Removing Dead Access Control Entries via FIB Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As network traffic increases or network devices are added, dead Access Control Entries (ACEs) in ACLs become invalid, occupying unnecessary space and slowing network devices due to increased processing time, as they specify permissions or denials for non-existent networks.
Innovation Solution
A method and system to identify and remove dead ACEs by checking their validity using a Forwarding Information Base (FIB) and hit count, indicating ACEs as candidates for removal if their specified paths do not exist or have not been accessed, thereby optimizing ACL size and improving network manageability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the number of ACEs in the ACL is increased to accommodate more network traffic and devices, then the ACL can cover more permissions and denials, but the processing time increases and network device speed decreases
Solution Approach 1:
The patent extracts and removes dead ACEs (Access Control Entries) from the ACL that reference non-existent networks. By identifying ACEs where the source or destination network no longer exists and removing them, the system reduces the total number of ACEs while maintaining the necessary security coverage, thereby decreasing processing time without sacrificing adaptability.
Solution Approach 2:
The patent implements a mechanism to discard invalid ACEs by checking whether referenced networks exist in the FIB. Dead ACEs are identified and removed from the ACL, recovering processing resources and reducing the time required to evaluate access control rules, while the system maintains the ability to add new ACEs as networks are added.
2Stability of the object's composition
If dead ACEs are retained in the ACL, then the ACL structure remains complete, but unnecessary space is occupied and network device performance deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the system continuously monitors the validity of ACEs by checking whether their referenced networks exist in the FIB. When networks are added or removed, the system receives feedback and automatically identifies and removes dead ACEs, maintaining an optimized ACL structure that improves network device productivity without compromising structural integrity.
3Reliability
If the ACL is frequently updated to reflect network changes, then the ACL remains current and accurate, but the complexity of managing the ACL increases
Solution Approach 1:
The patent implements a self-service mechanism where the system automatically identifies and removes dead ACEs without requiring manual intervention. By autonomously checking FIB entries and eliminating invalid ACEs, the system maintains high ACL accuracy while reducing management complexity, as the automated process handles updates in response to network changes without increasing operational burden.
Data Source
AI summary
Methods and systems have been provided for removing dead Access Control Entries (ACEs) in an Access Control List (ACL). In one embodiment, the dead ACEs can be detected for an egress as well as an ingress ACL. The ACEs that have a hit count above a user-specified hit count are checked for their validity. The validity of the ACE is checked, using the information based on a Forwarding Information Base (FIB). If an ACE is found to be invalid, it is considered dead. The dead ACEs are referred as candidates for removal from the ACL. If the ACE is found to be a candidate for removal, a system administrator can either warn the network administrator about the candidate for removal or delete the ACE from the ACL after a pre-defined time limit.