Back to results
US 10,834,085 B2Granted
Method and apparatus for speeding up ACL rule lookups that include TCP/UDP port ranges in the rules
AssigneeNXP USA, Inc.
InventorsKrishnakumar Venkataraman, Sai Naidu Kamisetti
Life of this patent
Estimating the term…
Abstract
A hardware access control list (ACL) table is used to evaluate a received network packet to identify a first rule key portion in the hardware ACL table having a first address range indicator value that matches with an address value in the network packet, and the first rule key portion is then used to search a software-maintained list of extended check nodes linked with the first rule key portion to identify a first extended check node having a first address range value that matches with the address value in the network packet and to select one or more actions contained in the first extended check node to be performed by the networking element.
Claims18
A method comprising:
- configuring a hardware access control list and a software-maintained list of one or more extended check nodes with a lookup rule;
- evaluating a network packet received at a network element using the hardware access control list to identify a first rule key portion in the hardware access control list comprising a first address range indicator value that matches with a first address value portion in the network packet;
- searching the software-maintained list of one or more extended check nodes linked with the first rule key portion by a pointer in the first rule key portion and ranked by priority to identify a first extended check node comprising a first address range value that matches with the first address value portion in the network packet, where each extended check node comprises an address range value and a specified action;
- and
- selecting one or more actions to be performed by the networking element, wherein the one or more actions are identified as the specified action contained in the first extended check node that is maintained in software separately from the hardware access control list;
- where configuring the hardware access control list and the software-maintained list of one or more extended check nodes comprises:
- generating one or more rule key portions for storage in the hardware access control list, where at least one rule key portion comprises a first key mask value for a port range for the first rule key portion;
- and
- generating one or more extended check nodes for storage in the list of one or more extended check nodes,
- where evaluating the network packet comprises generating a lookup key comprising a plurality of selector fields which is applied to index into the hardware access control list to identify the first rule key portion.
7 more elements
A networking element, comprising:
- a data packet processor comprising one or more processor cores connected to a table lookup hardware accelerator for accessing a hardware access control list, where the data packet processor is configured to:
- evaluate a received network packet using the table lookup hardware accelerator to identify a first rule key portion in the hardware access control list comprising a first range indicator value for a packet header field that matches with a packet header field value in the network packet;
- search a software-maintained list of one or more extended check nodes that are ranked by priority and linked with the first rule key portion by a pointer in the first rule key portion using the one or more processor cores to identify a first extended check node comprising a first range value for the packet header field that matches with the packet header field value in the network packet, where each extended check node comprises an address range value and a specified action;
- and
- select one or more actions to be performed by the networking element, wherein the one or more actions are identified as the specified action contained in the first extended check node that is maintained in software separately from the hardware access control list;
- and
- a central processing unit connected to configure the hardware access control list and the software-maintained list of one or more extended check nodes with a lookup rule by:
- generating one or more rule key portions for storage in the hardware access control list, where at least one rule key portion comprises a first key mask value for a port range for the first rule key portion;
- and
- generating one or more extended check nodes for storage in the software-maintained list of one or more extended check nodes,
- where the data packet processor is configured to evaluate the network packet by generating a lookup key comprising a plurality of selector fields which is applied to index into the hardware access control list to identify the first rule key portion.
8 more elements
A system for filtering received data units, comprising:
- a memory structure adapted to store a firewall rule configuration table as a hardware access control list, each entry in the hardware access control list comprising one or more key-bits and an address range indicator value corresponding to a filter rule for a data unit;
- a data packet processing element comprising one or more processor cores connected to a table lookup hardware accelerator for accessing the hardware access control list in the memory structure to:
- evaluate a received data unit using the table lookup hardware accelerator to identify a first rule key portion in the hardware access control list having a first address range indicator value that matches with a first address value portion in the data unit,
- search a software-maintained list of one or more extended check nodes that are ranked by priority and linked with the first rule key portion by a pointer in the first rule key portion using the one or more processor cores to identify a first extended check node comprising a first address range value that matches with the first address value portion in the data unit, a rule priority, and specified filtering action for the data unit associated with the first address range value, and
- select one or more actions to be performed by the system to filter the received data unit, wherein the one or more actions are identified in the specified filtering action contained in the first extended check node that is maintained in software separately from the hardware access control list;
- and
- a central processing unit connected to configure the hardware access control list and the software-maintained list of one or more extended check nodes with a lookup rule by:
- generating one or more rule key portions for storage in the hardware access control list, where at least one rule key portion comprises a first key mask value for a port range for the first rule key portion;
- and
- generating one or more extended check nodes for storage in the software-maintained list of one or more extended check nodes,
- where the data packet processor is configured to evaluate the network packet by generating a lookup key comprising a plurality of selector fields which is applied to index into the hardware access control list to identify the first rule key portion.
8 more elements
Dependencies are inferred from the claim text.