Access Control Rule Encoding for Memory-Efficient Packet Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of packets transmitted via network devices leads to an excessive memory occupation by access control rules due to the inclusion of more types of fields, posing a challenge to storage space and requiring a method to reduce memory usage.
Innovation Solution
Encoding rule addresses based on their coverage relationship to obtain first codes of shorter length, replacing the original rule addresses in access control rules, which maintains the coverage relationship and allows for additional fields to be added, thereby reducing memory and improving scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If more types of fields are included in the access control rule to match increasing packet diversity, then the matching capability and versatility are improved, but the memory occupation and storage space are excessively increased
Solution Approach 1:
The patent segments the access control rule into multiple levels: a first level containing commonly used fields with full length, and a second level containing less frequently used fields with shortened length. This segmentation allows the system to prioritize storage of essential matching fields while reducing overall memory occupation by compressing less critical fields.
Solution Approach 2:
The patent changes the parameter of field length in the access control rule by shortening the length of fields in the second level. This parameter modification reduces the total memory occupation while preserving the essential matching capability, as the shortened fields still retain sufficient information for packet classification.
2Quantity of substance
If the length of access control rule is reduced by encoding, then memory occupation is reduced, but the complexity of encoding and decoding processes is increased
Solution Approach 1:
The patent applies preliminary action by pre-establishing a correspondence relationship between original fields and shortened encoded fields before the actual packet matching process. This correspondence table is built in advance, allowing the system to quickly map shortened fields back to their original meanings during matching, thereby reducing the complexity of real-time encoding operations.
Solution Approach 2:
The patent introduces an intermediary correspondence relationship (mapping table) that connects the shortened encoded fields with the original field meanings. This intermediary structure simplifies the encoding process by providing a direct lookup mechanism, avoiding complex real-time encoding algorithms while maintaining the ability to interpret shortened fields correctly.
3Quantity of substance
If fields are shortened to reduce memory usage, then storage space is saved, but the precision of packet matching may be compromised
Solution Approach 1:
The patent applies local quality by differentiating the treatment of different fields within the access control rule. Frequently used and critical fields are maintained at full length to preserve matching precision, while less frequently used fields are shortened to save storage space. This localized optimization ensures that precision is maintained where it matters most while achieving overall compression.
Solution Approach 2:
The patent applies partial action by selectively shortening only certain fields (those in the second level) rather than uniformly compressing all fields. This partial compression approach maintains sufficient precision for critical matching fields while achieving storage reduction through compression of less critical fields, balancing precision and space efficiency.
Data Source
AI summary
A rule processing method includes: an encoding device obtains a plurality of rule addresses, and determines a coverage relationship between rule addresses in the plurality of rule addresses. Then, the encoding device may encode the rule addresses based on the coverage relationship between the rule addresses to obtain first codes of the rule addresses, and replace rule addresses included in an access control rule with the first codes of the rule addresses. The rule address is used to match a packet address carried in a packet, one rule address is one field included in one access control rule, and a length of the first code is less than a length of the rule address corresponding to the first code.