Hybrid ACL Entry Storage for Scalable Packet Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network apparatuses face challenges with traditional ACL rule sets due to increased size and complexity, leading to performance degradation, configuration difficulties, high costs, limited scalability, and maintenance complexities in TCAM and SRAM-based solutions.
Innovation Solution
Split ACL entries into two sections: one for source and destination addresses stored in TCAM, and the other for transport layer ports and packet priority in SRAM, using unique identifiers to enhance storage and matching efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ACL rule sets are used to control data packet flow, then network security and management objectives are achieved, but as network size and data traffic increase, ACL rule sets become larger leading to performance degradation
Solution Approach 1:
The patent segments ACL entries into two distinct sections: the first section contains source and destination addresses stored in TCAM for high-speed matching, while the second section contains transport layer ports and packet priority stored in SRAM for additional filtering. This segmentation allows each memory type to handle specific portions of the ACL rules, preventing performance degradation as rule sets expand.
2Adaptability or versatility
If ACL rule sets become larger to accommodate increased network size, then more comprehensive access control is achieved, but configuration difficulties and maintenance complexities increase
Solution Approach 1:
By dividing ACL entries into first section (addresses in TCAM) and second section (ports and priority in SRAM), the system maintains comprehensive access control while simplifying configuration. Each section can be managed independently, reducing the complexity of configuring and maintaining large-scale ACL rule sets.
3Productivity
If TCAM is used to store ACL entries for high-speed packet filtering, then rapid packet processing is achieved, but hardware costs increase
Solution Approach 1:
The patent merges TCAM and SRAM into a hybrid storage system where TCAM stores the first section of ACL entries for high-speed address matching, and SRAM stores the second section for additional filtering. This combination achieves rapid packet processing while reducing overall hardware costs by utilizing the lower-cost SRAM for portions of the ACL storage that do not require the highest speed.
4Device complexity
If ACL entries are stored in a single memory type, then storage simplicity is maintained, but scalability is limited as network grows
Solution Approach 1:
The patent segments ACL storage across two memory types (TCAM and SRAM) with distinct roles: TCAM handles address-based filtering for high-speed processing, while SRAM handles transport layer filtering for comprehensive control. This segmentation enables the system to scale effectively as network size increases, maintaining both simplicity in management and high performance in packet processing.
Data Source
Figure 1~2
Figure 3~4
AI summary
The disclosure provides a method for storing ACL entries, a method for matching ACL entries, and a network apparatus. The method for storing ACL entries includes: obtaining an ACL entry to be stored, splitting the ACL entry into a first section and a second section, where the first section includes a source address and a destination address stored in the ACL entry, and the second section includes some or all of a transport layer source port, a transport layer destination port, a transport layer protocol type, a packet priority, and a port of the ACL entry; storing the first section in a TCAM, and storing the second section in an SRAM.