Network Element ACL Lookup via Action Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network elements face inefficiencies in applying multiple Access Control Entries (ACEs) to packets due to the need for multiple searches within Access Control Lists (ACLs), which increases processing time and limits the number of ACEs that can be identified, potentially missing relevant actions.
Innovation Solution
Creating lookup tables such as Radix tables, hash-based tables, or binary search trees to enable a single ACL search that returns an action record containing multiple actions for a packet, allowing all non-conflicting ACE actions to be applied efficiently, with the ability to update these tables without replacing the entire ACL.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple ACEs are applied to packets using conventional sequential retrieval, then comprehensive filtering coverage is achieved, but processing time increases and throughput decreases
Solution Approach 1:
The patent pre-processes ACEs into action records during idle periods, organizing filtering rules into optimized data structures before they are needed for packet processing. This preliminary organization allows the filtering engine to quickly retrieve and apply multiple ACE actions without performing multiple sequential searches during active packet processing, thereby maintaining both comprehensive filtering coverage and high throughput
Solution Approach 2:
The patent creates action records as simplified copies of ACEs that contain only the essential filtering criteria and associated actions. These action records are stored in a separate data structure optimized for rapid retrieval, eliminating the need to repeatedly search through the original ACE lists during packet processing. The copying approach allows the system to maintain complete filtering logic while enabling fast parallel retrieval of multiple matching rules
2Reliability
If multiple searches are performed within ACLs to locate applicable ACEs, then all relevant filter rules are identified, but the number of ACEs that can be processed is limited by processing time
Solution Approach 1:
The system performs preliminary organization of ACEs into action records during idle periods, creating an optimized lookup structure that enables single-search retrieval of all applicable filtering rules. This pre-processing eliminates the need for multiple sequential searches during packet processing, allowing the system to identify all relevant filter rules while minimizing search time to a single efficient lookup operation
Solution Approach 2:
The patent implements a dynamic filtering engine that can adaptively retrieve action records based on packet characteristics. The system dynamically determines which action records to retrieve and applies them in parallel, optimizing the filtering process for different traffic patterns while maintaining the ability to identify all relevant rules without being constrained by fixed search time limits
3Adaptability or versatility
If ACEs are stored and processed in traditional ACL structures, then filter rules can be defined flexibly, but the system cannot efficiently apply multiple non-conflicting ACE actions simultaneously
Solution Approach 1:
The patent segments the filtering system into distinct components: ACE definitions stored in traditional ACL structures for flexible rule configuration, and derived action records stored in optimized data structures for efficient retrieval. This segmentation allows the system to maintain flexible filter rule definitions while enabling efficient parallel application of multiple non-conflicting ACE actions through the segmented action record structure
Solution Approach 2:
The patent introduces action records as an intermediary data structure between the original ACE definitions and the packet filtering engine. These action records serve as a bridge, containing pre-processed filtering information that can be rapidly retrieved and applied. The intermediary structure enables the system to maintain flexible ACE definitions while achieving efficient multi-action application through the mediating action record layer
Data Source
AI summary
Multiple non-conflicting actions associated with filter rules may be located and applied to a packet using a single ACL lookup by causing action records to be created from ACEs in the ACL, and then causing the ACL lookup to return the action record rather than any one particular ACE. Radix tables may be created to enable a search engine to quickly locate the appropriate action record based on a particular set of attributes associated with the incoming packet. The action record can contain multiple actions taken from multiple ACEs that apply to the particular packet. By grouping all the actions into an action record, and then searching for an action record that applies to the packet, it is possible to apply all non-conflicting actions to the packet regardless of the number of ACEs that are used to specify those actions. Since all the actions are located together, the actions of all ACEs may be applied to a packet using a single ACL lookup.