TCAM ACL Disjunction via Numeric Range Table

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Ternary content addressable memory (TCAM) systems used in access control lists (ACLs) do not support logical disjunction operations, leading to resource exhaustion as disjunctive conditions are expressed as separate rules, which can result in numerous rules and inefficient use of TCAM capacity.

Innovation Solution

A modified numeric range table is introduced that allows disjunctive expressions by using an encode field to identify TCP flags and additional comparison operations, enabling a TCAM-based ACL to support logical disjunction operations without modifying the TCAM itself.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If disjunctive conditions are expressed as separate rules in TCAM-based ACL, then the ACL can be implemented with standard TCAM, but the number of rules increases leading to resource exhaustion

Engineering Contradiction:

ImproveACL functionalityVSAvoidnumber of rules

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent combines multiple disjunctive conditions into a single ACL rule by introducing a numeric range table that stores multiple condition sets. Instead of creating separate TCAM rules for each condition (e.g., one rule for ACK flag, another for RST flag), the system merges them into one rule that references the numeric range table, which contains both conditions. This reduces the number of TCAM rules from multiple to one while maintaining full disjunctive functionality.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent introduces a numeric range table as an intermediary structure between the ACL rules and the actual condition evaluation. This intermediary table stores multiple condition sets that can be referenced by a single ACL rule, allowing the system to express disjunctive conditions without multiplying the number of TCAM rules. The numeric range table acts as a mediator that holds the complexity outside the TCAM rule structure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If multiple rules are used to cover disjunctive conditions, then complete coverage is achieved, but TCAM capacity is consumed faster

Engineering Contradiction:

Improvecondition coverageVSAvoidTCAM capacity

Core Design Contradiction:

Adaptability or versatilityVSArea of stationary object

Solution Approach 1:

The patent merges multiple condition sets into a single ACL rule by using the numeric range table structure. Instead of consuming separate TCAM rule entries for each condition (ACK flag rule, RST flag rule, etc.), the system consolidates them into one rule that references the numeric range table containing all condition variations. This maintains complete condition coverage while using minimal TCAM capacity.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The numeric range table provides a universal structure that can store multiple condition sets that can be referenced by different ACL rules. A single entry in the numeric range table can serve multiple purposes and be referenced by multiple rules, making the system more efficient in its use of TCAM capacity while maintaining versatility in condition matching.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Speed

If TCAM is used for high speed searching in ACL, then search speed is improved, but TCAM capacity is costly and limited

Engineering Contradiction:

Improvesearch speedVSAvoidTCAM capacity

Core Design Contradiction:

SpeedVSQuantity of substance

Solution Approach 1:

The patent extracts the storage of multiple condition sets from the TCAM rule structure itself and places it in a separate numeric range table. This extraction allows the TCAM to maintain its high-speed searching capability with a compact rule set, while the numeric range table (which can be implemented in different memory technologies) stores the expanded condition information. This separation optimizes both search speed and capacity utilization.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments the ACL system into two parts: a compact rule set in TCAM that provides high-speed searching, and an expanded numeric range table that provides comprehensive condition storage. This segmentation allows each component to optimize for its specific function - TCAM for speed and the numeric range table for capacity - while working together to provide complete functionality.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS10541921B2Supporting access control list rules that apply to TCP segments belonging to ‘established’ connection

Publication Date: 2020.01.21 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Embodiments provide a TCAM-based access control list that supports disjunction operations in rules. A network frame is received. Embodiments determine set TCP flags of the network frame. Upon determining that the set TCP flags match a first entry in a numeric range table, bits of a search key corresponding to the first entry are updated. The search key accesses a second entry stored in a TCAM. The first entry further comprises an encode field to scan a TCP header of the network frame for set TCP flags, a first mask field to a condition corresponding to unset TCP flags to identify in the network frame, a second mask field to a condition corresponding to set TCP flags to identify in the network frame, and an operation field specifying a disjunction operation for comparing the set TCP flags with the first mask field and the second mask field.