ACL Lookup Early Termination and Subtable Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Access Control List (ACL) implementations using Longest Prefix Match (LPM) engines face challenges with exponential memory consumption and long lookup times due to unnecessary continued lookups and duplicate subtables, leading to inefficient packet traffic management.
Innovation Solution
The method introduces an early termination feature in LPM lookups and an iterative table construction mechanism that reduces the number of subtables and eliminates duplicates, using a data class with compression information to optimize memory usage and lookup efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard LPM lookup is used for ACL implementation, then comprehensive rule matching is achieved, but memory consumption increases exponentially and lookup time increases
Solution Approach 1:
The patent extracts and removes duplicate subtables from the LPM lookup structure. By identifying and eliminating redundant table copies, the system maintains comprehensive rule matching capability while significantly reducing memory consumption. The extraction process focuses on removing unnecessary duplicate entries that do not contribute to additional matching accuracy.
Solution Approach 2:
The patent merges duplicate subtables into a single shared table structure. Instead of maintaining separate copies of identical subtables throughout the lookup hierarchy, the system consolidates them into one referenceable table, reducing overall memory usage while preserving the ability to match all ACL rules accurately.
2Reliability
If full LPM lookup is performed for each packet, then all AC rules are checked, but lookup time increases due to unnecessary continued lookups
Solution Approach 1:
The patent implements early termination as a preliminary action that stops the lookup process as soon as a matching ACL rule is found. Instead of continuing to check all possible rules in the LPM hierarchy, the system terminates the lookup early once the first match is identified, significantly reducing lookup time while maintaining complete rule matching through proper default deny handling.
3Reliability
If duplicate subtables are maintained in LPM structure, then lookup coverage is ensured, but device complexity increases
Solution Approach 1:
The patent uses intelligent copying where duplicate subtables are replaced by references to a single master copy. Instead of maintaining physical copies of identical tables at multiple levels, the system creates reference pointers to the shared table structure, reducing device complexity while ensuring lookup coverage through proper reference management.
Data Source
AI summary
A method, data processing system, and computer program product are provided for retrieving access rules using a plurality of subtables. An incoming packet that includes fields of data is received from a network. A key is formed from the fields, the key includes a number of subkeys. The subkeys are selected and each of the selected subkeys is used to search a different subtable. If a subtable entry is a pointer, a next level subtable is searched until a failure or data is encountered. If a failure occurs, a default rule is applied. If data is encountered, the key is masked using a stored mask value. The resulting masked key is compared to a stored rule. If they match, the identified rule is applied, otherwise the default rule is applied.