Parallel ACL Evaluation in Network Interface Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network interface devices face increased latency in packet communications due to the sequential evaluation of Access Control Lists (ACLs), which becomes time-consuming as the number of applied rules increases.
Innovation Solution
Implementing a network interface device with packet processing circuitry that performs parallel evaluation of network policy and firewall ACL rules using match-action operations, including range checks, longest prefix matches, and ternary content addressable memory (TCAM) for wildcard matches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If sequential evaluation of ACL rules is used, then device complexity is reduced, but packet processing latency increases
Solution Approach 1:
The patent segments the packet processing task by separating ACL rule evaluation from the main data processing path. Network interface devices perform ACL rule evaluations in parallel using specialized circuitry, while host processors focus on data processing. This segmentation allows parallel processing of multiple ACL rules simultaneously, reducing packet processing latency without significantly increasing overall device complexity.
Solution Approach 2:
The patent introduces network interface devices as intermediary components between the host processor and the packet processing pipeline. These intermediary devices are specifically designed to handle ACL rule evaluations in parallel, acting as a mediator that offloads complex rule processing from the host processor while maintaining simplified data processing at the host level.
2Reliability
If more ACL rules are applied to enhance security, then network security improves, but packet processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-configuring and pre-compiling ACL rules in parallel evaluation structures at network interface devices. This allows the system to handle security rules in advance and maintains the ability to process multiple rules simultaneously, ensuring that increased security measures do not linearly increase packet processing time.
Solution Approach 2:
The patent applies dynamics by enabling flexible, dynamic ACL rule configurations that can be adjusted without disrupting ongoing packet processing. The parallel evaluation architecture allows dynamic updates to ACL rules while maintaining continuous processing capability, ensuring that security enhancements can be applied adaptively without significant performance penalty.
3Ease of manufacture
If sequential ACL rule processing is used, then implementation simplicity is maintained, but server resources remain occupied
Solution Approach 1:
The patent extracts ACL rule processing functionality from the host processor and relocates it to dedicated network interface devices. This extraction allows host processors to be freed from resource-intensive ACL evaluations, improving server resource utilization for tenant applications while maintaining implementation simplicity through standardized network interface device configurations.
Solution Approach 2:
The patent implements self-service by enabling network interface devices to autonomously perform ACL rule evaluations without requiring continuous host processor involvement. The parallel processing capability at network interface devices allows them to self-manage packet filtering operations, freeing server resources while maintaining straightforward implementation through standardized interfaces.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Examples described herein relate to a network interface device comprising: an interface to a port; and circuitry to: perform parallel evaluation of multiple rules for a packet; drop the packet based at least in part on an indication by the parallel evaluation that communication with a target is not permitted; and permit communication of the packet based at least in part on a second indication by the parallel evaluation that communication with the target is permitted. In some examples, the parallel evaluation of multiple rules is to evaluate one or more of: a permitted sender Internet Protocol (IP) address range, a permitted destination IP address range, a permitted packet protocol, or a permitted egress port range.