CN112073357A - Method and device for issuing access control list - Google Patents

Abstract

This document discloses a method and device for issuing an access control list. The method includes: generating an ACL matching table according to an access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule; traversing the ACL matching table, and determining each record in the ACL matching table; The chip logic unit matching length of a record is to update the ACL matching table: when there is a record whose chip logic unit matching length exceeds the preset matching length in the ACL matching table, field culling is performed on the ACL matching table Process so that the matching length of all the chip logic units recorded in the ACL matching table does not exceed the preset matching length; and deliver the updated ACL matching table to the logic unit of the chip. The technical solution of this paper can save the occupation of the logic unit on the chip when the access control list is issued.

Description

Method and device for issuing access control list

technical field

The present invention relates to the field of communication technologies, and in particular, to a method and device for issuing an access control list.

Background technique

ACL (Access Control List, access control list) is an access control technology. Network devices use ACL to match and filter data packets. Generally, network devices deliver ACLs to chip logic units (slices) to match the content of ACL rules. The value of the bit width and length of the chip logic unit is a fixed value, which limits the length of the content matched by the ACL. Although the ACL matching length can be increased by combining multiple logical units, due to the limited number of logical units on the chip, if each ACL rule occupies multiple logical units, the total number of ACL rules supported by the device will decrease.

In the related art, when an ACL rule is issued, the chip entry is usually occupied according to the longest matching length of the ACL rule. With the development of the network, such as the wide application of IPv6, vxlan, etc., the number of logical units occupied during resource reservation according to the longest matching length of the ACL rule when ACL is issued increases significantly, and the actual number of logical units that need to match the content may be far The number of logic units is less than the number of logic units reserved on the chip, resulting in a waste of ACL resources on the chip.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is to provide a method and device for issuing an access control list, which can save the occupation of logic units on a chip when the access control list is issued.

An embodiment of the present invention provides a method for issuing an access control list, including:

An ACL matching table is generated according to the access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule;

Traverse the ACL matching table, determine the chip logic unit matching length of each record in the ACL matching table, and update the ACL matching table: when there is a chip logic unit matching length in the ACL matching table that exceeds a preset length When matching the length of the record, perform field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length;

The updated ACL matching table is delivered to the logic unit of the chip.

An embodiment of the present invention provides an access control list issuing device, including:

An ACL matching table generating module is used to generate an ACL matching table according to an access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule;

The ACL matching table updating module is used to traverse the ACL matching table, determine the chip logic unit matching length of each record in the ACL matching table, and update the ACL matching table: when the ACL matching table exists When the chip logic unit matching length exceeds the record of the preset matching length, perform field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length;

The ACL matching table delivery module is used to deliver the updated ACL matching table to the logic unit of the chip.

An embodiment of the present invention provides an access control list issuing device, including:

A memory, a processor, and an access control list issuing program stored on the memory and running on the processor, the access control list issuing program implementing the above-mentioned access control list issuing when the access control list issuing program is executed by the processor steps of the method.

An embodiment of the present invention provides a computer-readable storage medium, where an access control list distribution program is stored on the computer-readable storage medium, and the access control list distribution program implements the above-mentioned access control list distribution when the access control list distribution program is executed by a processor steps of the method.

Compared with the related art, the present invention provides a method and device for issuing an access control list, which generates an ACL matching table according to the ACL rule of the access control list, and each record in the ACL matching table corresponds to all matching fields of an ACL rule. Traverse the ACL matching table, determine the chip logic unit matching length of each record in the ACL matching table, and update the ACL matching table: when there is a chip logic unit matching length in the ACL matching table that exceeds the predetermined length When setting the record of the matching length, perform field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length; Sent to the logic unit of the chip. The technical solutions of the embodiments of the present invention can save the occupation of logic units on the chip when the access control list is issued, and increase the number of ACL rules issued to the chip when the number of chip logic unit resources is constant.

Description of drawings

1 is a flowchart of a method for issuing an access control list according to Embodiment 1 of the present invention;

2 is a schematic diagram of a device for issuing an access control list according to Embodiment 2 of the present invention;

FIG. 3 is a flowchart of a method for updating an ACL matching table according to Example 1 of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, the embodiments in the present application and the features in the embodiments may be arbitrarily combined with each other if there is no conflict.

Example 1

As shown in FIG. 1 , an embodiment of the present invention provides a method for issuing an access control list, including:

Step S110, generating an ACL matching table according to the ACL rule of the access control list; each record in the ACL matching table corresponds to all matching fields of an ACL rule;

Step S120, traverse the ACL matching table, determine the chip logic unit matching length of each record in the ACL matching table, and update the ACL matching table: when there is a chip logic unit matching length in the ACL matching table When exceeding the record of the preset matching length, perform field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length;

Step S130, delivering the updated ACL matching table to the logic unit of the chip.

In an implementation manner, the preset matching length is set according to a message protocol or set by a user;

For example, for IPv4 packets, the preset matching length can be set to 1 chip logic unit; for IPv6 packets, the preset matching length can be set to 2 chip logic units;

In one embodiment, the process of performing field elimination on the ACL matching table includes:

Determine the culling priority of all matching fields in the ACL matching table; sort all matching fields according to the culling priority from high to low;

Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the ith record in the set of records to be processed: The first m _i matching fields with high culling priorities are determined as the culling fields of this record, and the m _i culling fields are eliminated from the record; wherein, the m _i is the chip logic that makes the record The unit matching length does not exceed the minimum value of the preset matching length;

In one embodiment, the determining of the culling priority of all matching fields in the ACL matching table includes:

Statistics on the usage rate of each matching field in the ACL matching table;

The matching field is scored according to the usage rate and/or matching weight of each matching field; the score of a matching field is used to indicate the possibility that the matching field is eliminated;

In one embodiment, the scoring of the matching fields according to the usage rate and/or the matching weight of each matching field includes:

For any matching field, evaluate the possibility of the matching field being eliminated according to the utilization rate a _i of the matching field to obtain the score p _i of the matching field, p _i =1-a _i ; 0<a _i ≤ 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the matching weight b _i of the matching field to obtain the score p _i of the matching field, p _i =1- _{bi ; 0<b i ≤} 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the utilization rate a _i of the matching field and the matching weight b _i to obtain the score p _i of the matching field, p _i =(1-a _i )×(1-bi ); 0<a _i ≤1 _{, 0≤bi} <1;

Wherein, the usage rate a _i of any matching field is the ratio of the number of records using the matching field in the ACL matching table to the total number of all records in the ACL matching table;

In one embodiment, the matching weight of the matching field may be determined in any of the following ways:

Determine the matching weight b _i of the matching field according to the attention degree k _i of the matching field set by the user, b _i = _ki ; 0≤k _i ≤1

The matching weight of the matching field is determined according to the matching weight b _i of the matching field preset by the system and the attention degree _ki of the matching field set by the user, b _i '= _ki ×b _i ; 0<b _i ≤1, 0≤k _i ≤1.

Example 2

As shown in FIG. 2, an embodiment of the present invention provides an access control list issuing device, including:

The ACL matching table generating module 201 is used to generate an ACL matching table according to the access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule;

The ACL matching table updating module 202 is configured to traverse the ACL matching table, determine the chip logic unit matching length of each record in the ACL matching table, and update the ACL matching table: when the ACL matching table is in the When there is a record whose chip logic unit matching length exceeds the preset matching length, perform field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length;

The ACL matching table issuing module 203 is configured to issue the updated ACL matching table to the logic unit of the chip.

In an implementation manner, the preset matching length is set according to a message protocol or set by a user;

For example, for IPv4 packets, the preset matching length can be set to 1 chip logic unit; for IPv6 packets, the preset matching length can be set to 2 chip logic units;

In one embodiment, the ACL matching table updating module is configured to perform field elimination processing on the ACL matching table in the following manner:

Determine the culling priority of all matching fields in the ACL matching table; sort all matching fields according to the culling priority from high to low;

Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the ith record in the set of records to be processed: The first m _i matching fields with high culling priorities are determined as the culling fields of this record, and the m _i culling fields are eliminated from the record; wherein, the m _i is the chip logic that makes the record The unit matching length does not exceed the minimum value of the preset matching length;

In one embodiment, the ACL matching table updating module is configured to determine the culling priority of all matching fields in the ACL matching table in the following manner:

Statistics on the usage rate of each matching field in the ACL matching table;

The matching field is scored according to the usage rate and/or matching weight of each matching field; the score of a matching field is used to indicate the possibility that the matching field is eliminated;

In one embodiment, the ACL matching table updating module is configured to score each matching field according to the usage rate and/or matching weight of each matching field in the following manner:

For any matching field, evaluate the possibility of the matching field being eliminated according to the utilization rate a _i of the matching field to obtain the score p _i of the matching field, p _i =1-a _i ; 0<a _i ≤ 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the matching weight b _i of the matching field to obtain the score p _i of the matching field, p _i =1- _{bi ; 0<b i ≤} 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the utilization rate a _i of the matching field and the matching weight b _i to obtain the score p _i of the matching field, p _i =(1-a _i )×(1-bi ); 0<a _i ≤1 _{, 0≤bi} <1;

Wherein, the usage rate a _i of any matching field is the ratio of the number of records using the matching field in the ACL matching table to the total number of all records in the ACL matching table;

In one embodiment, the matching weight of the matching field may be determined in any of the following ways:

Determine the matching weight b _i of the matching field according to the attention degree k _i of the matching field set by the user, b _i = _ki ; 0≤k _i ≤1

The matching weight of the matching field is determined according to the matching weight b _i of the matching field preset by the system and the attention degree _ki of the matching field set by the user, b _i '= _ki ×b _i ; 0<b _i ≤1, 0≤k _i ≤1.

Example 3

An embodiment of the present invention provides a device for issuing an access control list, including:

A memory, a processor, and an access control list issuing program stored on the memory and running on the processor, the access control list issuing program being executed by the processor to implement the above-mentioned Embodiment 1 The steps of the access control list distribution method.

Example 4

An embodiment of the present invention provides a computer-readable storage medium, where an access control list distribution program is stored on the computer-readable storage medium, and when the access control list distribution program is executed by a processor, the above-mentioned embodiment 1 is implemented. The steps of the access control list distribution method described above.

The following describes the method for issuing an access control list of the present application by using an example.

Example 1

This example provides an access control list delivery method. Assuming that the packets are IPv6 packets, the system sets the default matching length of the ACL rule to 2 chip logic units (the bit width of one chip logic unit is 80 bits).

A traditional ACL rule includes N items (N is greater than 4), and 4 items are schematically listed in Table 1. The first ACL rule is Rule 1. The content of the rule is: permit tcp srcip 1000::1srcport 1000. The matching fields include protocol number (tcp), source ip (1000::1), and source port number (1000). The second ACL rule is Rule 2, the content of the rule is: permit udp srcip 2000::1, the matching fields include the protocol number (udp), the source ip (2000::1); the third ACL rule is Rule 3, the content of the rule Yes: permit tcp srcip 3000::1srcport 3000dstip 3100::1, the matching fields include protocol number (tcp), source ip (3000::1), source port number (3000), destination ip (3100::1); where The fourth ACL rule is Rule 4. The content of the rule is: permit tcp srcip4000::1srcport 4000dstip 4100::1dst 4100. The matching fields include protocol number (tcp), source ip (4000::1), source port number (4000) , destination ip (4100::1), destination port number (4100);

Table 1

As shown in Table 2 below, an ACL matching table is generated according to a traditional ACL rule, and each record in the ACL matching table corresponds to all matching fields of an ACL rule;

Table 2

Among them, the first rule includes 3 fields, the protocol number field occupies 8 bits, the source ip field occupies 128 bits, and the source port number field occupies 16 bits, occupying a total of 152 bits. If it is mapped to the chip logic unit, 2 logic units are required;

Among them, the second rule includes 2 fields, the protocol number field occupies 8 bits, the source ip field occupies 128 bits, and occupies 136 bits in total. If it is mapped to the chip logic unit, 2 logic units are required;

Among them, the third rule includes 4 fields, the protocol number field occupies 8 bits, the source ip field occupies 128 bits, the source port number field occupies 16 bits, and the destination ip field occupies 128 bits, occupying a total of 280 bits. If it is mapped to the chip logic unit, 4 logical unit;

Among them, the fourth rule includes 5 fields, the protocol number field occupies 8 bits, the source ip field occupies 128 bits, the source port number field occupies 16 bits, the destination ip field occupies 128 bits, and the destination port number field occupies 16 bits, occupying a total of 296 bits. The chip logic unit requires 4 logic units;

Therefore, the ACL matching table is updated. As shown in Figure 3, the update process of the ACL matching table includes the following steps:

S101, statistics the usage rate of each matching field in the ACL matching table;

Wherein, the usage rate a _i of any matching field is the ratio of the number of records using the matching field in the ACL matching table to the total number of all records in the ACL matching table;

Among them, each matching field in Table 2 is counted, and the usage rate of each matching field is obtained as shown in Table 3 below.

match field Usage a_i agreement number 1 source ip 1 source port number 0.75 destination ip 0.5 destination port number 0.25

table 3

S102, for any matching field, determine the matching weight of the matching field according to the matching weight b _i of the matching field preset by the system and the attention degree _ki of the matching field set by the user;

b _i '=k _i ×b _i ; 0<b _i ≤1, 0≤k _i ≤1;

Wherein, for each matching field in Table 2, the matching weight of the matching field preset by the system is shown in Table 4;

Table 4

Wherein, for each matching field in Table 2, the degree of attention of the matching field set by the user is shown in Table 5;

match field User set attention k_i agreement number 0.5 source ip 1 source port number 1 destination ip 0.2 destination port number 0.2

table 5

Wherein, for each matching field in Table 2, the matching weight of the matching field is determined according to the matching weight of the matching field preset by the system and the attention degree of the matching field set by the user, as shown in Table 6.

match field Matching weight b_i'=k_i×b_i agreement number 0.25 source ip 0.8 source port number 0.5 destination ip 0.14 destination port number 0.08

Table 6

S103, scoring the matching field according to the utilization rate and matching weight of each matching field;

Among them, the score of a matching field is used to indicate the possibility of the matching field being eliminated;

Wherein, for any matching field, the possibility of the matching field being eliminated is evaluated according to the utilization rate a _i of the matching field and the matching weight b _i to obtain the score p _i of the matching field, _pi =(1- a _i )×(1-b _i ); 0<a _i ≤1, 0≤b _i <1;

Among them, for each matching field in Table 2, the score of the matching field is shown in Table 7 below.

match field match field score p_i agreement number 0 source ip 0 source port number 0.125 destination ip 0.258 destination port number 0.69

Table 7

S104, sort all matching fields according to the scores from high to low;

Among them, the matching fields with scores from high to low are: destination port number, destination ip, source port number, source ip and protocol number (the two are in parallel); therefore, the destination port number field is most likely to be eliminated.

S105, for the i-th record in the ACL matching table, determine whether i is less than or equal to N, and if yes, execute step S106, otherwise end; N is the total number of records in the ACL matching table.

S106, whether the matching length of the chip logic unit of the i-th record exceeds the preset matching length, if yes, go to step S107, otherwise go to step S108;

Wherein, the preset matching length is set according to the message protocol; for example, for the IPv6 message, the preset matching length can be set as 2 chip logic units (the bit width of one chip logic unit is 80bit);

S107, determine the m _i matching fields in the front of the score value included in the i-th record as the rejection fields of the record, and remove the m _i rejection fields from the record; wherein, the m _i is to make the recorded chip logic unit matching length not exceed the minimum value of the preset matching length;

Among them, the value of _mi can be understood as follows:

Taking the third record in Table 2 as an example, excluding the one matching field (destination ip field) with the highest scoring value contained in this record, the matching length of the chip logic unit of this record can be shortened to 152 bits, which is not more than 152 bits. 2 chip logic units, so the m _i value of this record is 1.

Taking the fourth record in Table 2 as an example, the matching length of the chip logic unit of this record can be shortened by eliminating the two matching fields (destination port number field and destination ip field) with the top score value contained in this record. It is 152bit, no more than 2 chip logic units, so the m _i value of this record is 2.

S108, the value of i is increased by 1, and the process returns to step S105.

Finally, through the process of eliminating the matching field in the updated ACL matching table, the matching length of all recorded chip logic units does not exceed the preset matching length. The updated ACL matching table is delivered to the logic unit of the chip. Compared with the scheme in which the chip table entry is occupied according to the longest matching length of the ACL rule in the related art, the current maximum matching length of a single logic unit is 80 bits. . The quintuple of IPv6 consists of 128-bit source IP, 128-bit destination IP, 16-bit source port, 16-bit destination port, and 8-bit protocol number, with a total of 296 bits. If an ACL rule needs to achieve complete matching of IPv6 quintuple, it needs to occupy at least 4 logical units. In the technical solution of Example 1, each ACL rule occupies 2 logic units, which can greatly reduce the occupation of logic units on the chip. When the number of chip logic unit resources is constant, the number of ACL rules delivered to the chip can be greatly increased. In scenarios where a large number of ACL rules are configured, the ACL capacity that supports matching can be significantly increased.

Those of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, functional modules/units in the system, and the apparatus can be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those of ordinary skill in the art, the term computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or may Any other medium used to store desired information and which can be accessed by a computer. In addition, communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .

It should be noted that the present invention can also have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these Corresponding changes and deformations should belong to the protection scope of the appended claims of the present invention.

Claims (10)

1. A method for issuing an access control list, comprising: An ACL matching table is generated according to the access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule; Traverse the ACL matching table, determine the chip logic unit matching length of each record in the ACL matching table, and update the ACL matching table: when there is a chip logic unit matching length in the ACL matching table that exceeds a preset length When matching the length of the record, perform field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length; The updated ACL matching table is delivered to the logic unit of the chip. 2. The method of claim 1, wherein: The process of field culling on the ACL matching table includes: Determine the culling priority of all matching fields in the ACL matching table; sort all matching fields according to the culling priority from high to low; Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the ith record in the set of records to be processed: The first m _i matching fields with high culling priorities are determined as the culling fields of this record, and the m _i culling fields are eliminated from the record; wherein, the m _i is the chip logic that makes the record The unit match length does not exceed the minimum value of the preset match length. 3. The method of claim 2, wherein: Determining the culling priority of all matching fields in the ACL matching table includes: Statistics on the usage rate of each matching field in the ACL matching table; The matching fields are scored according to the usage rate and/or the matching weight of each matching field; the score of a matching field is used to indicate the possibility of the matching field being eliminated. 4. The method of claim 3, wherein: The scoring of the matching fields according to the usage rate and/or the matching weight of each matching field includes: For any matching field, evaluate the possibility of the matching field being eliminated according to the utilization rate a _i of the matching field to obtain the score p _i of the matching field, p _i =1-a _i ; 0<a _i ≤ 1; or For any matching field, evaluate the possibility of the matching field being eliminated according to the matching weight b _i of the matching field to obtain the score p _i of the matching field, p _i =1- _{bi ; 0<b i ≤} 1; or For any matching field, evaluate the possibility of the matching field being eliminated according to the utilization rate a _i of the matching field and the matching weight b _i to obtain the score p _i of the matching field, p _i =(1-a _i )×(1-bi ); 0<a _i ≤1 _{, 0≤bi} <1; Wherein, the usage rate a _i of any matching field is the ratio of the number of records using the matching field in the ACL matching table to the total number of all records in the ACL matching table. 5. The method of claim 3, wherein: The matching weight of the matching field can be determined in any of the following ways: Determine the matching weight b _i of the matching field according to the attention degree k _i of the matching field set by the user, b _i = _ki ; 0≤k _i ≤1 The matching weight of the matching field is determined according to the matching weight b _i of the matching field preset by the system and the attention degree _ki of the matching field set by the user, b _i '= _ki ×b _i ; 0<b _i ≤1, 0≤k _i ≤1. 6. The method according to any one of claims 1-5, wherein: The preset matching length is set according to the message protocol or set by the user. 7. An access control list issuing device, comprising: An ACL matching table generating module is used to generate an ACL matching table according to an access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule; The ACL matching table updating module is used to traverse the ACL matching table, determine the chip logic unit matching length of each record in the ACL matching table, and update the ACL matching table: when the ACL matching table exists When the chip logic unit matching length exceeds the record of the preset matching length, perform field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length; The ACL matching table delivery module is used to deliver the updated ACL matching table to the logic unit of the chip. 8. The device of claim 7, wherein: The ACL matching table updating module is configured to perform field elimination processing on the ACL matching table in the following manner: Determine the culling priority of all matching fields in the ACL matching table; sort all matching fields according to the culling priority from high to low; Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the ith record in the set of records to be processed: The first m _i matching fields with high culling priorities are determined as the culling fields of this record, and the m _i culling fields are eliminated from the record; wherein, the m _i is the chip logic that makes the record The unit match length does not exceed the minimum value of the preset match length. 9. An access control list issuing device, comprising: A memory, a processor, and an access control list issuing program stored on the memory and running on the processor, the access control list issuing program being executed by the processor to implement the above claims 1-6 The steps of any one of the methods for issuing an access control list. 10. A computer-readable storage medium on which an access control list issuing program is stored, and when the access control list issuing program is executed by a processor, any one of the above claims 1-6 is realized The steps of the method for issuing the access control list described in the item.

Images