ACL Rule Invalidity Detection via Subset Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity and quantity of ACL rules in network devices lead to a high likelihood of invalid rules being deployed, causing resource waste and requiring time-consuming manual identification, which is prone to errors and increases labor and maintenance costs.
Innovation Solution
A method where a first network entity detects invalid ACL rules by comparing the information of potential ACL rules against stored valid rules, determining if the second information is a subset of the first, and skips sending invalid rules to a second network entity, thereby saving hardware resources and reducing manual maintenance costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual identification of invalid ACL rules is performed, then validation accuracy can be maintained, but labor costs and time consumption increase significantly
Solution Approach 1:
The patent applies preliminary action by performing automated validity detection on ACL rules before they are deployed to network devices. The detection mechanism checks whether packet features of a second ACL rule are subsets of packet features of a first ACL rule, and automatically identifies invalid rules in advance, eliminating the need for manual verification after deployment and significantly reducing time consumption while maintaining accuracy.
2Reliability
If manual identification of invalid ACL rules is performed, then validation accuracy can be maintained, but labor maintenance costs increase
Solution Approach 1:
The patent implements self-service by enabling the system to automatically detect and identify invalid ACL rules without requiring manual intervention. The detection mechanism autonomously compares packet features of different ACL rules, determines subset relationships, and identifies invalid rules independently, thereby eliminating ongoing labor maintenance costs while preserving validation accuracy through automated continuous monitoring.
3Adaptability or versatility
If invalid ACL rules are deployed on network devices, then ACL rule coverage can be increased, but hardware resources are wasted
Solution Approach 1:
The patent applies preliminary action by performing validity detection before ACL rules are deployed to network devices. The system checks whether the packet features of a second ACL rule are subsets of the first ACL rule's packet features, and only allows deployment of valid rules that do not waste hardware resources, while still maintaining comprehensive coverage through proper rule selection.
Solution Approach 2:
The patent converts the potential harm of deploying invalid rules into a benefit by using the subset relationship detection mechanism to identify and prevent such deployments. The system transforms what would be resource-wasting redundant rules into a detection opportunity, where the very act of checking for subset relationships reveals invalid rules that should not be deployed, thereby saving hardware resources while maintaining effective rule coverage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application discloses a method and an apparatus for detecting invalidity of an ACL rule. The method includes: obtaining, by a first network entity, a second ACL rule, where the first network entity includes a first entry, and the first entry includes a first rule index and first information; generating, by the first network entity, a second entry according to the second ACL rule, where the second entry includes a second rule index and second information; determining, by the first network entity, whether the second information is a subset of the first information; and if the first network entity determines that the second information is a subset of the first information, determining, by the first network entity, that the second ACL rule is an invalid ACL rule, and skipping, by the first network entity, sending the second ACL rule to a second network entity.