ACL Lookup via Hash Key Multiplexing Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional access control list (ACL) technologies require expensive Ternary Content Addressable Memory (TCAM) for fast entry lookup, leading to long latency and increased lookup time, especially with multi-field information searches, and struggle to locate rule index addresses within one cycle.
Innovation Solution
A method and system for fast ACL table lookup using a codeword table, mask table, and hash table indexing, where a hash key is generated through multiplexing logic operations and a hash function, allowing for fast pattern matching by pointing to corresponding entries in the signature and action tables, reducing table search time and hardware latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional ACL lookup methods are used, then lookup speed is improved through TCAM, but hardware cost and complexity increase significantly
Solution Approach 1:
The patent replaces expensive TCAM hardware with standard CMOS logic and memory structures. The solution uses readily available components like RAM/ROM, multiplexers, and standard logic gates to implement ACL lookup functionality, eliminating the need for specialized expensive hardware while maintaining lookup performance.
Solution Approach 2:
The patent substitutes the mechanical/electrical TCAM structure with a software-based hash table implementation running on standard processors. The lookup mechanism transitions from direct hardware comparison (TCAM) to computational hashing and table search, replacing specialized hardware mechanics with general-purpose computational mechanics.
2Loss of time
If TCAM is used for fast ACL lookup, then lookup latency is reduced, but hardware cost increases
Solution Approach 1:
The patent employs inexpensive standard memory components (RAM, ROM) and logic gates instead of costly TCAM chips. The hash table is implemented using conventional memory structures that are significantly cheaper than TCAM, while the hash function and lookup logic use standard combinational logic that is far less expensive than TCAM hardware.
Solution Approach 2:
The patent creates a hash table that copies and reorganizes ACL data into a structure optimized for hash-based access. Instead of storing raw ACL rules in expensive TCAM, the system copies the essential lookup information into a hash table format that enables fast access through computational hashing, reducing both hardware cost and lookup latency.
3Measurement precision
If multi-field information search is performed, then matching accuracy is improved, but lookup time increases
Solution Approach 1:
The patent transforms the lookup parameters by applying a hash function to the multi-field packet information. Instead of sequentially comparing multiple fields against ACL rules (which increases lookup time), the system transforms the fields into a hash key that directly indexes the hash table, maintaining matching accuracy while reducing lookup time to constant O(1) complexity.
Solution Approach 2:
The patent introduces a hash function as an intermediary between the multi-field packet information and the ACL hash table. The hash function processes multiple fields simultaneously and produces a single hash key that serves as an intermediary index, enabling fast direct access to the hash table entry without sequential field-by-field comparison.
4Speed
If rule index address location is performed in one cycle, then lookup speed is improved, but hardware complexity increases
Solution Approach 1:
The patent replaces complex hardware address generation logic with a software-based hash function implementation. Instead of using specialized hardware circuits to compute rule index addresses in a single cycle, the system uses a hash function that can be efficiently implemented in software or simple logic, reducing hardware complexity while maintaining single-cycle lookup capability through pipelining or parallel execution.
Data Source
AI summary
The present invention provides a method for packet processing according to a access control list table, comprising: receiving a packet, wherein the packet includes a packet information and match items for matching; providing an access control list (ACL) codeword table; providing a mask table, wherein the ACL codeword table corresponds to the mask table; obtaining a hash key by performing a multiplexing logic operation, wherein the hash key is made by combining a multiplex result of the packet information and the mask table; obtaining a hash value by performing a hash function based on the hash key, wherein the hash value is composed of X+Y, wherein X is a signature table (hash table) index and Y is a key digest; performing a hash table indexing, based on the signature table index, wherein the signature table index is the index to an address of signature table; performing a fast pattern match, wherein the signature table contains signature fields, and if any second signature field in the signature table is matched with the digest key, the action table index of the same signature field is then assigned to an address index to an action table; and applying an action to the packet, wherein the action is listed in the action table.