An ACL optimization method, system, electronic device and computer storage medium

Abstract

The application belongs to the technical field of communication and provides an ACL optimization method, system, electronic device and computer storage medium. The application aims to solve the technical problems that the linear search mode becomes slower and slower with the increase of the number of rules, affecting the data packet processing speed and overall network performance, and that the original rules are temporarily invalid during the renumbering process, causing temporary service interruption. The application comprises the following steps: constructing a matching hash table and an action hash table; when a data packet arrives, obtaining all matching fields of the data packet; matching all matching fields with the matching hash table to obtain all rule codes; merging all rule codes into a bitmap; performing priority processing on the bitmap to obtain the rule code with the highest priority; taking the rule code with the highest priority as a key to find the corresponding action in the action hash table; and processing the data packet according to the action.

Description

Technical Field

[0001] This invention belongs to the field of communication technology, and in particular relates to an ACL optimization method, system, electronic device, and computer storage medium. Background Technology

[0002] ACL stands for Access Control List. An ACL contains a series of conditional statements, essentially a set of rules that allow or deny actions. In other words, an ACL is a set of rules defined by the user to allow the device to determine whether to execute the user-defined action.

[0003] When a data packet enters a network device, the device matches it against the configured ACL rules. The matching process typically begins with the rule with the smallest RULEID, and once a matching rule is found, the search stops and the device performs the appropriate action (such as allow or deny) based on that rule. Therefore, the order in which the rules are arranged is crucial to how data packets are processed.

[0004] In existing technologies, the step size determines the difference between two adjacent rule IDs when the system automatically assigns IDs to ACL rules. Setting an appropriate step size allows users to add, delete, or modify rules in existing ACLs more flexibly without worrying about confusion caused by reordering. For example, if a small step size is initially set but it is later found that frequent insertion of new rules is needed, the step size can be adjusted to leave enough room for future use.

[0005] The existing technology has the following technical problems:

[0006] 1. ACL rules are matched in ascending order of RULEID. The current matching process is linear, meaning it checks each rule one by one starting from the first one until a match is found or all rules have been traversed. In this case, the worst-case time complexity is O(N), where N is the number of ACL rules. As the number of rules increases, the linear search method becomes increasingly slow, impacting packet processing speed and overall network performance.

[0007] 2. When inserting a new rule between existing rules, the step size needs to be adjusted to make room. However, directly modifying the step size will cause all affected rules to be renumbered, triggering the deletion and reconstruction process of related driving entries. During the renumbering process, the original rules will temporarily become invalid, resulting in a brief service interruption. Summary of the Invention

[0008] This invention provides an ACL optimization method, system, electronic device, and computer storage medium, aiming to solve the technical problems in the prior art where linear search becomes increasingly slow as the number of rules increases, affecting packet processing speed and overall network performance; and where existing rules temporarily become invalid during renumbering, leading to brief service interruptions.

[0009] The technical solution of this invention to solve the above-mentioned technical problems is as follows: An ACL optimization method, comprising:

[0010] Construct a matching hash table and an action hash table, wherein the matching hash table stores the mapping between matching fields in ACL rules and their corresponding rule codes, and the action hash table stores the mapping between rule codes in ACL rules and their corresponding actions;

[0011] When a data packet arrives, all matching fields of the data packet are obtained, all matching fields are matched with the matching hash table to obtain all rule codes, and all rule codes are merged into a bitmap.

[0012] The bitmap is subjected to priority processing to obtain the rule code with the highest priority;

[0013] The highest priority rule is encoded as the key, the corresponding action is looked up in the action hash table, and the data packet is processed according to the action.

[0014] The beneficial effects of adopting the above technical solution are as follows: This invention improves matching efficiency by using a hash table for matching, optimizing the time complexity from O(N) to close to O(1). It also reduces packet processing latency and improves network performance.

[0015] Furthermore, the construction of the matching hash table and the action hash table specifically includes:

[0016] Retrieve all ACL rules and preprocess them to obtain the matching fields, rule codes, and actions of the ACL rules;

[0017] The matching field of each ACL rule is used as the key, and the corresponding rule code is used as the value to store it in the matching hash table; the rule code of each ACL rule is used as the key, and the corresponding action is used as the value to store it in the action hash table.

[0018] The beneficial effects of adopting the above technical solution are as follows: Through preprocessing and hash table construction, the present invention makes the addition, deletion and modification of ACL rules more efficient and will not significantly affect performance due to changes in the number of ACL rules.

[0019] Furthermore, the matching fields of the aforementioned ACL rules include: source IP, destination IP, source port, destination port, and protocol.

[0020] The beneficial effects of adopting the above technical solution are as follows: the present invention includes common matching fields, which can meet the needs of most network traffic control.

[0021] Furthermore, the aforementioned matching hash table includes: a source IP hash table, a destination IP hash table, a source port hash table, a destination port hash table, and a protocol hash table; wherein, the source IP hash table is used to store the source IP address and its corresponding rule code; the destination IP hash table is used to store the destination IP address and its corresponding rule code; the source port hash table is used to store the source port number and its corresponding rule code; the destination port hash table is used to store the destination port number and its corresponding rule code; and the protocol hash table is used to store the protocol type and its corresponding rule code.

[0022] The beneficial effects of adopting the above technical solution are as follows: the present invention stores different matching fields in multiple sub-hash tables, which further improves the search efficiency.

[0023] Furthermore, the above-mentioned process of merging all rule encodings into a single bitmap specifically includes:

[0024] Each matched rule is encoded into a binary representation and set to 1 at the corresponding position in the bitmap.

[0025] The beneficial effects of adopting the above technical solution are as follows: the present invention can quickly merge and represent multiple matching rules by means of bitmap, which simplifies the subsequent priority processing.

[0026] Furthermore, the aforementioned priority processing of the bitmap specifically includes:

[0027] The lowest-priority rule code is obtained by performing the bitmap&=-bitmap operation on the bitmap.

[0028] The beneficial effects of adopting the above technical solution are: the present invention ensures that the priority processing of rule numbers is efficient and accurate, and avoids complex sorting and traversal operations.

[0029] Furthermore, the aforementioned actions include Drop and Pass, wherein if the action is Drop, the data packet is discarded, and if the action is Pass, the data packet is allowed to pass.

[0030] The beneficial effects of adopting the above technical solution are as follows: This invention provides flow control function through action definition, which meets most network security and management needs.

[0031] Secondly, to solve the above-mentioned technical problems, the present invention also provides an ACL optimization system, comprising:

[0032] The hash table construction module is used to construct a matching hash table and an action hash table. The matching hash table stores the mapping between matching fields in ACL rules and their corresponding rule codes, while the action hash table stores the mapping between rule codes in ACL rules and their corresponding actions.

[0033] The matching module is used to obtain all the matching fields of the data packet when the data packet arrives, match all the matching fields with the matching hash table to obtain all the rule codes, and merge all the rule codes into a bitmap.

[0034] The priority processing module is used to perform priority processing on the bitmap to obtain the rule code with the highest priority.

[0035] The action module is used to encode the highest priority rule as a key, look up the corresponding action in the action hash table, and process the data packet according to the action.

[0036] Thirdly, in order to solve the above-mentioned technical problems, the present invention also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the ACL optimization method of the present application.

[0037] Fourthly, in order to solve the above-mentioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the ACL optimization method of the present application.

[0038] Compared with the prior art, the present invention has the following advantages:

[0039] 1. This invention improves matching efficiency by using a hash table for matching, optimizing the time complexity from O(N) to near O(1). This reduces packet processing latency and improves network performance.

[0040] 2. This invention, through preprocessing and hash table construction, makes the addition, deletion, and modification of ACL rules more efficient and does not significantly affect performance due to changes in the number of ACL rules.

[0041] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart illustrating an ACL optimization method according to an embodiment of the present invention is shown;

[0044] Figure 2 A schematic diagram of an ACL optimization system according to an embodiment of the present invention is shown;

[0045] Figure 3 A schematic diagram of an electronic device structure according to an embodiment of the present invention is shown. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Figure 1 A flowchart illustrating an ACL optimization method according to an embodiment of the present invention is shown, as follows: Figure 1 As shown, an ACL optimization method according to an embodiment of the present invention includes:

[0048] Construct a matching hash table and an action hash table, wherein the matching hash table stores the mapping between matching fields in ACL rules and their corresponding rule codes, and the action hash table stores the mapping between rule codes in ACL rules and their corresponding actions;

[0049] When a data packet arrives, all matching fields of the data packet are obtained, all matching fields are matched with the matching hash table to obtain all rule codes, and all rule codes are merged into a bitmap.

[0050] The bitmap is subjected to priority processing to obtain the rule code with the highest priority;

[0051] The highest priority rule is encoded as the key, the corresponding action is looked up in the action hash table, and the data packet is processed according to the action.

[0052] This invention improves matching efficiency by using a hash table for matching, reducing the time complexity from O(N) to nearly O(1). This also reduces packet processing latency and enhances network performance.

[0053] Optionally, constructing the matching hash table and the action hash table specifically includes:

[0054] Retrieve all ACL rules and preprocess them to obtain the matching fields, rule codes, and actions of the ACL rules;

[0055] The matching field of each ACL rule is used as the key, and the corresponding rule code is used as the value to store it in the matching hash table; the rule code of each ACL rule is used as the key, and the corresponding action is used as the value to store it in the action hash table.

[0056] This invention, through preprocessing and hash table construction, makes the addition, deletion, and modification of ACL rules more efficient and does not significantly affect performance due to changes in the number of ACL rules.

[0057] Optionally, the matching fields of the ACL rule include: source IP, destination IP, source port, destination port, and protocol.

[0058] This invention includes common matching fields, which can meet the needs of most network traffic control.

[0059] Optionally, the matching hash table includes: a source IP hash table, a destination IP hash table, a source port hash table, a destination port hash table, and a protocol hash table; wherein, the source IP hash table is used to store the source IP address and its corresponding rule code; the destination IP hash table is used to store the destination IP address and its corresponding rule code; the source port hash table is used to store the source port number and its corresponding rule code; the destination port hash table is used to store the destination port number and its corresponding rule code; and the protocol hash table is used to store the protocol type and its corresponding rule code.

[0060] In this invention, different matching fields are stored in multiple sub-hash tables, which further improves the search efficiency.

[0061] Optionally, the step of merging all the rule encodings into a single bitmap specifically includes:

[0062] Each matched rule is encoded into a binary representation and set to 1 at the corresponding position in the bitmap.

[0063] This invention uses a bitmap to quickly merge and represent multiple matching rules, simplifying subsequent priority processing.

[0064] Optionally, prioritizing the bitmap specifically includes:

[0065] The lowest-priority rule code is obtained by performing a bitmap&=-bitmap operation on the bitmap.

[0066] In this embodiment, during ACL matching, rule numbers are arranged sequentially, with lower-numbered rules having higher priority. Therefore, the rule number corresponding to the least significant 1 in the bitmap is the highest-priority matching rule.

[0067] In this invention, priority processing of rule numbers is ensured to be efficient and accurate, avoiding complex sorting and traversal operations.

[0068] Optionally, the action includes Drop and Pass, wherein if the action is Drop, the data packet is discarded, and if the action is Pass, the data packet is allowed to pass.

[0069] This invention provides traffic control functionality through action definition, which meets most network security and management needs.

[0070] Example 1:

[0071] The ACL rule is:

[0072] acl test

[0073] rule 1drop src_ip 192.168.3.0 / 24

[0074] rule 5 permit protocol 6 dst_port 53,80

[0075] rule 9 permit protocol 17 dst_port 53

[0076] To improve matching efficiency, we preprocess all ACL rules, splitting and storing the chained rules. After splitting, we obtain 5 sub-hash tables (source IP hash table, destination IP hash table, source port hash table, destination port hash table, and protocol hash table) and an action hash table. The sub-hash tables are shown in Tables 1-5 below, and the action hash table is shown in Table 6.

[0077]

[0078] Table 1

[0079]

[0080] Table 2

[0081]

[0082] Table 3

[0083]

[0084] Table 4

[0085]

[0086] Table 5

[0087]

[0088] Table 6

[0089] For ACL rule 1, there is only a source address matching entry. The source address 192.168.3.0 / 24 is used as the key and the rule number 0x1 is used as the value. These entries are stored in the source IP Map.

[0090] For ACL rule 5, there are two matching items: destination port and protocol. Destination ports 53 and 80 are used as keys, and rule number 0x5 is used as the value, stored in the dst port map. Protocol number 6 (TCP) is used as the key, and rule number 0x5 is used as the value, stored in the protocol map.

[0091] For ACL rule 9, there are two matching items: destination port and protocol. Destination port 53 is used as the key and rule number 0x9 as the value, and both are stored in the dst port map. Protocol number 17 (UDP) is used as the key and rule number 0x9 as the value, and both are stored in the protocol map.

[0092] During the construction of the action hash table, the rule number is used as the key and the action is used as the value, and stored in the action Map.

[0093] There is a data packet, as shown in Table 7:

[0094] src ip dst ip src port dst port protocal bitmap 192.168.4.1 192.168.4.100 1000 53 17 - 0x110 NULL NULL 0x111 0x101 0x100 192.168.4.1 192.168.4.100 1000 53 6 - 0x110 NULL NULL 0x111 0x11 0x10

[0095] Table 7

[0096] Retrieve all matching fields of the packet to obtain the following information: Source IP: 192.168.4.1; Destination IP: 192.168.4.100; Source Port: 1000; Destination Port: 53; Protocol: 17 (UDP).

[0097] The lookup rule number is performed in the sub-hash table, specifically as follows:

[0098] 1. Find the source IP:

[0099] Searching for 192.168.4.1 in the source IP map did not yield a direct match, but it did find 0x1O corresponding to 192.168.3.0 / 24.

[0100] 2. Find the destination IP:

[0101] No match was found for 192.168.4.100 in the dst IP map.

[0102] 3. Locate the source port:

[0103] Searching for 1000 in the source port map yielded no match.

[0104] 4. Locate the destination port:

[0105] Search for 53 in the dst port map and find the matching item 0x1 01.

[0106] 5. Lookup Protocol:

[0107] Searching for 17 (UDP) in the proto map, a match 0x100 was found.

[0108] Then, all matching rule numbers are merged into a bitmap. The calculated result is 0x101.

[0109] Then, the highest priority rule number is obtained using the bitmap&=-bitmap operation. The result of bitmap&-bitmap is 0x1 (because the binary representation of 0x101 is 00010001).

[0110] Using 0x1 as the key, the corresponding action is looked up in the action hash table: the value is DROP, so the packet should be dropped.

[0111] Based on and Figure 1 Based on the same principle as the method shown, this embodiment of the invention also provides an ACL optimization system, such as... Figure 2 As shown, it includes:

[0112] The hash table construction module is used to construct a matching hash table and an action hash table. The matching hash table stores the mapping between matching fields in ACL rules and their corresponding rule codes, while the action hash table stores the mapping between rule codes in ACL rules and their corresponding actions.

[0113] The matching module is used to obtain all the matching fields of the data packet when the data packet arrives, match all the matching fields with the matching hash table to obtain all the rule codes, and merge all the rule codes into a bitmap;

[0114] The priority processing module is used to perform priority processing on the bitmap to obtain the rule code with the highest priority.

[0115] The action module is used to encode the highest priority rule as a key, look up the corresponding action in the action hash table, and process the data packet according to the action.

[0116] The ACL optimization system of this invention can execute the ACL optimization method provided in this invention. The implementation principle is similar. The actions performed by each module and unit in the ACL optimization system of each embodiment of this invention correspond to the steps in the ACL optimization method of each embodiment of this invention. For detailed functional descriptions of each module of the ACL optimization system, please refer to the descriptions in the corresponding ACL optimization methods shown above, which will not be repeated here.

[0117] The aforementioned ACL optimization system can be a computer program (including program code) running on a computer device, such as an application software; the application software can be used to execute the corresponding steps in the method provided in the embodiments of the present invention.

[0118] The modules described in the embodiments of the present invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0119] Based on the same principles as the methods shown in the embodiments of the present invention, the embodiments of the present invention also provide an electronic device, which may include, but is not limited to: a processor and a memory; the memory for storing computer programs; and the processor for executing the methods shown in any embodiment of the present invention by invoking the computer programs.

[0120] In one alternative embodiment, an electronic device is provided, such as Figure 3 As shown, Figure 3 The illustrated electronic device includes a processor and a memory. The processor and memory are connected, for example, via a bus. Optionally, the electronic device may also include a transceiver, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver is not limited to one unit, and the structure of this electronic device does not constitute a limitation on the embodiments of the present invention.

[0121] The memory stores application code (computer program) that executes the present invention, and its execution is controlled by a processor. The processor executes the application code stored in the memory to implement the content shown in the foregoing method embodiments.

[0122] Among these, electronic devices can also be terminal devices. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0123] This invention provides a computer-readable storage medium storing a computer program that, when run on a computer, enables the computer to execute the corresponding content in the aforementioned method embodiments.

[0124] According to another aspect of the present invention, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various embodiments described above.

[0125] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0126] The computer-readable storage medium provided in this invention can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0127] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0128] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. An ACL optimization method, characterized in that, include: Construct a matching hash table and an action hash table, wherein the matching hash table stores the mapping between matching fields in ACL rules and their corresponding rule codes, and the action hash table stores the mapping between rule codes in ACL rules and their corresponding actions; When a data packet arrives, all matching fields of the data packet are obtained, all matching fields are matched with the matching hash table to obtain all rule codes, and all rule codes are merged into a bitmap. The bitmap is subjected to priority processing to obtain the rule code with the highest priority; The highest priority rule is encoded as the key, the corresponding action is looked up in the action hash table, and the data packet is processed according to the action. Specifically, constructing the matching hash table and the action hash table includes: Retrieve all ACL rules and preprocess them to obtain the matching fields, rule codes, and actions of the ACL rules; The matching field of each ACL rule is used as the key, and the corresponding rule code is used as the value to store it in the matching hash table; the rule code of each ACL rule is used as the key, and the corresponding action is used as the value to store it in the action hash table.

2. The ACL optimization method according to claim 1, characterized in that, The matching fields of the ACL rule include: source IP, destination IP, source port, destination port, and protocol.

3. The ACL optimization method according to claim 2, characterized in that, The matching hash table includes: a source IP hash table, a destination IP hash table, a source port hash table, a destination port hash table, and a protocol hash table; wherein, the source IP hash table is used to store the source IP address and the corresponding rule code; the destination IP hash table is used to store the destination IP address and the corresponding rule code; the source port hash table is used to store the source port number and the corresponding rule code; the destination port hash table is used to store the destination port number and the corresponding rule code; and the protocol hash table is used to store the protocol type and the corresponding rule code.

4. The ACL optimization method according to claim 1, characterized in that, The process of merging all the rules into a single bitmap specifically includes: Each matched rule is encoded into a binary representation and set to 1 at the corresponding position in the bitmap.

5. The ACL optimization method according to claim 4, characterized in that, Priority processing of the bitmap specifically includes: The lowest-priority rule code is obtained by performing a bitmap&=-bitmap operation on the bitmap.

6. The ACL optimization method according to claim 1, characterized in that, The actions include Drop and Pass. If the action is Drop, the data packet is discarded; if the action is Pass, the data packet is allowed to pass.

7. An ACL optimization system, characterized in that, include: The hash table construction module is used to construct a matching hash table and an action hash table. The matching hash table stores the mapping between matching fields in ACL rules and their corresponding rule codes, while the action hash table stores the mapping between rule codes in ACL rules and their corresponding actions. The construction of the matching hash table and the action hash table specifically includes: Retrieve all ACL rules and preprocess them to obtain the matching fields, rule codes, and actions of the ACL rules; The matching field of each ACL rule is used as the key, and the corresponding rule code is used as the value to store it in the matching hash table; the rule code of each ACL rule is used as the key, and the corresponding action is used as the value to store it in the action hash table. The matching module is used to obtain all the matching fields of the data packet when the data packet arrives, match all the matching fields with the matching hash table to obtain all the rule codes, and merge all the rule codes into a bitmap; The priority processing module is used to perform priority processing on the bitmap to obtain the rule code with the highest priority. The action module is used to encode the highest priority rule as a key, look up the corresponding action in the action hash table, and process the data packet according to the action.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-6.

9. A computer storage medium, characterized in that, The computer storage medium stores a computer program, which, when executed by a processor, implements the method of any one of claims 1-6.

Images