Access Control List Violation Reporting via Forwarding Table
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network devices consume excessive bus and processor bandwidth when reporting access control violations, as they require copying packets to the host processor for detailed logging, which can lead to bandwidth flooding.
Innovation Solution
The implementation of an access control list in conjunction with a forwarding table allows for efficient logging of access control violations by using a single forwarding table entry to enable or disable reporting, thereby reducing bandwidth consumption by avoiding the need to update multiple entries in the access control list.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If packets are copied to the host processor for detailed logging of access control violations, then logging completeness is improved, but bus bandwidth consumption increases
Solution Approach 1:
The patent extracts only the essential violation information (packet header fields, violation type, timestamp) from the complete packet data, storing it in a compact log buffer structure. This extraction approach provides sufficient logging detail without copying entire packets to host memory, reducing bus bandwidth consumption while maintaining logging completeness for security analysis.
Solution Approach 2:
The patent implements different quality levels of logging by storing only critical packet information (source/destination addresses, protocol type, violation reason) in the log buffer, rather than copying complete packet payloads. This local quality approach ensures that the most important security-relevant data is captured while minimizing data transfer overhead on the bus.
2Adaptability or versatility
If multiple access control list entries are updated to enable/disable reporting, then reporting control flexibility is improved, but processing time increases
Solution Approach 1:
The patent merges the reporting control functionality into a single centralized log buffer data structure that can be enabled or disabled through one control mechanism. Instead of updating multiple separate access control list entries, the system uses a unified log buffer with a single enable/disable flag, reducing the number of operations required when reporting needs to be toggled while maintaining flexible control over logging behavior.
3Measurement precision
If packets are copied to the host processor for violation reporting, then violation detection accuracy is improved, but processor bandwidth consumption increases
Solution Approach 1:
The patent extracts only the necessary violation detection information (packet classification result, violation type, relevant header fields) and stores it in the log buffer structure. This extraction provides accurate violation detection data without requiring complete packet copies to be transferred to the host processor, thereby reducing processor bandwidth consumption while maintaining detection accuracy.
Solution Approach 2:
The patent creates a simplified copy of packet information in log buffer format that contains only the essential fields needed for violation analysis (addresses, protocol type, violation reason). This selective copying approach provides sufficient data for accurate violation detection while minimizing the data transfer burden on the processor bus compared to copying entire packets.
Data Source
AI summary
Systems and methods of reporting access violations in a network device are disclosed. One such method comprises setting a forwarding index field in a specific entry of an access control list (ACL) to reference a specific forwarding table entry (FTE). The specific FTE is the only FTE associated with reporting access violations. The method further comprises setting a next destination field in the specific FTE to indicate a copy-to-processor behavior. The method further comprises setting the next destination field in the specific FTE to indicate a drop behavior. The setting of the next destination field is responsive to a timeout on a timer associated with reporting access violations.