Hash-Based ACL Lookup Offload for TCAM Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing packet classification systems, particularly those using Access Control Lists (ACLs), require significant hardware resources due to the complexity of evaluating ordered rules, often relying on expensive ternary content addressable memory (TCAM) for efficient operation.
Innovation Solution
Converting an ordered ACL into contiguous subsections of mutually exclusive rules, which are then processed using a hash-based ACL lookup offload engine, reducing the need for TCAM hardware by utilizing a software/hardware-based approach for lookup operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If TCAM is used to evaluate ordered ACL rules, then packet classification accuracy is improved, but hardware cost and device complexity increase
Solution Approach 1:
The patent segments the ACL rule evaluation process into two distinct phases: a hardware-based hash table lookup phase for initial filtering, and a software-based ordered evaluation phase for final decision-making. This segmentation allows the system to leverage both hardware speed and software flexibility without requiring expensive TCAM hardware for the entire evaluation process.
Solution Approach 2:
The patent introduces a hash table as an intermediary structure between the ACL rules and the packet data. The hash table stores pre-computed hash values of ACL rules, enabling efficient initial filtering of packets before they undergo full ordered evaluation. This intermediary mechanism reduces the burden on hardware resources while maintaining classification accuracy.
2Measurement precision
If ordered ACL rules are evaluated sequentially, then access control accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing hash values of ACL rules in a hardware hash table before packet arrival. This allows the system to quickly filter packets using the hash table during data plane processing, significantly reducing the time required to evaluate ordered ACL rules while maintaining the same access control accuracy.
3Speed
If TCAM is used for ACL lookup, then lookup speed is improved, but device complexity and cost increase
Solution Approach 1:
The patent replaces expensive TCAM hardware with a more economical approach using standard hardware hash tables and software processing. The hash table can be implemented using conventional memory structures, significantly reducing hardware cost and complexity while achieving comparable or superior lookup performance through optimized data structures and algorithms.
Data Source
AI summary
Described herein are various embodiments of a network element including an access control list processing module to process an access control list of the network element. In one embodiment the access control list processing module converts the access control list into set of subsections of rules, where each rule of a subsection mutually exclusive of each other rule in the subsection. The network element may then make forwarding decisions for network data using the set of subsections of rules. In one embodiment, semantics preserving transformations can be applied to rules and data to enable more efficient processing of filtering or rules.