Hardware Forwarding Element ACL Rule Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In traditional networks, forwarding decisions are centralized, limiting the ability to push routing decisions to network edges, which requires significant changes in forwarding elements and protocols, and introduces security risks due to compromised endpoints having control over network operations.

Innovation Solution

Implementing a hardware forwarding element without control plane logic, where control plane logic is pushed to network endpoints, using network controllers to store and distribute network topology, and endpoints generate packet headers specifying paths through forwarding elements, with forwarding elements parsing and executing actions specified in the packets.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If control plane logic is pushed to network endpoints, then network edge operation efficiency is improved, but security risks increase due to compromised endpoints having control over network operations

Engineering Contradiction:

Improvenetwork edge operation efficiencyVSAvoidsecurity risks from compromised endpoints

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

A hardware forwarding element with a trusted execution environment acts as an intermediary between network endpoints and the forwarding plane. The TEE verifies ACL rules and generates authenticated packet headers, preventing compromised endpoints from injecting malicious forwarding rules while maintaining efficient edge-based forwarding decisions.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces software-based control plane logic in endpoints with hardware-based verification in a trusted execution environment. This substitution provides cryptographic assurance that ACL rules are legitimate, eliminating the security vulnerability of software-based endpoint control while preserving forwarding efficiency.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Device complexity

If forwarding decisions are centralized, then network control is simplified, but the ability to push routing decisions to network edges is limited

Engineering Contradiction:

Improvenetwork control complexityVSAvoidrouting decision distribution capability

Core Design Contradiction:

Device complexityVSAdaptability or versatility

Solution Approach 1:

The patent segments the control plane functionality: high-level policy management remains centralized in network controllers, while local ACL verification and packet header generation are distributed to hardware forwarding elements. This segmentation enables both simplified centralized control and flexible edge-based routing decisions.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system dynamically adapts the distribution of control functions based on trust relationships. The TEE can verify ACL rules locally when trust is established, enabling distributed decision-making, while maintaining the option to centralize control when needed, providing flexible adaptability across different operational scenarios.

Inventive Principle:

Principle #15Dynamics

3Extent of automation

If hardware forwarding elements include control plane logic, then forwarding decisions can be made autonomously, but security vulnerabilities increase due to potential compromise of the control plane

Engineering Contradiction:

Improveautonomous forwarding decision capabilityVSAvoidcontrol plane security

Core Design Contradiction:

Extent of automationVSReliability

Solution Approach 1:

The TEE acts as a trusted intermediary that autonomously verifies ACL rules and generates authenticated packet headers. This autonomous verification capability enables automated forwarding decisions while the cryptographic trust model ensures that only legitimate rules are enforced, maintaining control plane security.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system pre-establishes cryptographic trust relationships between the TEE and network controllers before autonomous forwarding operations begin. This prior cushioning through key pair generation and certificate exchange ensures that autonomous decisions are secure from the outset, preventing control plane compromise.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentUS10826815B2Verification of access control list rules provided with a message

Publication Date: 2020.11.03 BAREFOOT NETWORKS INC

AI summary

Some embodiments provide a method for a forwarding element (FE) operating in a network of FEs. The method receives a data message with an access control list (ACL) rule and a first digest for the ACL rule appended to the data message. The ACL rule specifies that the packet is allowed to be sent through the network. The method verifies the ACL rule by computing a second digest from the ACL rule using a secret key and comparing the first digest to the second digest. The method determines whether the packet matches the ACL rule by comparing values in headers of the data message to values specified in the ACL rule. The method only forwards the data message if the ACL rule is verified and the packet matches the ACL rule.