ACL Entry Storage Split Across TCAM and SRAM for Scalable Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network apparatuses face challenges with traditional ACL rule sets due to increased network size and data traffic, leading to performance degradation, configuration difficulties, high costs, limited scalability, and complexity in managing large-scale ACL rule sets.
Innovation Solution
Split ACL entries into two sections: one for source and destination addresses stored in TCAM, and the other for transport layer information stored in SRAM, using unique identifiers to associate the sections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ACL rule sets are used to control packet flow, then network security and packet filtering are achieved, but performance degrades and configuration becomes difficult as network size and data traffic increase
Solution Approach 1:
The patent divides the ACL entry into two distinct sections: a first section containing source and destination addresses stored in TCAM, and a second section containing transport layer information stored in SRAM. This segmentation allows each memory type to handle specific fields optimally, resolving the contradiction between maintaining comprehensive security rules and achieving high packet processing performance.
2Adaptability or versatility
If ACL rule sets are expanded to manage larger networks, then coverage increases, but configuration difficulty and complexity increase
Solution Approach 1:
By segmenting ACL entries into address fields (TCAM) and transport layer fields (SRAM), the system can scale network coverage without proportionally increasing configuration complexity. The TCAM handles the bulk of address-based filtering with simpler rules, while SRAM manages transport layer details separately.
Solution Approach 2:
The patent introduces a hash table as an intermediary structure that maps between TCAM and SRAM entries. This mediator enables efficient association between the two memory sections without requiring complex direct configurations, allowing the system to manage large-scale networks with reduced operational complexity.
3Reliability
If more ACL entries are stored to increase filtering capability, then security coverage improves, but hardware cost increases
Solution Approach 1:
The patent segments the storage of ACL information across two memory types with different cost characteristics. TCAM provides high-speed parallel matching for address fields, while SRAM provides cost-effective storage for transport layer fields. This segmentation optimizes the balance between security coverage and hardware cost by utilizing the strengths of each memory type.
Solution Approach 2:
The patent merges TCAM and SRAM into a hybrid storage system where each memory type handles specific portions of ACL entries. This combination achieves higher security coverage than either memory type could provide alone, while controlling hardware costs by using SRAM for less critical fields and reserving TCAM for performance-critical address matching.
Data Source
AI summary
The disclosure provides a method for storing ACL entries, a method for matching ACL entries, and a network apparatus. The method for storing ACL entries includes: obtaining an ACL entry to be stored, splitting the ACL entry into a first section and a second section, where the first section includes a source address and a destination address stored in the ACL entry, and the second section includes some or all of a transport layer source port, a transport layer destination port, a transport layer protocol type, a packet priority, and a port of the ACL entry; storing the first section in a TCAM, and storing the second section in an SRAM.