refer to the description in the corresponding ACL optimization method shown in the above text, which will not be repeated here.

[0117] The ACL optimization system may be a computer program (including program code) running in a computer device. For example, the ACL optimization system is an application software. The application software may be used to execute the corresponding steps in the method provided in the embodiment of the present invention.

[0118] The modules involved in the embodiments of the present invention may be implemented by software or hardware, wherein the name of a module does not limit the module itself in some cases.

[0119] Based on the same principle as the method shown in the embodiments of the present invention, an electronic device is also provided in the embodiments of the present invention, which may include but is not limited to: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the method shown in any embodiment of the present invention by calling the computer program.

[0120] In an alternative embodiment, an electronic device is provided, such as Figure 3 As shown, Figure 3 The electronic device shown includes: a processor and a memory. The processor and the memory are connected, such as through a bus. Optionally, the electronic device may also include a transceiver, which may be used for data exchange between the electronic device and other electronic devices, such as data transmission and / or data reception. It should be noted that in actual applications, the transceiver is not limited to one, and the structure of the electronic device does not constitute a limitation on the embodiments of the present invention.

[0121] The memory is used to store the application code (computer program) for executing the solution of the present invention, and the execution is controlled by the processor. The processor is used to execute the application code stored in the memory to implement the content shown in the above method embodiment.

[0122] The electronic device may also be a terminal device. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0123] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding contents of the aforementioned method embodiment.

[0124] According to another aspect of the present invention, a computer program product or a computer program is also provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the implementation modes of the above-mentioned various embodiments.

[0125] It should be understood that the flow charts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the module, the program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0126] The computer-readable storage medium provided by the embodiment of the present invention may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, device, or device.

[0127] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0128] The above description is only a preferred embodiment of the present invention and an explanation of the technical principles used. Those skilled in the art should understand that the disclosure scope involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) by each other.

Claims

1. An ACL optimization method, characterized in that: include: Constructing a matching hash table and an action hash table, wherein the matching hash table stores a mapping between matching fields in the ACL rule and corresponding rule codes, and the action hash table stores a mapping between rule codes in the ACL rule and corresponding actions; When a data packet arrives, all matching fields of the data packet are obtained, all matching fields are matched with the matching hash table, all corresponding rule codes are obtained, and all rule codes are merged into a bitmap; Prioritizing the bitmap to obtain a rule code with the highest priority; The rule encoding with the highest priority is used as the key, the corresponding action is searched in the action hash table, and the data packet is processed according to the action.

2. The ACL optimization method according to claim 1, characterized in that: Constructing the matching hash table and action hash table specifically includes: Obtain all ACL rules and preprocess them to obtain the matching fields, rule codes, and actions of the ACL rules; The matching field of each ACL rule is used as a key, and the corresponding rule code is stored as a value in the matching hash table; the rule code of each ACL rule is used as a key, and the corresponding action is stored as a value in the action hash table.

3. The ACL optimization method according to claim 1, characterized in that: The matching fields of the ACL rule include: source IP, destination IP, source port, destination port and protocol.

4. The ACL optimization method according to claim 3, characterized in that: The matching hash table includes: a source IP hash table, a destination IP hash table, a source port hash table, a destination port hash table and a protocol hash table; wherein the source IP hash table is used to store the source IP address and the corresponding rule code; the destination IP hash table is used to store the destination IP address and the corresponding rule code; the source port hash table is used to store the source port number and the corresponding rule code; the destination port hash table is used to store the destination port number and the corresponding rule code; the protocol hash table is used to store the protocol type and the corresponding rule code.

5. The ACL optimization method according to claim 1, characterized in that: The step of merging all rule codes into a bitmap specifically includes: Convert each matched rule encoding into binary representation and set the corresponding position in the bitmap to 1.

6. The ACL optimization method according to claim 5, characterized in that: The priority processing of the bitmap specifically includes: The bitmap&=-bitmap operation is performed on the bitmap to obtain the lowest bit 1 in the bitmap, thereby obtaining the rule code with the highest priority.

7. The ACL optimization method according to claim 1, characterized in that: The actions include Drop and Pass, wherein if the action is Drop, the data packet is discarded, and if the action is Pass, the data packet is allowed to pass.

8. An ACL optimization system, characterized in that: include: A hash table construction module, used to construct a matching hash table and an action hash table, wherein the matching hash table stores a mapping between matching fields in ACL rules and corresponding rule codes, and the action hash table stores a mapping between rule codes in ACL rules and corresponding actions; A matching module, used for obtaining all matching fields of a data packet when the data packet arrives, matching all matching fields with the matching hash table, obtaining all corresponding rule codes, and merging all rule codes into a bitmap; A priority processing module, used for performing priority processing on the bitmap to obtain a rule code with the highest priority; The action module is used to encode the rule with the highest priority as the key, find the corresponding action in the action hash table, and process the data packet according to the action.

9. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images