Access Control List Reduction Through IP Prefix Graph Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of ACL rules on host machines due to multiplexing multiple services results in reduced VFP throughput and performance, leading to increased lookup times and management difficulties.
Innovation Solution
A method and system that combines multiple allowed IPs into a single or small number of IP prefixes by calculating minimum bit changes, building an ACL rule graph, and merging nodes to reduce ACL rules while maintaining security by ensuring additional IP addresses are within the same organization, thus reducing the number of allow rules and minimizing security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple services are multiplexed on a single machine, then service functionality is improved, but the number of ACL rules increases significantly
Solution Approach 1:
The patent merges multiple ACL rules that allow access from different IP addresses within the same organization into a single aggregated rule. The system identifies IP addresses belonging to the same organization and combines them into one rule, reducing the total number of ACL rules while maintaining the same level of security and access control functionality for multiple services.
2Measurement precision
If the number of ACL rules is increased, then access control precision is improved, but lookup time increases
Solution Approach 1:
The patent reduces lookup time by merging multiple specific IP address rules into single aggregated rules based on organizational affiliation. This consolidation maintains access control precision by preserving organization-level security boundaries while significantly reducing the number of individual rules that need to be checked during packet filtering operations.
3Reliability
If the number of ACL rules is increased, then security coverage is improved, but management complexity increases
Solution Approach 1:
The patent simplifies ACL management by automatically aggregating multiple IP address rules into organization-based rules. This reduces management complexity by decreasing the total number of rules that administrators need to configure and maintain, while preserving comprehensive security coverage through organization-level access control policies.
4Productivity
If ACL rules are reduced by merging IP addresses, then lookup performance is improved, but security precision may be compromised
Solution Approach 1:
The patent introduces organization affiliation as an intermediary concept for ACL rule aggregation. Instead of merging arbitrary IP addresses, the system uses organizational boundaries as the basis for aggregation, ensuring that security precision is maintained at the organization level while still achieving performance benefits through rule reduction. The organization acts as a mediator that preserves security semantics during the merging process.
Data Source
AI summary
The present disclosure relates to methods and systems for reducing access control lists (ACLs). The methods and systems combine multiple allowed internet protocol (IP) addresses from the ACLs to a single or small number of IP prefixes. The methods and systems calculate a minimum of the bit changes in transforming the IP addresses from one to another. Using the information for the minimum bit changes in transforming the IP addresses from one to another, the methods and systems build a graph of IP addresses, where the nodes are the IP addresses, and the edges denote that the IP addresses are transformed from one to another using the minimum number of bit changes. The methods and systems recursively merge the nodes to reduce the ACL rules into a compressed ACL rule graph. The methods and systems generate a reduced set of ACL rules using the compressed ACL rule graph.