Multi-tenant ACL Segmentation for Network Device Memory Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems face challenges in supporting a large number of unique access control lists (ACLs) in multi-tenant environments due to memory and processing constraints, leading to increased configuration complexity and limited scalability.
Innovation Solution
The implementation of a method that identifies common and variable ACL parameters, maps parameter values, and generates a multi-tenant ACL, which combines common policies with tenant-specific variables, reducing memory and processing requirements by using a common decision tree for common rules and distinct mechanisms for unique rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If custom access control lists (ACLs) are created for different tenants, networks, or virtual machines, then access control precision is improved, but device complexity and memory requirements increase
Solution Approach 1:
The patent segments ACL parameters into two distinct categories: variable parameters (tenant-specific) and common parameters (shared across multiple tenants). This segmentation allows the system to maintain precise access control for each tenant while sharing common rules, thereby reducing overall device complexity and memory requirements.
Solution Approach 2:
The patent creates a multi-tenant ACL structure where a single ACL can serve multiple tenants by incorporating both variable parameters (specific to each tenant) and common parameters (shared across tenants). This universal ACL structure eliminates the need for completely separate ACLs for each tenant, reducing device complexity while maintaining access control precision.
2Manufacturing precision
If custom access control lists (ACLs) are created for different tenants, networks, or virtual machines, then access control precision is improved, but memory and processing constraints are exceeded
Solution Approach 1:
The patent merges multiple tenant-specific ACLs into a single multi-tenant ACL by combining variable parameters (tenant-specific values) with common parameters (shared rules). This merging reduces the total number of ACL entries stored in memory and processed by the device, while still maintaining the ability to enforce precise access control for each individual tenant.
Solution Approach 2:
The multi-tenant ACL structure allows a single ACL to serve multiple tenants simultaneously by incorporating parameter mappings that link variable parameters to specific tenants. This universal structure reduces memory and processing resource consumption compared to maintaining separate ACLs for each tenant, while preserving access control precision.
3Manufacturing precision
If multiple unique ACLs are maintained for different tenants, then access control precision is improved, but configuration complexity increases
Solution Approach 1:
The patent segments the ACL configuration into variable parameters (tenant-specific) and common parameters (shared), allowing administrators to configure access control policies in a structured manner. This segmentation simplifies configuration by enabling the reuse of common parameters across multiple tenants while only requiring tenant-specific values to be customized, thereby reducing configuration complexity while maintaining access control precision.
4Manufacturing precision
If multiple unique ACLs are maintained for different tenants, then access control precision is improved, but scalability is limited
Solution Approach 1:
The multi-tenant ACL structure creates a universal framework that can accommodate multiple tenants with a single ACL configuration. By incorporating variable parameters that map to different tenants and common parameters that apply broadly, the system achieves both access control precision for individual tenants and scalability across the entire multi-tenant environment.
Solution Approach 2:
The patent implements dynamic parameter mapping that allows variable parameters in the multi-tenant ACL to be mapped to different tenants based on runtime conditions. This dynamic capability enables the system to scale efficiently as new tenants are added or existing ones are modified, maintaining access control precision while enhancing scalability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a method includes identifying common access control list (ACL) parameters and variable ACL parameters among a plurality of tenants in a network, mapping parameter values for the variable ACL parameters to the tenants, generating a multi-tenant access control list for the tenants, storing the multi-tenant access control list and mapping at a network device, and applying the multi-tenant access control list to ports at the network device. The multi-tenant access control list includes the common ACL parameters and variable ACL parameters.