Dynamic Access Control Policy Enforcement via Indirection Tables

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network policies are static and do not dynamically adapt to changing client conditions, particularly in wireless networks, where roaming clients require policies to be applied based on client-specific information that may conflict with foreign network policies.

Innovation Solution

A central controller maintains an indirection table and policy lists that map client attributes to applicable policy lists, allowing for dynamic selection and prioritization of policies, enabling flexible policy enforcement across different networks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If static policy mechanisms are used based on fixed packet attributes, then policy enforcement is simple and deterministic, but the system cannot dynamically adapt to roaming clients or apply client-specific policies

Engineering Contradiction:

Improvedynamic policy adaptationVSAvoidpolicy enforcement complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements dynamic policy enforcement by maintaining multiple policy lists in hardware (e.g., TCAM) that can be selectively applied based on client attributes. The system transitions from static single-policy enforcement to dynamic multi-policy selection, where the applicable policy list is determined by matching client attributes (MAC address, IP address, VLAN ID) against attribute tuples stored in hardware tables.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes the parameter of policy applicability by introducing attribute tuples that combine multiple packet attributes (MAC address, IP address, VLAN ID) as composite keys. This allows the policy enforcement mechanism to select different policy lists based on the specific combination of attributes, enabling dynamic adaptation without increasing operational complexity.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If multiple ACL lists are combined using software merge techniques, then flexible policy combinations are achieved, but processing speed decreases due to serial evaluation limitations

Engineering Contradiction:

Improvepolicy combination flexibilityVSAvoidpackets per second processing rate

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent replaces software-based serial merge operations with hardware-based parallel lookup structures. Multiple policy lists are loaded into hardware memory (TCAM) with attribute tuples as keys, enabling simultaneous parallel evaluation of multiple policies at line rate, eliminating the serial processing bottleneck of software implementations.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system performs preliminary action by pre-loading multiple policy lists and their associated attribute tuples into hardware memory before packet arrival. This allows the hardware to immediately perform parallel lookups without requiring runtime software merging, achieving both flexibility and high processing speed.

Inventive Principle:

Principle #10Preliminary action

3Productivity

If TCAM is used for parallel policy evaluation, then processing speed increases, but TCAM can only provide the address of the first matching entry and requires all entries to be evaluated simultaneously

Engineering Contradiction:

Improveprocessing speedVSAvoidmultiple matching conditions

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent segments the policy evaluation by organizing policies into multiple separate policy lists, each with its own attribute tuple key. The hardware performs parallel lookups across all lists simultaneously, and the system selects the appropriate policy list based on the match result, enabling multiple matching conditions without requiring sequential evaluation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces attribute tuples as intermediary structures that bridge the gap between TCAM's single-match limitation and the need for multiple matching conditions. By storing composite attribute tuples (MAC address, IP address, VLAN ID) as keys, the system enables sophisticated policy matching while maintaining hardware-speed parallel evaluation.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Ease of manufacture

If serial ACL evaluation is used, then implementation is simple in software, but the number of packets per second that can be processed is limited

Engineering Contradiction:

Improvesoftware implementation simplicityVSAvoidpackets per second

Core Design Contradiction:

Ease of manufactureVSProductivity

Solution Approach 1:

The patent replaces software-based serial ACL evaluation with hardware-based parallel evaluation using TCAM or similar associative memory structures. Multiple policy lists are loaded into hardware with attribute tuples as keys, enabling line-rate packet processing while maintaining the logical structure of multiple ACL lists for flexible policy combination.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS7945941B2Flexible access control policy enforcement

Publication Date: 2011.05.17 CISCO TECHNOLOGY INC

AI summary

A method and system for applying access-control policies. In particular implementations, a method includes determining one or more policies, and a prioritization order for the determined policies, based on the one or more parameters; accessing an indirection table to create an entry for the client, wherein the entry indicates the prioritization order of the determined policies; and creating one or more entries in one or more policy data structures for the one or more determined policies.