Access control list processing method, electronic device and computer program product

Abstract

The invention discloses an access control list processing method, electronic equipment and a computer program product, and belongs to the field of data processing. The method comprises the following steps: setting a rule logic table and a rule physical table, wherein table item structures of the rule logic table and the rule physical table are consistent; in response to the change of the access control list, based on the table item structure of the rule logic table, determining and executing a logic table item operation required for updating the rule logic table from the current state to a target state; according to the logic table item operation, an operation instruction sequence is generated, and instructions in the operation instruction sequence are used for executing corresponding physical table item operation on the rule physical table; and sending the operation instruction sequence to complete updating of the rule physical table.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to a method for processing access control lists, electronic devices, and computer program products. Background Technology

[0002] In existing network equipment's Access Control List (ACL) processing, the logical rule table maintained by the software processing layer and the physical rule table maintained by the hardware processing layer use different table entry structures and sorting algorithms, resulting in structural differences between the two. When ACL services change, the software processing layer adjusts the logical table item by item according to its own algorithm and then sends it down to the hardware processing layer one by one. The hardware processing layer, however, needs to recalculate and perform additional migration and integration operations based on its independent table structure. This leads to a large number of redundant migration operations and performance losses during the update process, affecting the response speed of service changes and network stability. Summary of the Invention

[0003] This application provides a method for processing access control lists, an electronic device, and a computer program product that can solve problems such as excessive redundant data transfer and performance loss in the hardware processing layer in related technologies.

[0004] To solve the above-mentioned technical problems, this application is implemented as follows: Firstly, a method for processing access control lists is provided, applied to network devices, including the following steps: Set up a rule logic table and a rule physical table, wherein the table entries of the rule logic table and the rule physical table have the same structure; In response to a change in the access control list, based on the table structure of the rule logic table, the logic table entry operations required to update the rule logic table from the current state to the target state are determined and executed; Based on the logical table entry operation, an operation instruction sequence is generated, and the instructions in the operation instruction sequence are used to perform corresponding physical table entry operations on the rule physical table. Send the sequence of operation instructions to complete the update of the rule physical table.

[0005] In a second aspect, an electronic device is provided, the electronic device comprising a processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions, when executed by the processor, implementing the steps of the access control list processing method as described above.

[0006] Thirdly, a computer program product is provided, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the steps of the access control list processing method as described above.

[0007] The access control list processing method, electronic device, and computer program product provided in this application, by setting rule logic tables and rule physical tables with consistent entry structures, can avoid the additional relocation and conversion work caused by differences in entry structures at the hardware processing layer, and reduce performance loss during ACL updates. When the software processing layer responds to ACL changes, it directly determines and executes logical entry operations based on the rule logic table, and synchronously generates the corresponding operation instruction sequence and sends it to the hardware processing layer. This allows the hardware processing layer to directly execute the corresponding physical entry operations without independent calculation, achieving efficient coordination between software and hardware updates. This shortens the entry update time when ACL services change, reduces the risk of traffic interruption caused by update delays, and enhances the service stability and reliability of network devices in high-load, high-capacity ACL scenarios.

[0008] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0009] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0010] Figure 1 This diagram illustrates the hierarchical structure of ACL service processing in the prior art. Figure 2 This diagram illustrates the flow chart of ACL service processing in the prior art. Figure 3 A flowchart illustrating an exemplary embodiment of this application for processing an access control list is shown. Figure 4 A flowchart illustrating an exemplary embodiment of this application for processing an access control list is shown. Figure 5 This illustration shows a schematic diagram of the structure of a service configuration table provided in an exemplary embodiment of this application; Figure 6 A flowchart illustrating an exemplary embodiment of the access control list processing method of this application is shown; Figure 7 A schematic diagram illustrating entry movement in an application example of this application is shown; Figure 8A schematic diagram of the structure of a question control list processing apparatus provided in an exemplary embodiment of this application is shown; Figure 9 A structural block diagram of an electronic device provided in an exemplary embodiment of this application is shown. Detailed Implementation

[0011] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0012] Access Control Lists (ACLs) in switches or routers are a set of network security inspection rules based on packet field matching. They can be used for packet filtering, security domain isolation, policy routing, resource protection, and more. See also Figure 1 The existing ACL (Access Control List) service processing can be divided into three layers: service configuration, software table processing, and hardware table processing. The ACL service is at the top layer, consisting of a set of access control rules configured by the user, such as "allow / deny certain traffic". The software table is in the middle layer, representing the logical implementation of the ACL service within the software processing layer. The software table performs logical processing on ACL rules, such as priority sorting and conflict detection. The hardware table is at the bottom layer, representing the physical implementation of the ACL service in the hardware chip. The hardware table directly participates in packet matching and forwarding decisions.

[0013] The software table is maintained by the software processing layer, and the hardware table is maintained by the hardware processing layer. In the existing process, because the two tables are distributed across different layers, and each layer uses different sorting algorithms, the structures of the software table and the hardware table differ. See also... Figure 2 When ACL services change, the service configuration generates a new service table and sends it to the software processing layer. The software processing layer adjusts its own software table according to its algorithm and then sends the software table to the hardware processing layer, enabling the hardware processing layer to adjust its own hardware table. The specific adjustment sequence is: for each incoming entry, move and insert it, then move and insert it again, and so on. Therefore, the chip-based table writing process requires an additional move and integration process compared to the table writing process of the chip manager (such as the software layer or forwarding chip manager), thus consuming device performance.

[0014] Generally, when network devices handle a large number of ACL (Access Control List) transactions, making changes to these ACLs can lead to slow device response and potentially prolonged network outages. These interruptions can disrupt customer services and prevent normal network operation. However, with the rapid development of network technology, user demands for network services are increasing daily, and ACL capacity has grown from the K level to the M level. Therefore, a more reliable service change solution is needed to cope with complex network service changes.

[0015] To address the aforementioned problems in the prior art, this application provides a method for processing access control lists, applied to network devices. The following is a detailed explanation in conjunction with the appendix. Figures 1 to 9 This application provides a detailed description of an access control list processing method, electronic device, and computer program product through specific embodiments and application scenarios. These embodiments are for illustrative purposes only and do not constitute a limitation thereof.

[0016] Figure 3 A flowchart illustrating an exemplary embodiment of this application demonstrates a method for processing access control lists, which can be executed by a network device. Figure 3 As shown, the processing method for this access control list mainly includes the following steps: Step 110: Set up a rule logic table and a rule physical table, wherein the table entries of the rule logic table and the rule physical table have the same structure.

[0017] When processing ACL services, network devices can include a service configuration layer, a software processing layer, and a hardware processing layer.

[0018] The business configuration layer receives user configurations, converts ACL rules into configuration information tables, and sends them to the software processing layer. This layer does not directly maintain the rule logic table or rule physical table, but instead generates raw data for updating the rule logic table.

[0019] The software processing layer maintains the rule logic table, including structured management, priority sorting, and relocation calculations for table entries. Based on changes to the rule logic table, the software processing layer generates a sequence of instructions to update the rule physical table. The software processing layer may include a Forwarding Chip Manager (FCM), specifically responsible for interacting with and managing one or more forwarding chips (ASIC / NPU), which can be understood as the functional entity of the software processing layer in terms of data plane forwarding control.

[0020] The hardware processing layer maintains the physical rule table and performs hardware-level operations such as writing and clearing entries based on instructions issued by the software processing layer. The physical rule table resides in the hardware chip and is used for the actual matching and forwarding of packets.

[0021] In some embodiments, the table entry structures of the rule logical table and the rule physical table are identical, including at least one of the following: Consistent entry order: The order in which entries in the rule logical table are arranged according to priority is the same as the physical order in which the rule physical table is arranged in the hardware storage medium.

[0022] Field mapping consistency: The key fields of entries in the rule logic table (e.g., matching key, mask, action, priority identifier, etc.) have the same semantics, bit width and encoding format as their corresponding fields in the rule physical table.

[0023] Specifically, consistent entry sorting can include the order in which entries in the rule logical table are sorted by priority (e.g., the ruleid field) completely corresponding to the physical order of entries in the rule physical table in hardware storage space (e.g., TCAM). For example, the order of the highest priority entry A, the second highest priority entry B, and the lowest priority entry C in the rule logical table strictly follows the same storage order in the rule physical table (A is adjacent to B, and B is adjacent to C).

[0024] Consistent field mapping can mean that key fields contained in the rule logic table entries (e.g., matching fields, action fields, priority identifiers, insertion position markers, etc.) have exactly the same semantics and storage format in the rule physical table, and can be directly used for hardware matching and execution without field conversion or recoding.

[0025] As a direct result and verification of the above structural consistency, the two can maintain consistency in their update behavior: the logical operations performed on the rule logical table can be directly mapped to the operation sequence that performs the same effect on the rule physical table, and the number and order of entry movement are consistent between the two.

[0026] Furthermore, in some embodiments, the consistency of the entry structure between the rule logical table and the rule physical table can also be achieved by adopting a consistent storage layout model (e.g., the same logical block size and entry offset rules). The logical storage model managed by the rule logical table (e.g., block size, entry offset, etc.) corresponds to the actual partitioning method of the hardware physical memory.

[0027] Specifically, consistent storage models mean that the storage model abstracted by the regular logical table (e.g., linear list, block table, or tree structure) matches the actual physical storage model of the regular physical table. For example, if the regular logical table is managed according to a "block-entry" two-level structure, then the regular physical table is also organized in the chip with the same block size and entry capacity, avoiding resource fragmentation or cross-block migration caused by model differences.

[0028] Step 120: In response to a change in the access control list, based on the table structure of the rule logic table, determine and execute the logic table entry operations required to update the rule logic table from the current state to the target state.

[0029] Changes to the access control list can include, but are not limited to, adding ACL rules, deleting existing ACL rules, modifying the matching conditions or actions of existing rules, and adjusting the priority order of rules. These changes can typically be initiated through command line, network management interface, or automated scripts in the business configuration.

[0030] Based on the current structural state and change target of the rule logic table, the software processing layer performs global planning, calculates the effective atomic operations, and updates the rule logic table from the current state to the target state with minimal cost.

[0031] The current state of a rule logic table refers to the overall state of all entries (e.g., entries A, B, and C) in the rule logic table before this business change occurs, defined by their specific arrangement and content. The target state of a rule logic table refers to the new arrangement and content state that the rule logic table should ultimately achieve based on the requirements of this business change (e.g., adding entry D or deleting entry B).

[0032] Logical table entry operations refer to the basic action units used to change the state of table entries. For example, insertion adds a table entry at a specified logical position (determined by fields such as lastrid), and deletion removes a specified table entry.

[0033] Step 130: Based on the logical table entry operation, generate an operation instruction sequence, wherein the instructions in the operation instruction sequence are used to perform corresponding physical table entry operations on the rule physical table.

[0034] The logical table entry operations are based on the basic operations on the rule logical table determined in step S120, such as inserting a new entry at a certain logical position. These operations are based on the software data structure and algorithm definition.

[0035] Physical table entry operations refer to low-level hardware instructions that can be directly executed by the hardware chip and act on the regular physical table. These instructions are related to the chip's microarchitecture, memory controller, and register programming model. For example, writing entry data to TCAM address 0x1000 or clearing the entry with index 2 in SRAM block 5.

[0036] Since the table structure of the rule logic table and the rule physical table is consistent in step S110, the mapping from logical operations to physical instructions can be directly implemented. Address mapping is achieved by the software processing layer mapping logical locations to hardware physical addresses. When generating instructions, the positional parameters in the logical operations are converted into specific hardware addresses. Instruction encapsulation encapsulates the operation type (insertion / deletion) and the operation object (entry data, target address) into a command format that can be recognized by the chip driver or hardware registers.

[0037] Specifically, refer to the following example. Suppose an ACL service contains three entries, and its rule logic table structure is as follows (arranged in descending order of priority):

[0038] Under a consistent design, the storage layout of regular physical tables in the hardware chip must strictly follow the same order and content: Hardware memory address: 0x1000 corresponds to entry A (rid=A) Hardware storage address: 0x1008 corresponds to entry B (rid=B) Hardware memory address: 0x1010 corresponds to entry C (rid=C) When a new entry D (rid=D) needs to be inserted after entry B, the rule logic table calculates using an algorithm to determine that entry C needs to be shifted one position to the right, and D is inserted into the empty position, resulting in the new order: A, B, D, C. Because of the consistent structure, the rule hardware table can directly receive the operation instruction sequence "shift C one position to the right and insert D after B," without needing to recalculate the position or move other irrelevant entries.

[0039] Step 140: Send the sequence of operation instructions to complete the update of the rule physical table.

[0040] The generated operation instruction sequence is sent from the software processing layer to the hardware processing layer, driving the hardware to update the rule physical table to ensure consistency between the rule logical table and the rule physical table. Through a specific hardware-software interaction channel within the device (e.g., PCIe bus, chip-specific management interface, register programming interface, etc.), the encapsulated operation instruction sequence is transferred from the software memory space to the instruction buffer or command register of the hardware chip. After the hardware chip receives and executes the entire operation instruction sequence, the content and structure of its internal rule physical table (e.g., the ACL table in TCAM / SRAM) are completely consistent with the target state of the software layer's rule logical table, and the hardware is ready to perform message matching and forwarding based on the new table entries.

[0041] In this embodiment, by setting rule logic tables and rule physical tables with consistent entry structures, the additional relocation and conversion work caused by differences in entry structures at the hardware processing layer can be avoided, reducing performance loss during ACL updates. When the software processing layer responds to ACL changes, it directly determines and executes logical entry operations based on the rule logic table, synchronously generating corresponding operation instruction sequences and sending them to the hardware processing layer. This allows the hardware processing layer to directly execute the corresponding physical entry operations without independent calculation, achieving efficient collaboration between software and hardware updates. This shortens the entry update time when ACL services change, reduces the risk of traffic interruption due to update delays, and enhances the service stability and reliability of network devices in high-load, high-capacity ACL scenarios.

[0042] In yet another exemplary embodiment, the sequence of operation instructions directly executes the physical table entries on the rule physical table through a specific instruction interface.

[0043] Specific instruction interfaces can be predefined during hardware chip design and provided to the software processing layer as dedicated programming interfaces for directly manipulating the chip's internal table resources. Through this interface, the software processing layer can bypass the chip's traditional, inefficient self-management logic and directly manage the storage location and content of table entries, essentially granting the software processing layer management access to the regular physical table. After receiving operation instructions through this interface, the hardware chip directly drives its internal memory controller, address generator, data path, and other underlying circuits to complete the physical operations required by the operation instructions, such as "writing data Y to address X".

[0044] Specifically, a particular instruction interface can be a dedicated command queue, a set of function registers, or a message-based channel.

[0045] Refer to the following example to illustrate, assuming that entry D needs to be inserted after entry B.

[0046] In the traditional approach, the software sends: Entry_Data=D, Hint=to be inserted after B. The hardware internally needs to calculate the physical address of B, find that the position after B is occupied by C, trigger the relocation algorithm, execute the relocation, and finally write to D.

[0047] In this embodiment, the software issues the following command via a specific command interface: CMD_SEQUENCE = [WRITE_DIRECT addr=0x1018 data=C, WRITE_DIRECT addr=0x1010 data=D] After receiving the data, the hardware's internal logic can directly decode it into sending requests to the storage controller for "write address 0x1018, data C" and "write address 0x1010, data D". The hardware's original ACL entry management logic can be completely untriggered.

[0048] In this embodiment, for ACL services, the table entry migration calculation process, originally handled by the hardware processing layer, is moved to the software processing layer. The hardware processing layer provides a new interface to the software processing layer, releasing hardware management permissions. The software processing layer manages hardware resources through this interface, plans the storage location of entries in the rule physical table, and sends migration calculation results to the hardware. The hardware processing layer can then skip the migration calculation process and directly move the entries to the table. When service changes, the software processing layer provides an execution sequence based on the migration algorithm. The rule physical table performs the same migration operation based on the received results, thereby reducing the additional migration overhead caused by differences in the entry structures between the two tables. This satisfies the ACL priority mechanism, improves write performance, and meets user needs.

[0049] In yet another exemplary embodiment, the physical entry operation includes at least one of the following: a write operation to a physical storage unit; and a clear operation to a physical storage unit.

[0050] Physical table entry operations are low-level atomic operations that hardware chips can directly execute to change the state of a rule physical table. A physical storage unit is the smallest addressable storage entity that constitutes a rule physical table; its specific form depends on the chip's hardware design. Each physical storage unit has a unique hardware address and can typically hold all the relevant data (matching key, mask, actions, etc.) of an ACL entry.

[0051] A write operation is the process of storing specific data (the complete content of a table entry or a key portion thereof) into a designated physical storage unit. The hardware controller receives the target address and the data, driving the storage circuitry to complete a "write" transaction. This operation overwrites any previously existing data in the target unit. Write operations are typically used to add a new table entry or update / move an existing table entry (by writing its contents to a new location).

[0052] A wipe operation is the process of invalidating or initializing data in a specified physical storage unit (e.g., all 0s, all 1s, or a specific free flag). This can be achieved by writing a specific "empty" data pattern to the unit or by triggering internal hardware erase logic. The wipe operation deletes an entry that is no longer needed, releasing the physical resources it occupies so that it can be reused by subsequent write operations.

[0053] In this embodiment, the software processing layer directly plans and issues explicit write and clear instruction sequences. Every operation performed by the hardware processing layer is known and anticipated by the software, with no hidden actions. The total number of operations equals the number of instructions issued by the software, making the process transparent and controllable.

[0054] Figure 4 A flowchart illustrating an exemplary embodiment of this application shows a method for processing an access control list, which can be executed by a network device. Figure 4 As shown, the processing method for this access control list mainly includes the following steps: Step 210: Set up a rule logic table and a rule physical table, wherein the table entries of the rule logic table and the rule physical table have the same structure.

[0055] Step 210 can be found above. Figure 1 The specific description of step 110 in the illustrated embodiment can achieve the same technical effect, and will not be repeated here to avoid repetition.

[0056] Step 220, based on step 120 of the above embodiment, in response to a change in the access control list, based on the table entry structure of the rule logic table, determines and executes the logical table entry operations required to update the rule logic table from the current state to the target state. This embodiment may include the following specific steps: Receive a configuration information table corresponding to a change in the access control list, the configuration information table including an update mode flag; in response to the update mode flag indicating an incremental update, determine the logical table entry operation in an incremental update manner; execute the logical table entry operation to update the rule logical table.

[0057] The configuration information table is generated by the business configuration layer and is a structured data set describing the details of this ACL change. It may include ACL rule entries that need to be added, modified, or deleted, as well as metadata controlling the update behavior. See also... Figure 5 The configuration information table, as a business table, is configured by the business and then sent to the software processing layer. It contains an update mode flag, "incflag," which is a key control field indicating the update strategy to be used for this business change. The two most common modes are: Incremental update mode: usually marked as incflag=1, which aims to always keep at least one complete and valid ACL rule set available during the update process, so as to avoid traffic interruption due to temporary rule loss.

[0058] Full update / overwrite mode: usually marked as incflag=0. This mode may allow clearing some or all of the old rules before writing the new rules, which is suitable for business initialization or scenarios that tolerate short-term interruptions.

[0059] The operation sequence for incremental updates at the software processing layer is characterized by: first, performing insertion operations on all newly added entries, and then performing deletion operations on all obsolete entries. At the hardware processing layer, the operation sequence is characterized by: first, writing the new entry or the moved entry to the new location, and then clearing the replaced old entry.

[0060] It should be noted that the incremental update method for ACLs is mainly for services with high priority requirements. Incremental initialization can be used during service initialization, and subsequent service updates can also be sent incrementally.

[0061] When the software processing layer parses the configuration information table and finds that the update mode flag indicates an incremental update, it enters the incremental update processing flow. All subsequent logical table entry operations and their algorithms and plans must prioritize business continuity. Based on the current state of the rule logic table and the target changes in the configuration information table, the software processing layer runs a planning algorithm (e.g., a minimum relocation algorithm). The intermediate states and final operation sequence of the algorithm planning must ensure that the functionality has been fully taken over by the newly added or relocated entries before any old entries are deleted.

[0062] Referring to the example below, if you want to modify item B to B', in incremental mode, the planned operation sequence will not be a simple matter of deleting B first and then inserting B', because the position of B is empty in between. The correct incremental planning would be: first insert B' into a temporary empty position, then delete B, and in subsequent defragmentation, B' can be moved back to B's original position.

[0063] The software processing layer executes the planned incremental operation sequence on its rule logic table in memory. After execution, the software logic is expressed to the target state, and this update process does not lose any valid rules in the intermediate states.

[0064] Step 230: Based on the logical table entry operation, generate an operation instruction sequence, wherein the instructions in the operation instruction sequence are used to perform corresponding physical table entry operations on the rule physical table.

[0065] Step 240: Send the sequence of operation instructions to complete the update of the rule physical table.

[0066] Steps 230 and 240 can be found above. Figure 1 The specific descriptions of steps 130 and 140 in the illustrated embodiment are provided, and they achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0067] In this embodiment, by identifying update mode markers and executing incremental update mode, it is ensured that at least one complete ACL rule set is always in effect throughout the entire process of software planning and hardware execution, thus eliminating network traffic interruptions caused by temporary rule absences. Intelligent differentiation through update mode markers allows for a more direct full / overlay mode to pursue ultimate speed in scenarios where service initialization or interruption is permissible, while online service changes automatically enable incremental mode to ensure reliability. This on-demand configuration strategy balances performance and reliability.

[0068] In yet another exemplary embodiment, based on step 220 of the above embodiment, in response to the update mode being marked as indicating incremental update, the logical table entry operation is determined in an incremental update manner. This embodiment may include the following specific steps: Obtain the insertion position marker of the new rule entry from the configuration information table; determine the target insertion position in the rule logic table based on the insertion position marker; if the target insertion position is occupied, calculate the existing table entries to be moved and their movement paths for inserting the new rule entry based on the minimum movement algorithm; determine the operation of the logical table entries based on the existing table entries to be moved and their movement paths.

[0069] The insertion position marker is a key field in the configuration information table used to indicate the expected priority of new rule entries. See [link / reference]. Figure 5 The `lastrid` (Last Rule ID) is used as a logical positional reference to indicate which existing entry a new entry should follow. For example, `lastrid=B` means that the new entry should immediately follow the existing entry `B`, with a lower priority than `B`, but a higher priority than any entry following `B`.

[0070] The target insertion position is the specific logical index position found in the linear sort sequence of the current rule logical table, based on the indication of lastrid. For example, if the current table order is A, B, C, then the target insertion position corresponding to lastrid=B is the position between B and C.

[0071] The software processing layer locates the target insertion position in the rule logical table based on `lastrid`. It then checks if the position is already occupied. In the linearly ordered structure of an ACL table, a "position" is actually defined by the entries preceding and following it. If the entry pointed to by `lastrid` (e.g., B) is immediately followed by another entry (e.g., C), then the position between B and C is considered to be occupied by C. If the target insertion position is occupied, one or more existing entries must be moved to make room for the new entry.

[0072] Specifically, see Figure 5The software processing layer implements different distribution strategies based on the configuration information table sent by the business configuration layer. When `incflag` (update mode flag) is enabled, it indicates that the table distribution method is incremental, meaning entries are added first and then deleted, ensuring uninterrupted business operations. `lastrid` (insertion position flag), such as A, B, C, D, indicates the insertion position in this write operation. `rid` (entry number) is the entry number, such as A, B, C, D. The data at the insertion position is a specific entry number. For example, if the table already has entries with numbers A, B, and C, and now there is an entry with number `rid` of D, inserting at position `lastrid` = B will result in entries with numbers A, B, D, and C after the insertion. When a large number of ACL entries already exist on the device, and the newly added business entry's `rid` is not the last field, the software processing layer identifies the key field `lastrid` of the entry and selects the corresponding position in the rule logic table based on `lastrid`. If the position is already occupied, a migration algorithm is needed to reschedule the entry, freeing up the position before writing the newly added entry. See [link to documentation]. Figure 6 In the diagram, the software table corresponds to the rule logic table, and the hardware table corresponds to the rule physical table. For example, each issued entry carries the corresponding entry number rid. The table already contains three issued entries with rids A, B, and C. A new entry with rid=D and lastrid=B is issued. At this point, there is already a C after B, indicating that the position is occupied. Therefore, the entry with rid=C will be moved to the right, and the entry D will be written between B and C. The final order of the entries with rid is A, B, D, C.

[0073] The computation process based on the minimum move algorithm is as follows: The current complete state of the rule logic table, the target insertion position, and the number of new entries to be inserted (possibly multiple); different combinations of move directions are evaluated. For example, a backward move strategy moves everything after the target position (such as C and possible subsequent entries) backward; a forward move strategy moves everything before the target position (such as B and possible preceding entries) forward; a mixed strategy moves the entries before and after the target position in different directions respectively; the adjustment scheme that minimizes the total number of existing entries to be moved is found; the existing entries to be moved, as well as the source and target logical positions of each moved entry, for example, moving entry C from position 3 to position 4.

[0074] Based on the calculation results of the minimum move algorithm, the software processing layer generates a specific, ordered sequence of logical table entry operations. This sequence may include: Move operation: For each existing entry that needs to be moved, generate a MOVE(entry X, from position P, to position Q) operation.

[0075] Insertion operation: After all necessary relocation operations are completed (i.e., the target position has been logically freed up), generate an INSERT(new entry, position = target insertion position) operation.

[0076] Incremental update constraint satisfaction: In incremental update mode, the physical implementation of this operation sequence (subsequently converted into write / clear instructions) must adhere to the order of writing the newly added or moved entry first, and then clearing the overwritten old entry (add first, delete later).

[0077] The following are some examples of relocation scenarios based on the minimum relocation algorithm: Example 1: There are currently three items A, B, and C. There is space before A and after C for placing other items. If we add a new item D, which needs to be inserted between B and C, the minimum move algorithm (which completes all moves and insertions at once) will move item C to the right, requiring only one move (it will not use the algorithm that moves A and B forward).

[0078] Example 2: There are currently three items A, B, and C. There is space before A and after C to place another item. If a new item D is inserted between A and B, the minimum move algorithm will move item A forward, ultimately moving only one item (it will not use the algorithm that moves B and C backward).

[0079] The above example represents a relatively common scenario. In reality, the table size is several kilobytes or tens of kilobytes, which is far more complex than the example scenario. For example, there may be no space after entries A and C, space between A and B, space between B and C, or multiple entries may be written at once. The algorithm will take all factors into consideration to find the method with the minimum amount of data to move.

[0080] After the software processing layer completes the table entry integration, it sends the final updated table entries to the hardware processing layer. The hardware processing layer determines the location of each entry based on the location information in the table entries sent by the software processing layer. If the location is occupied, the physical rule table is moved to free up space, and the new entry is written. Since the rule logical table and rule physical table have already been constructed into the same structural model, the number of moves required for the rule logical table is the same as the number required for the rule physical table, eliminating the need for additional moves.

[0081] In this embodiment, by introducing an insertion location marker-based and minimum relocation algorithm, performance optimization and control are facilitated while ensuring lossless incremental update services. By proactively identifying the occupancy status of the target location and using the minimum relocation algorithm to globally calculate the optimal relocation scheme, the uncontrollable, chain-reaction hardware relocation in traditional schemes is transformed into a predictable and quantifiable minimum-item movement plan at the software layer, which helps improve the efficiency of the update process. The number of relocation items and the path required for each insertion are pre-calculated and known, allowing for the estimation of update time, which is helpful for system capacity planning, performance evaluation, and fault diagnosis, thereby improving product maintainability.

[0082] In yet another exemplary embodiment, the configuration information table further includes an end marker; the step of determining the logical table entry in an incremental update manner in response to the update mode marker indicating incremental update includes the following steps: The received configuration information tables are cached until the end marker is detected; all cached configuration information tables are treated as the same processing batch; based on the same processing batch, the logical table entry operations required for all newly added rule entries are determined.

[0083] The closing marker is a specific field in the configuration information table; see [link / reference]. Figure 5 The `ridnum` parameter is used to explicitly identify the boundary of a set of continuously issued service configurations.

[0084] When the flag is absent or has a specific value (such as 0), it indicates that the currently issued configuration information table is part of a larger set of business changes, and related configuration information tables may be received later. The software processing layer should not process it immediately, but should wait.

[0085] When a flag exists and has a specific value (such as a non-zero sequence number or end character), it indicates that the current configuration information table is the last item in a certain business change set. At this point, the information of a complete batch has been collected and can begin unified processing.

[0086] The term "same processing batch" refers to a group of ACL service changes represented by all configuration information tables cached by the software processing layer between two end markers. These changes are logically related (e.g., multiple adjustments to the same policy) or are temporally adjacent, making them suitable for merging and processing.

[0087] Specifically, the business configuration layer converts configuration information into incremental business table entries according to the incremental update template (each incremental field corresponds to a sub-table entry). Key fields can include: key value + mask + result + incremental field. The incremental field contains key information: update mode flag (incflag), insertion position flag (lastrid), current entry sequence number (rid), and end flag (ridnum), which is then sent to the software processing layer. The software processing layer determines the set of table entries to process based on ridnum, obtains the total number of sub-table entries (there may be multiple entry sequences), and determines the target insertion position for each entry based on the lastrid of each incremental field. The target insertion position represents the business activation priority.

[0088] After the above entries are integrated, the software processing layer performs a transfer algorithm, calculating the minimum number of transfers based on the target insertion position of each entry. Once all transfer operations have been calculated, the software processing layer updates the entries that need to be changed (essentially all transfer operations and all insertion operations at once) to its own rule logic table and sends it down to the lower-level hardware processing layer.

[0089] In this embodiment, batch caching and processing are achieved by introducing an end marker. The software processing layer can temporarily store a series of continuous change requests until a clear batch end signal is received. This allows multiple scattered changes within a time period or a logical transaction (e.g., expanding an entry to eight or inserting multiple unrelated entries in different positions) to be treated as a single change set for global optimization calculation. This helps improve the performance of overall business change processing and avoids a large number of repetitive and redundant intermediate migration operations. By setting an end marker, the business configuration layer can choose to make changes take effect immediately (setting an end marker for a single or small number of changes) or accumulate them and make them take effect uniformly (setting an end marker only for the last item in a batch of changes) according to business needs. This provides a flexible and controllable interface for business configuration and can better meet the needs of diverse operation and maintenance scenarios. The batch processing method implemented in this way can reduce the number of planning algorithm calls, software and hardware context switching and interaction. It compresses multiple calculations, multiple instruction packages, and multiple hardware interactions that may have been executed in multiple time slices into a one-time centralized calculation and distribution, which can reduce the fragmentation loss of the calculation cycle, reduce the occupation of the control bus, and improve the overall resource utilization.

[0090] In yet another exemplary embodiment, the logical entry operation is configured such that in the sequence of operation instructions generated therefrom, all write operation instructions corresponding to newly added rule entries are arranged before all clear operation instructions of replaced rule entries.

[0091] The sequence of operation instructions is a low-level instruction stream generated by the software processing layer and sent to the hardware processing layer for directly updating the rule physical table. It consists of a series of specific write operation instructions and clear operation instructions in a specific order.

[0092] New rule entries include those that need to be added to the ACL rule set during this business change. At the hardware level, they must be stored in the rule physical table through write operations.

[0093] The replaced rule entries include older entries that are no longer needed due to policy updates in this business change. These entries may be deleted directly, or they may be moved due to priority adjustments, rendering their original content invalid. At the hardware level, they ultimately need to be removed from the rule physical table through a cleanup operation.

[0094] In the final sequence of operation instructions issued to the hardware processing layer, all instructions for writing newly added or moved entries must precede any instructions for clearing replaced or obsolete entries. Interleaving between two sets of instructions is not permitted.

[0095] Specifically, the software processing layer first determines a series of logical table entry operations based on business changes (incremental update mode).

[0096] For example, insert entry D, move entry C, delete entry B. When converting these to physical instructions: Insert entry D is mapped to write (new address, data D).

[0097] Moving entry C is mapped to write (new address of C, data C) and optional clear (old address of C). Under incremental optimization, the old address of C may be overwritten by the new entry, thus omitting explicit clear.

[0098] Delete entry B by mapping to clear (the address of B).

[0099] When generating the final sequence, the software processing layer must collect all write instructions (corresponding to the addition of D and the relocated C) and place them at the beginning of the sequence. All clear instructions (corresponding to the deletion of B and, if any, clearing the old address of C) must be collected and placed at the end of the sequence.

[0100] Example of the final instruction sequence: [Write(D), Write(C_New), ..., Clear(B), Clear(C_Old)].

[0101] In this embodiment, sorting rules ensure that when the hardware performs an update, it always first ensures that the new entry and the moved entry are written to the correct position before clearing the replaced entry. At any point during this process, the physical rule table contains at least a complete and usable set of rules, and packet forwarding will not be interrupted due to missing rules. If write and clear commands are interspersed arbitrarily, there may be temporary rule gaps (new entries have not been written, but old entries have been cleared), or rule overlaps and ambiguities (new and old entries exist simultaneously, but their priority relationships are not cleared). Sorting rules can eliminate this uncertainty of intermediate states and ensure that services are not interrupted.

[0102] In yet another exemplary embodiment, the method further includes the following steps: In response to the existence of multiple non-contiguous free physical storage units in the storage space of the rule physical table, a logical entry operation for moving at least one entry from one physical storage unit to another physical storage unit is determined.

[0103] The storage space for the physical rules table refers to the hardware storage resources in the hardware chip used to store the ACL rule physical table, which is usually composed of multiple fixed-size storage blocks. These storage units may be physically contiguous, but may become discontinuous in logical allocation and use.

[0104] Non-contiguous free physical storage units refer to those unoccupied but non-adjacent storage units in the storage space. Fragmentation is a natural process. Initially, the storage space is contiguous and free. As ACL rules are continuously inserted, contiguous storage units are occupied. When some rules are deleted or updated, the storage units they occupied are released and become free. After multiple random insertions and deletions, free units will be scattered among occupied units, forming fragmentation. For example, the storage state may become: [occupied, free, occupied, occupied, free, free, occupied...].

[0105] When managing the physical tables of rules, the software processing layer continuously or periodically monitors the utilization and fragmentation of their storage space. When multiple non-contiguous free physical storage units are detected, and the distribution of these fragments may affect the allocation of subsequent large contiguous blocks of space (e.g., a batch of consecutive rules needs to be inserted, but the largest contiguous free block is insufficient), the software processing layer can proactively decide to initiate defragmentation. Triggers can be based on thresholds (e.g., fragmentation rate exceeding a set percentage), scheduled tasks, or pre-checks before a planned update.

[0106] Defragmentation fills fragmentation by moving one or more occupied entries, thereby freeing up more contiguous space at the other end. The software processing layer runs a defragmentation algorithm that analyzes the occupancy graph of the current physical table and calculates a set of entry relocation operations. These operations specify which entry will be moved from its current fragmented location (source physical storage unit) to another location that can fill the fragmentation (target physical storage unit). The relocation operations must maintain the logical priority order of all entries. That is, relocation only changes the physical storage address of the entries, not their priority order in ACL matching. Finally, a set of logical entry operations of the relocation type is output.

[0107] In this embodiment, the fragmentation problem generated during the table update process can be solved by the above method. Although the minimum migration algorithm is used for a single update, long-term random deletion will still generate fragmentation. Active compaction can ensure that storage resources are always in a state that is easy to allocate efficiently, avoid large-scale and inefficient real-time compaction due to insufficient space, and help maintain the long-term stable high performance of the system.

[0108] See Figure 7 Taking a 4K capacity ACL service as an example, this paper further illustrates the specific process of performance optimization when ACL service changes.

[0109] Assume the device already has 4K ACL services, with RIDs from 1 to 4096, all of which are non-range entries (i.e., one service corresponds to one entry). Based on this, we need to modify one of the services, changing the non-range entries to range entries, so that one service corresponds to eight entries. For example, the original service A had entry A, and the updated entry list would have entries A1-A8.

[0110] The business configuration layer updates item by item. That is, for item A, the updated A1-A8 are written first, and then the original item A is deleted, thus completing the update operation for one item.

[0111] If batch updates are not performed, the software processing layer operates as follows: When A1 is issued, the existing 4096 entries are first shifted one position to the right, and then A1 is written. The same operation is performed when A2 is issued, until all 8 entries are issued. The shifting process involves writing the entry to the new position and then deleting the entry from the old position—one add and one delete operation. The total number of operations is 8 * 4096 add operations + 8 * 4096 delete operations + 8 add operations = 65544 operations.

[0112] Based on the above embodiment using batch delivery, when writing A1-A8, the software processing layer will move the existing 4096 entries on the device backward by 8 entries, and then write the newly added A1-A8. Theoretically, the software processing layer involves the following actions: 4096 additions + 4096 deletions + 8 additions = 8200. That is, to complete the update of one business, 8200 actions are required. Finally, the number of write tables sent from the software processing layer to the hardware processing layer is 4104 (distinguished by the 'rid' field).

[0113] The example above illustrates a case where multiple entries are inserted at the same position.

[0114] If multiple entries are inserted at different positions, for example, if the table entries managed by the software processing layer are 0000000A00B0CD0E0000000, and it is now necessary to insert three entries FGH after B and four entries IJKL after C.

[0115] 1. Based on the first insertion target, it is determined that 3 positions need to be left empty after B. Currently, there is only 1 position, so 2 positions need to be freed up through the shifting algorithm.

[0116] 2. There are two methods for calculating the relocation of the first segment using algorithms: 1) Move B forward 2 positions, moving 1 item; 2) Move E one position to the right, and move C and D two positions to the right, for a total of three items moved; 3) Move B forward 1 position, and move C and D backward 1 position, moving a total of 3 entries; The optimal approach is to choose method 1), and the cache table entries after the migration are as follows: 0000000ABFGHCD0E0000000 3. Based on the previous relocation results and according to the second insertion target, it is determined that 4 empty spaces are needed after C.

[0117] 4. There are two methods for calculating and inserting the second segment using algorithms: 1) Move ABFGHC forward 4 positions respectively, moving 6 items; 2) Move D 4 positions to the right and E 3 positions to the right, moving 2 items in total; The optimal approach is to choose method 2), and the cache entries after the migration are: 0000000ABFGHCIJKLDE0000 5. The final moving sequence is: B moves forward two positions, D moves backward four positions, and E moves backward three positions.

[0118] In existing technologies, because the priority algorithm of the hard chip and the software processing layer (such as FCM) are separate and different, the arrangement of entries in the chip's table differs from that of the FCM. A worst-case scenario is used to simulate chip relocation. When the FCM writes entries to the chip, it does not write them all at once, but rather sends them one by one. When the FCM integrates and writes an entry to the chip, the entire chip is moved backward. The chip's operations include: when the FCM performs 4096 additions, the chip will move other entries, totaling 4096*(4096+1) / 2 additions; similarly, it continues to perform 4096*(4096+1) / 2 deletions, plus 8*4096 (additions to A1-A8). The total number of operations is 4096*(4096+1)+8*4096=16,814,080.

[0119] After optimization through the above embodiments, the hardware chip no longer performs any relocation; the relocation of entries is entirely controlled by the FCM, and the priority of chip entries is controlled by the FCM. In other words, after optimization, the total number of operations is only 8200 times by the FCM. The chip completely transfers algorithm management to the FCM. The rule logic table of the software processing layer is completely consistent with the rule hardware table of the hardware processing layer. The chip performs the same number of relocation operations as the FCM.

[0120] In addition to managing entry priorities, FCM also needs to manage shared block resources, i.e., defragmentation. For example, when the chip's rule physical table occupies two blocks (block1 and block2), deleting an entry on block1 requires moving block2 to block1 before deleting block2. Assuming each block stores 1024 entries, this process will generate 2048 operations (addition and deletion). Even combined with the previous 8200 operations, this is still much smaller than the 16,814,080 operations before optimization. Therefore, the speedup in table decomposition is very significant.

[0121] The above performance optimizations can solve the problem of slow updates to network device entries caused by service change operations when there are a large number of ACL services in the network device, which leads to traffic interruption. This can improve device performance and enhance network environment stability.

[0122] Corresponding to the access control list processing method provided in the above embodiments, based on the same technical concept, this application also provides an access control list processing apparatus. See also Figure 8 The device 400 is applied to network equipment and includes an entry model module 410, an entry calculation module 420, an instruction generation module 430, and an interface processing module 440.

[0123] The table entry model module 410 is used to set up a rule logical table and a rule physical table, wherein the table entry structures of the rule logical table and the rule physical table are consistent; the table entry calculation module 420 is used to, in response to a change in the access control list, determine and execute the logical table entry operations required to update the rule logical table from its current state to a target state based on the table entry structure of the rule logical table; the instruction generation module 430 is used to generate an operation instruction sequence according to the logical table entry operations, wherein the instructions in the operation instruction sequence are used to perform corresponding physical table entry operations on the rule physical table; and the interface processing module 440 is used to send the operation instruction sequence to complete the update of the rule physical table.

[0124] It should be noted that the access control list processing apparatus and the access control list processing method provided in this application embodiment are based on the same application concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned access control list processing method, and repeated details will not be described again.

[0125] Corresponding to the access control list processing method provided in the above embodiments, based on the same technical concept, this application also provides an electronic device for executing the above method. Figure 9 To illustrate the structure of an electronic device according to various embodiments of this application, as shown in the following diagrams... Figure 9 As shown. Electronic device 500 can vary considerably due to differences in configuration or performance, and may include one or more processors 510 and memory 520. Memory 520 may store one or more application programs or data. Memory 520 may be temporary or persistent storage. The application programs stored in memory 520 may include one or more modules (not shown), each module may include a series of computer-executable instructions for the electronic device. Furthermore, processor 510 may be configured to communicate with memory 520 and execute the series of computer-executable instructions stored in memory 520 on the electronic device.

[0126] Those skilled in the art will understand that Figure 9 The structure shown does not constitute a limitation on the electronic device 500, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0127] In one exemplary embodiment, a computer program product is also provided, comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform all or part of the steps of the access control list processing method shown in any of the above embodiments.

[0128] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems, devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0130] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0131] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0132] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0133] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0134] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0135] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0136] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0137] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for processing access control lists, applied to network devices, characterized in that, Includes the following steps: Set up a rule logic table and a rule physical table, wherein the table entries of the rule logic table and the rule physical table have the same structure; In response to a change in the access control list, based on the table structure of the rule logic table, the logic table entry operations required to update the rule logic table from the current state to the target state are determined and executed; Based on the logical table entry operation, an operation instruction sequence is generated, and the instructions in the operation instruction sequence are used to perform corresponding physical table entry operations on the rule physical table. Send the sequence of operation instructions to complete the update of the rule physical table.

2. The method according to claim 1, characterized in that, The consistency of the table entry structure between the rule logical table and the rule physical table includes consistency in table entry sorting and / or field mapping.

3. The method according to claim 1, characterized in that, The sequence of operation instructions directly executes the physical table entries on the rule physical table through a specific instruction interface.

4. The method according to claim 3, characterized in that, The physical entry operation includes at least one of the following: Write operations to physical storage units; The clearing operation for physical storage units.

5. The method according to claim 1, characterized in that, In response to a change in the access control list, based on the table structure of the rule logic table, the logical table entry operations required to update the rule logic table from its current state to a target state are determined and executed, including the following steps: Receive a configuration information table corresponding to a change in the access control list, the configuration information table including an update mode flag; In response to the update mode being marked as indicating incremental update, the logical table entry operation is determined in an incremental update manner; Perform the logical table entry operation to update the rule logical table.

6. The method according to claim 5, characterized in that, The step of responding to the update mode being marked as indicating incremental update and determining the logical table entry operation in an incremental update manner includes the following steps: Obtain the insertion position marker of the new rule entry from the configuration information table; The target insertion position is determined in the rule logic table based on the insertion position marker. If the target insertion position is already occupied, the existing table entries to be moved and their movement paths are calculated based on the minimum movement algorithm to insert the new rule entry; The logical entry operation is determined based on the existing entry to be moved and its movement path.

7. The method according to claim 5, characterized in that, The configuration information table also includes an end marker; The step of responding to the update mode being marked as indicating incremental update and determining the logical table entry operation in an incremental update manner includes the following steps: The received configuration information tables are cached until the end marker is detected; Treat all cached configuration information tables as the same processing batch; Based on the same processing batch, determine the logical table entry operations required for all newly added rule entries.

8. The method according to claim 5, characterized in that, The logical entry operation is configured such that in the sequence of operation instructions generated based on it, all write operation instructions corresponding to newly added rule entries are arranged before the clear operation instructions of all replaced rule entries.

9. The method according to claim 1, characterized in that, The method further includes the following steps: In response to the existence of multiple non-contiguous free physical storage units in the storage space of the rule physical table, a logical entry operation for moving at least one entry from one physical storage unit to another physical storage unit is determined.

10. An electronic device, characterized in that, The electronic device includes a processor and a memory, the memory storing programs or instructions that can run on the processor, the programs or instructions being executed by the processor to implement the steps of the access control list processing method as described in any one of claims 1 to 9.

11. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the steps of the access control list processing method as described in any one of claims 1 to 9.

Images