WO2020248675A1 - Access control list issuing method and device - Google Patents

Abstract

Disclosed are an access control list (ACL) issuing method and device. Said method comprises: generating an ACL matching table according to ACL rules, each record in the ACL matching table corresponding to all the matching fields of one ACL rule; traversing the ACL matching table, so as to determine a chip logic unit matching length of each record in the ACL matching table, and updating the ACL matching table: when a record in which the chip logic unit matching length exceeds a pre-set matching length exists in the ACL matching table, performing field removing processing on the ACL matching table, so that the chip logic unit matching lengths of all the records in the ACL matching table do not exceed the pre-set matching length; and issuing the updated ACL matching table to the logic unit of the chip.

Description

Method and device for issuing access control list

Cross references to related applications

This application is filed based on the Chinese patent application with the application number 201910497981.8 and the application date on June 10, 2019, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated into this application by way of introduction.

Technical field

This application relates to the field of communication technology, and in particular to a method and device for issuing an access control list.

Background technique

ACL (Access Control List) is an access control technology. Network devices use ACLs to match and filter data packets. Generally, network equipment issues ACLs to chip logic units (slices) to implement ACL rule content matching. The bit width of the chip logic unit is a fixed value, which limits the length of ACL matching content. Although it is possible to increase the ACL matching length by using a combination of multiple logical units, due to the limited number of logical units of the chip, if each ACL rule occupies multiple logical units, the total number of ACL rules supported by the device will decrease.

In related technologies, when issuing ACL rules, chip table entries are usually occupied according to the longest matching length of the ACL rules. With the development of the network, such as the widespread application of IPv6, vxlan, etc., the number of logical units occupied by resource reservation according to the longest matching length of the ACL rule when issuing ACLs has increased significantly, and the number of logical units that actually require matching content may be far Less than the number of logical units reserved by the chip, resulting in a waste of chip ACL resources.

Summary of the invention

The technical problem to be solved by this application is to provide a method and device for issuing an access control list.

The embodiment of the application provides a method for issuing an access control list, including: generating an ACL matching table according to an ACL rule of an access control list; each record in the ACL matching table corresponds to all matching fields of an ACL rule; traversing the ACL The matching table determines the matching length of the chip logic unit of each record in the ACL matching table, and updates the ACL matching table: when there are records in the ACL matching table whose chip logic unit matching length exceeds the preset matching length When the ACL matching table is removed, the matching length of the chip logic unit of all records in the ACL matching table does not exceed the preset matching length; and the updated ACL matching table is delivered to the logic of the chip Unit.

The embodiment of the present application provides an access control list issuing device, including: an ACL matching table generation module, configured to generate an ACL matching table according to an ACL rule of an access control list; each record in the ACL matching table corresponds to an ACL rule All matching fields; ACL matching table update module, used to traverse the ACL matching table, determine the matching length of the chip logic unit of each record in the ACL matching table, and update the ACL matching table: when the ACL When there are records in the matching table whose chip logic unit matching length exceeds the preset matching length, field elimination processing is performed on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length Matching length; ACL matching table issuance module, used to distribute the updated ACL matching table to the logic unit of the chip.

The embodiment of the present application provides an access control list issuing device, including: a memory, a processor, and an access control list issuing program stored on the memory and running on the processor, and the access control list is downloaded When the distribution program is executed by the processor, the steps of the above-mentioned access control list distribution method are realized.

An embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores an access control list issuance program, and when the access control list issuance program is executed by a processor, the foregoing access control list issuance is implemented Method steps.

Description of the drawings

FIG. 1 is a flowchart of a method for issuing an access control list according to Embodiment 1 of the application;

2 is a schematic diagram of an access control list issuing apparatus according to Embodiment 2 of this application;

Fig. 3 is a flowchart of a method for updating an ACL matching table in Example 1 of the application.

Detailed ways

In order to make the purpose, technical solutions, and advantages of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. It should be noted that the embodiments in the application and the features in the embodiments can be combined with each other arbitrarily if there is no conflict.

Example 1

As shown in Figure 1, an embodiment of the present application provides a method for issuing an access control list, including:

Step S110, generating an ACL matching table according to the ACL rules of the access control list; each record in the ACL matching table corresponds to all matching fields of an ACL rule;

Step S120, traverse the ACL matching table, determine the matching length of the chip logic unit of each record in the ACL matching table, and update the ACL matching table: when there is a chip logic unit matching length in the ACL matching table When the record exceeds the preset matching length, perform field elimination processing on the ACL matching table so that the matching length of the chip logic unit of all records in the ACL matching table does not exceed the preset matching length;

In step S130, the updated ACL matching table is delivered to the logic unit of the chip.

In an embodiment, the preset matching length is set according to a message protocol or set by a user;

For example, the Ipv4 message can set the default matching length to 1 chip logic unit; the Ipv6 message can set the default matching length to 2 chip logic units;

In an implementation manner, the performing field elimination processing on the ACL matching table includes:

Determine the elimination priority of all matching fields in the ACL matching table; sort all the matching fields according to the elimination priority from high to low;

Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the i-th record in the set of records to be processed: comprising a high priority before culling m _i is determined to eliminate matching field which records the field, removed from the record fields excluding the number m _i; wherein m _i is the logic chip such that the recording The unit matching length does not exceed the minimum value of the preset matching length.

In an implementation manner, the determining the elimination priority of all matching fields in the ACL matching table includes:

Count the usage rate of each matching field in the ACL matching table;

Score the matching field according to the usage rate and/or matching weight of each matching field; the score of a matching field is used to indicate the probability of the matching field being eliminated;

In an embodiment, the scoring the matching field according to the usage rate and/or matching weight of each matching field includes:

For any matching field, evaluate the possibility of the matching field being eliminated according to the usage rate a _i of the matching field to obtain the score p _{i of} the matching field, p _i =1-a _i ; 0<a _i ≤ 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the matching weight b _i of the matching field to obtain the score p _{i of} the matching field, p _i =1-b _i ; 0<b _i ≤ 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the usage rate a _{i of} the matching field and the matching weight b _i to obtain the score p _{i of} the matching field, p _i = (1-a _i )×(1-b _i ); 0<a _i ≤1, 0≤b _i <1;

Wherein, the usage rate a _i of any matching field is the ratio of the number of records in the ACL matching table that uses the matching field to the total number of all records in the ACL matching table;

In an implementation manner, the matching weight of the matching field can be determined in any of the following ways:

Determine the matching weight b _i of the matching field according to the attention degree k _i of the matching field set by the user, b _i =k _i ; 0≤k _i ≤1

The system default match weight match field heavy attention b _i and the match field set by a user k _i determining the match field matches the weight of _{weight, b i '= k i ×} b i; 0 <b i ≤1, 0≤k _i ≤1.

Example 2

As shown in FIG. 2, an embodiment of the present application provides an access control list issuing apparatus, including:

The ACL matching table generating module 201 is configured to generate an ACL matching table according to an access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule;

The ACL matching table update module 202 is configured to traverse the ACL matching table, determine the matching length of the chip logic unit of each record in the ACL matching table, and update the ACL matching table: when the ACL matching table is When there is a record with a chip logic unit matching length exceeding a preset matching length, performing field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length;

The ACL matching table issuing module 203 is used for issuing the updated ACL matching table to the logic unit of the chip.

In an embodiment, the preset matching length is set according to a message protocol or set by a user;

For example, the Ipv4 message can set the default matching length to 1 chip logic unit; the Ipv6 message can set the default matching length to 2 chip logic units;

In an embodiment, the ACL matching table update module is configured to perform field elimination processing on the ACL matching table in the following manner:

Determine the elimination priority of all matching fields in the ACL matching table; sort all the matching fields according to the elimination priority from high to low;

Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the i-th record in the set of records to be processed: comprising a high priority before culling m _i is determined to eliminate matching field which records the field, removed from the record fields excluding the number m _i; wherein m _i is the logic chip such that the recording The unit matching length does not exceed the minimum value of the preset matching length;

In one embodiment, the ACL matching table update module is configured to determine the elimination priority of all matching fields in the ACL matching table in the following manner:

Count the usage rate of each matching field in the ACL matching table;

Score the matching field according to the usage rate and/or matching weight of each matching field; the score of a matching field is used to indicate the probability of the matching field being eliminated;

In one embodiment, the ACL matching table update module is configured to score the matching field according to the usage rate and/or matching weight of each matching field in the following manner:

For any matching field, evaluate the possibility of the matching field being eliminated according to the usage rate a _i of the matching field to obtain the score p _{i of} the matching field, p _i =1-a _i ; 0<a _i ≤ 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the matching weight b _i of the matching field to obtain the score p _{i of} the matching field, p _i =1-b _i ; 0<b _i ≤ 1; or

For any matching field, evaluate the possibility of the matching field being eliminated according to the usage rate a _{i of} the matching field and the matching weight b _i to obtain the score p _{i of} the matching field, p _i = (1-a _i )×(1-b _i ); 0<a _i ≤1, 0≤b _i <1;

Wherein, the usage rate a _i of any matching field is the ratio of the number of records in the ACL matching table that uses the matching field to the total number of all records in the ACL matching table;

In an implementation manner, the matching weight of the matching field can be determined in any of the following ways:

Determine the matching weight b _i of the matching field according to the attention degree k _i of the matching field set by the user, b _i =k _i ; 0≤k _i ≤1

The system default match weight match field heavy attention b _i and the match field set by a user k _i determining the match field matches the weight of _{weight, b i '= k i ×} b i; 0 <b i ≤1, 0≤k _i ≤1.

Example 3

The embodiment of the present application provides an access control list issuing device, including:

A memory, a processor, and an access control list issuing program stored on the memory and running on the processor, and the access control list issuing program is executed by the processor to implement the above-mentioned embodiment 1 The steps of the method for issuing an access control list.

Example 4

The embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores an access control list issuance program, and when the access control list issuance program is executed by a processor, the above-mentioned embodiment 1 is implemented. The steps of the method for issuing an access control list described above.

The following uses an example to illustrate the method for issuing an access control list of this application.

Example 1

This example provides a method for issuing an access control list. Assuming that the message is an IPv6 message, the system sets the default matching length of the ACL rule to 2 chip logic units (1 chip logic unit has a bit width of 80 bits).

Traditional ACL rules include N (N is greater than 4), and 4 are listed schematically in Table 1. The first ACL rule is Rule 1, and the content of the rule is: permit tcp srcip 1000::1 srcport 1000, and the matching fields include protocol number (tcp), source ip (1000::1), source port number (1000); where The second ACL rule is Rule 2, the content of the rule is: permit udp srcip 2000::1, and the matching fields include protocol number (udp), source ip (2000::1); the third ACL rule is Rule 3. The content is: permit tcp srcip 3000::1srcport 3000dstip 3100::1, the matching fields include protocol number (tcp), source ip (3000::1), source port number (3000), destination ip (3100::1); The fourth ACL rule is Rule 4, and the content of the rule is: permit tcp srcip 4000::1 srcport 4000 dstip 4100::1 dst 4100, and the matching fields include protocol number (tcp), source ip (4000::1), source Port number (4000), destination ip (4100::1), destination port number (4100);

Table 1

As shown in Table 2 below, an ACL matching table is generated according to a traditional ACL rule, and each record in the ACL matching table corresponds to all matching fields of an ACL rule;

Table 2

Among them, the first rule includes 3 fields. The protocol number field occupies 8 bits, the source ip field occupies 128 bits, and the source port number field occupies 16 bits, which occupies a total of 152 bits. If mapped to the chip logic unit, 2 logic units are required;

Among them, the second rule includes 2 fields. The protocol number field occupies 8 bits and the source ip field occupies 128 bits, which occupies a total of 136 bits. If it is mapped to the chip logic unit, 2 logic units are required;

Among them, the third rule includes 4 fields. The protocol number field occupies 8 bits, the source ip field occupies 128 bits, the source port number field occupies 16 bits, and the destination ip field occupies 128 bits, which occupies a total of 280 bits. If mapped to the chip logic unit, 4 Logical unit

Among them, the fourth rule includes 5 fields. The protocol number field occupies 8 bits, the source ip field occupies 128 bits, the source port number field occupies 16 bits, the destination ip field occupies 128 bits, and the destination port number field occupies 16 bits. A total of 296 bits are occupied. Chip logic unit requires 4 logic units;

Therefore, the ACL matching table is updated. As shown in Figure 3, the update processing of the ACL matching table includes the following steps:

S101: Count the usage rate of each matching field in the ACL matching table;

Wherein, the usage rate a _i of any matching field is the ratio of the number of records in the ACL matching table that uses the matching field to the total number of all records in the ACL matching table;

Among them, each matching field in Table 2 is counted, and the usage rate of each matching field is shown in Table 3 below.

Match field Usage rate a _i Agreement number 1 Source ip 1 Source port number 0.75 Destination ip 0.5 Destination port number 0.25

table 3

S102: For any matching field, determine the matching weight of the matching field according to the matching weight b _i of the matching field preset by the system and the attention degree k _i of the matching field set by the user;

_{b i '= k i × b} i; 0 <b i ≤1,0≤k i ≤1;

Among them, for each matching field in Table 2, the matching weight of the matching field preset by the system is shown in Table 4;

Match field System preset matching weight b _i Agreement number 0.5 Source ip 0.8 Source port number 0.5 Destination ip 0.7 Destination port number 0.4

Table 4

Among them, for each matching field in Table 2, the attention degree of the matching field set by the user is shown in Table 5;

Match field User set attention k _i Agreement number 0.5 Source ip 1 Source port number 1

Destination ip 0.2 Destination port number 0.2

table 5

Among them, for each matching field in Table 2, the matching weight of the matching field is determined according to the matching weight of the matching field preset by the system and the attention degree of the matching field set by the user, as shown in Table 6.

Match field Matching weight b _i '=k _i ×b _i Agreement number 0.25 Source ip 0.8 Source port number 0.5 Destination ip 0.14 Destination port number 0.08

Table 6

S103: Score the matching field according to the usage rate and matching weight of each matching field;

Among them, the score of a matching field is used to indicate the likelihood of the matching field being eliminated;

Wherein, for any matching field, the possibility of the matching field being eliminated is evaluated according to the usage rate a _{i of} the matching field and the matching weight b _i to obtain the score p _{i of} the matching field, p _i = (1- a _i )×(1-b _i ); 0<a _i ≤1, 0≤b _i <1;

Among them, for each matching field in Table 2, the score of the matching field is shown in Table 7 below.

Match field Match field score p _i Agreement number 0 Source ip 0 Source port number 0.125 Destination ip 0.258 Destination port number 0.69

Table 7

S104: Sort all matching fields according to the score from high to low;

Among them, the matching fields from high to low score are: destination port number, destination ip, source port number, source ip and protocol number (the two are tied together); therefore, the destination port number field is most likely to be eliminated.

S105, for the i-th record in the ACL matching table, judge whether i is less than or equal to N, if yes, execute step S106, otherwise end; N is the total number of records in the ACL matching table.

S106, whether the matching length of the chip logic unit of the i-th record exceeds the preset matching length, if yes, execute step S107, otherwise, execute step S108;

Wherein, the preset matching length is set according to the message protocol; for example, the preset matching length can be set to 2 chip logic units for IPv6 messages (the bit width of one chip logic unit is 80 bits);

S107, the scores of the records contained in the i-th front of the m _i is determined to eliminate matching field which records the field, removed from the record fields excluding the m th _i; wherein, the _i m So that the matching length of the recorded chip logic unit does not exceed the minimum value of the preset matching length;

Among them, the value of _mi can be understood as follows:

Take the third record in Table 2 as an example, remove the match field (destination ip field) with the highest score contained in this record, so that the matching length of the chip logic unit of this record can be shortened to 152 bits, which does not exceed 2 chip logic units, so the _mi value of this record is 1.

Take the 4th record in Table 2 as an example, eliminate the top 2 matching fields (destination port number field and destination ip field) contained in this record to shorten the matching length of the chip logic unit of this record It is 152bit, no more than 2 chip logic units, so the _mi value of this record is 2.

S108: Increase the value of i by 1, and return to step S105.

Finally, the updated ACL matching table eliminates the matching field, and the matching length of the chip logic unit of all records does not exceed the preset matching length. The updated ACL matching table is delivered to the logic unit of the chip. Compared with the solution in the related technology that uses the longest matching length of ACL rules to occupy the chip table entries, the current maximum matching length of a single logic unit is 80 bits. . The IPv6 quintuple consists of a 128-bit source IP, a 128-bit destination IP, a 16-bit source port, a 16-bit destination port, and an 8-bit protocol number, with a total of 296 bits. If an ACL rule needs to achieve complete matching of IPv6 quintuples, at least 4 logical units are required. In the technical solution of Example 1, each ACL rule occupies 2 logic units, which can greatly reduce the occupation of the logic unit of the chip. When the number of chip logic unit resources is fixed, the number of ACL rules issued to the chip can be greatly increased. In scenarios where a large number of ACL rules are configured, the ACL capacity that supports matching can be significantly improved.

The method and device for issuing an access control list provided by the present invention generate an ACL matching table according to the ACL rule of the access control list, and each record in the ACL matching table corresponds to all the matching fields of an ACL rule; traverse the ACL matching Table, determining the matching length of the chip logic unit of each record in the ACL matching table, and updating the ACL matching table: when there is a record in the ACL matching table whose chip logic unit matching length exceeds the preset matching length , Performing field elimination processing on the ACL matching table so that the matching length of the chip logic unit of all records in the ACL matching table does not exceed the preset matching length; and delivering the updated ACL matching table to the logic unit of the chip in. The technical solution of the embodiment of the present invention can save the occupation of logic units on the chip when the access control list is issued, and increase the number of ACL rules issued to the chip when the number of chip logic unit resources is certain.

A person of ordinary skill in the art can understand that all or some of the steps, functional modules/units in the system, and apparatus in the methods disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may consist of several physical components. The components are executed cooperatively. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on a computer-readable medium, and the computer-readable medium may include a computer storage medium (or a non-transitory medium) and a communication medium (or a transitory medium). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile memory implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Sexual, removable and non-removable media. Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, tape, magnetic disk storage or other magnetic storage device, or Any other medium used to store desired information and that can be accessed by a computer. In addition, as is well known to those of ordinary skill in the art, communication media usually contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery media .

It should be noted that this application can also have various other embodiments. Without departing from the spirit and essence of this application, those skilled in the art can make various corresponding changes and modifications according to this application, but these Corresponding changes and modifications should fall within the protection scope of the appended claims of this application.

Claims (10)

A method for issuing an access control list includes: Generating an ACL matching table according to an access control list ACL rule; each record in the ACL matching table corresponds to all matching fields of an ACL rule; Traverse the ACL matching table, determine the matching length of the chip logic unit of each record in the ACL matching table, and update the ACL matching table: when there is a chip logic unit matching length in the ACL matching table that exceeds the preset When matching length records, perform field elimination processing on the ACL matching table so that the matching length of the chip logic unit of all records in the ACL matching table does not exceed the preset matching length; The updated ACL matching table is delivered to the logic unit of the chip. The method of claim 1, wherein: The performing field elimination processing on the ACL matching table includes: Determine the elimination priority of all matching fields in the ACL matching table; sort all the matching fields according to the elimination priority from high to low; Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the i-th record in the set of records to be processed: comprising a high priority before culling m _i is determined to eliminate matching field which records the field, removed from the record fields excluding the number m _i; wherein m _i is the logic chip such that the recording The unit matching length does not exceed the minimum value of the preset matching length. The method of claim 2, wherein: The determining the elimination priority of all matching fields in the ACL matching table includes: Count the usage rate of each matching field in the ACL matching table; The matching field is scored according to the usage rate and/or matching weight of each matching field; the score of a matching field is used to indicate the probability of the matching field being eliminated. The method of claim 3, wherein: The scoring the matching field according to the usage rate and/or matching weight of each matching field includes: For any matching field, evaluate the possibility of the matching field being eliminated according to the usage rate a _i of the matching field to obtain the score p _{i of} the matching field, p _i =1-a _i ; 0<a _i ≤ 1; or For any matching field, evaluate the possibility of the matching field being eliminated according to the matching weight b _i of the matching field to obtain the score p _{i of} the matching field, p _i =1-b _i ; 0<b _i ≤ 1; or For any matching field, evaluate the possibility of the matching field being eliminated according to the usage rate a _{i of} the matching field and the matching weight b _i to obtain the score p _{i of} the matching field, p _i = (1-a _i )×(1-b _i ); 0<a _i ≤1, 0≤b _i <1; Wherein, the usage rate a _i of any matching field is the ratio of the number of records in the ACL matching table that uses the matching field to the total number of all records in the ACL matching table. The method of claim 3, wherein: The matching weight of the matching field can be determined in any of the following ways: Determine the matching weight b _i of the matching field according to the attention degree k _i of the matching field set by the user, b _i =k _i ; 0≤k _i ≤1 The system default match weight match field heavy attention b _i and the match field set by a user k _i determining the match field matches the weight of _{weight, b i '= k i ×} b i; 0 <b i ≤1, 0≤k _i ≤1. The method of any one of claims 1-5, wherein: The preset matching length is set according to the message protocol or set by the user. A device for issuing an access control list, including: The ACL matching table generating module is configured to generate an ACL matching table according to the ACL rules of the access control list; each record in the ACL matching table corresponds to all matching fields of an ACL rule; The ACL matching table update module is used to traverse the ACL matching table, determine the matching length of the chip logic unit of each record in the ACL matching table, and update the ACL matching table: when the ACL matching table exists When the chip logic unit matches a record whose length exceeds the preset matching length, performing field elimination processing on the ACL matching table so that the chip logic unit matching length of all records in the ACL matching table does not exceed the preset matching length; The ACL matching table distribution module is used to distribute the updated ACL matching table to the logic unit of the chip. The device of claim 7, wherein: The ACL matching table update module is used to remove fields from the ACL matching table in the following manner: Determine the elimination priority of all matching fields in the ACL matching table; sort all the matching fields according to the elimination priority from high to low; Traverse all the records in the ACL matching table whose matching length of the chip logic unit exceeds the preset matching length to generate a set of records to be processed; perform the following processing on the i-th record in the set of records to be processed: comprising a high priority before culling m _i is determined to eliminate matching field which records the field, removed from the record fields excluding the number m _i; wherein m _i is the logic chip such that the recording The unit matching length does not exceed the minimum value of the preset matching length. A device for issuing an access control list, including: A memory, a processor, and an access control list issuing program stored in the memory and running on the processor, and the access control list issuing program is executed by the processor to implement the above claims 1-6 Steps of any one of the method for issuing an access control list. A computer-readable storage medium, the computer-readable storage medium stores an access control list issuance program, and when the access control list issuance program is executed by a processor, implements any one of the foregoing claims 1-6 The steps of the method for issuing an access control list described above.

Images