Ordered Access Control List Conversion to Unordered Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ordered Access Control Lists (ACLs) require significant hardware resources for evaluation due to their complexity and the need for specialized hardware, especially when they contain hundreds or thousands of rules, leading to inefficient processing of network data.
Innovation Solution
A method and apparatus that convert an ordered ACL to an unordered ACL, where overlapping address ranges are resolved to independent, non-overlapping rules, allowing for flexible evaluation and reduced hardware requirements, using a process that initializes sets of permitted and denied addresses and processes each rule to create a tree structure for efficient packet processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If an ordered ACL with hundreds or thousands of rules is used to achieve precise access control, then the accuracy of access control is improved, but the hardware resource requirements and device complexity increase significantly
Solution Approach 1:
The patent segments the ordered ACL rules into multiple subsets and distributes them across different processing units or data structures. By dividing the large rule set into smaller manageable segments, the system maintains precise access control while reducing the complexity burden on any single hardware component, allowing parallel or hierarchical processing of rule subsets
Solution Approach 2:
The patent transforms the traditional one-dimensional ordered rule evaluation into a multi-dimensional structure using tree-based data structures (such as decision trees or trie structures). This dimensional transformation allows the system to organize rules hierarchically, enabling more efficient search and evaluation paths that reduce hardware resource requirements while maintaining accuracy
2Measurement precision
If an ordered ACL is evaluated using traditional methods, then the access control precision is maintained, but the processing speed and productivity decrease due to complicated hardware resources
Solution Approach 1:
The patent performs preliminary organization of ACL rules into optimized data structures (such as sorted trees or hash-based structures) before actual packet processing occurs. This pre-processing step groups rules in a way that enables faster lookup during runtime, maintaining precision while significantly improving processing speed by avoiding linear sequential evaluation
Solution Approach 2:
The patent replaces the traditional mechanical sequential evaluation mechanism with algorithmic tree-based search methods. Instead of linearly iterating through ordered rules, the system uses tree traversal algorithms that can quickly eliminate large portions of the rule set through bitwise operations and hierarchical pruning, substantially improving processing throughput
3Reliability
If TCAM-based approaches are used for ordered ACL evaluation, then the access control functionality is achieved, but the hardware cost and device complexity increase
Solution Approach 1:
The patent creates software-based copies or representations of the ACL rule sets in optimized data structures (such as in-memory tree structures) that mirror the functionality of hardware-based TCAM implementations. These software structures can be manipulated more flexibly and require less expensive hardware resources while maintaining equivalent access control functionality
Solution Approach 2:
The patent changes the fundamental parameters of rule storage and evaluation by transitioning from TCAM's bitwise parallel comparison approach to tree-based hierarchical search. This parameter change involves using different data organization methods (trees vs. parallel arrays) and evaluation strategies (sequential traversal vs. parallel comparison), reducing hardware cost while preserving functionality
Data Source
AI summary
A method and apparatus of a device that converts an ordered ACL to an unordered ACL is described. In an exemplary embodiment, a network element receives an ordered access control list that includes a set of ordered rules, where each of the ordered rules includes an address range and an action. Furthermore, if two address ranges for two of the ordered rules overlap, a corresponding action of a preceding rule overrules a corresponding action of a subsequent rule for an overlapping range of addresses. The network element further converts the ordered access control list to an unordered access control list, where the unordered access control list includes a plurality of independent rules and each of the plurality of independent rules include a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules. In addition, the network element stores the unordered access control list, where the unordered access control list is used by the network element to make forwarding decisions for processing network data.