TCAM Traffic Interception via Group Identifier Compression
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional ternary content-addressable memory (TCAM) systems for network security have limited capacity and are expensive, making it difficult to intercept and manage traffic from a large number of host machines effectively.
Innovation Solution
The approach involves tagging packets with group identifiers during the forwarding process, allowing a single TCAM rule to manage traffic from multiple host machines by matching on these group identifiers instead of individual hosts, thereby compressing multiple hosts into a single representation and reducing the burden on TCAM resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If TCAM is used to intercept traffic from individual host machines, then traffic interception capability is provided, but TCAM capacity is limited and memory resources are consumed quickly
Solution Approach 1:
The patent merges multiple host machine entries into a single group entry in TCAM. Instead of storing separate rules for each host machine, the system creates a group identifier that represents multiple hosts, allowing one TCAM rule to match traffic from all hosts in the group. This combining approach directly resolves the contradiction by maintaining comprehensive traffic interception capability while dramatically reducing the number of TCAM entries needed.
Solution Approach 2:
The group identifier serves multiple functions: it represents multiple host machines simultaneously, enables single rule application to multiple hosts, and reduces memory consumption. This multi-functionality allows the TCAM to maintain its traffic interception capability across many host machines without requiring proportional increases in memory capacity.
2Adaptability or versatility
If TCAM size is increased to handle more host machines, then more traffic can be intercepted, but cost and manufacturing complexity increase
Solution Approach 1:
By merging multiple host entries into a single group entry, the patent reduces the total number of TCAM entries required from N (for N host machines) to 1 (for the group). This drastic reduction in entry count directly lowers the required TCAM size, making the implementation more cost-effective and easier to manufacture while maintaining the ability to handle many host machines.
3Measurement precision
If individual host rules are stored in TCAM, then precise traffic targeting is achieved, but memory utilization efficiency decreases
Solution Approach 1:
The patent combines multiple individual host rules into a single group rule that targets traffic from all hosts in the group simultaneously. This merging maintains precise traffic targeting capability (the system can still identify and filter traffic from specific host groups) while dramatically improving memory utilization efficiency by reducing the number of entries from N to 1.
Data Source
AI summary
Incoming packets in a switch are associated with one or more group identifiers based on content contained in the incoming packets. Rules for processing the corresponding outgoing packets are identified based at least on the group identifiers associated with the incoming packets. Actions associated with matched rules are applied to the outgoing packets.