Parallel ACL Rule Evaluation in Network Interface Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Evaluating access control lists (ACLs) in network interfaces sequentially leads to increased latency as the number of rules grows, affecting packet communication efficiency and requiring offloading to reduce server resource usage.
Innovation Solution
Implementing a network interface device with packet processing circuitry that performs parallel evaluation of ACL rules using match-action operations, including range checks, longest prefix matches, and ternary content addressable memory (TCAM) for wildcard matches, allowing for decomposition of network policies and offloading performance from server processors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If ACL rules are evaluated sequentially, then the network interface device can process packets with simple logic, but the latency increases as the number of rules grows
Solution Approach 1:
The patent segments the ACL rule evaluation process into multiple parallel evaluation paths. Instead of processing rules sequentially in a single thread, the system divides the rule set into groups that can be evaluated simultaneously using parallel processing units, thereby reducing latency while maintaining processing simplicity
Solution Approach 2:
The patent transitions from sequential (one-dimensional time-based) rule evaluation to parallel (multi-dimensional concurrent) evaluation. By introducing parallel processing dimensions, the system evaluates multiple ACL rules simultaneously rather than one after another, significantly reducing processing latency
2Reliability
If more ACL rules are added to enhance security, then network protection improves, but processing latency increases
Solution Approach 1:
The patent segments the expanded rule set into manageable parallel groups that can be evaluated concurrently. This allows the system to maintain comprehensive security coverage with numerous rules while avoiding the latency penalty of sequential processing by distributing rule evaluation across multiple parallel paths
Solution Approach 2:
The patent implements preliminary actions by pre-compiling and organizing ACL rules into parallel evaluation groups before packet processing occurs. This preparation allows the packet processing unit to rapidly evaluate multiple rules simultaneously without runtime overhead, maintaining both security coverage and processing speed
3Device complexity
If sequential ACL evaluation is used, then server processors can handle fewer rules with lower complexity, but server resource usage increases for large rule sets
Solution Approach 1:
The patent extracts the ACL rule evaluation function from the server processor and implements it in dedicated packet processing circuitry. This extraction removes the processing burden from server processors, allowing them to handle fewer rules with lower complexity while the specialized hardware handles large-scale parallel rule evaluation efficiently
Solution Approach 2:
The patent introduces packet processing circuitry as an intermediary between the server processor and the packet processing task. This intermediary component handles the computationally intensive parallel rule evaluation, freeing server processors from resource-intensive operations and reducing overall server resource consumption
Data Source
AI summary
Examples described herein relate to a network interface device comprising: an interface to a port; and circuitry to: perform parallel evaluation of multiple rules for a packet; drop the packet based at least in part on an indication by the parallel evaluation that communication with a target is not permitted; and permit communication of the packet based at least in part on a second indication by the parallel evaluation that communication with the target is permitted. In some examples, the parallel evaluation of multiple rules is to evaluate one or more of: a permitted sender Internet Protocol (IP) address range, a permitted destination IP address range, a permitted packet protocol, or a permitted egress port range.