US 11,606,335 B2 · Systems and methods for hierarchical access control across devices in a network environment

Abstract

Access control systems and methods herein successfully overcome ACL group width limitations of existing designs by splitting an ACL group across different units, e.g., to create two ACL groups that each has a relatively smaller width. In embodiments, availability of ACL space is increased by hierarchically splitting an ACL table to fit into different two coupled devices and modifying certain fields carrying metadata in packets that are exchanged between the devices, such that one chipset may carry information about the lookup of another. In embodiments, an ACL group for a port extender is created by selectively creating a sub-group with qualifiers that fit within an available group width, and moving the remaining qualifiers to a controlling bridge to achieve the desired functionality.

Claims20

Dependent claims

A computer-implemented method for implementing an access control rule, the method comprising:

responsive to an Access Control List (ACL) rule that exceeds a threshold amount of memory for an information handling system, the ACL rule comprising a set of ACL qualifiers and an ACL action to be performed on a packet that matches the set of ACL qualifiers:
generating, for a first information handling system, a first rule comprising a first subset of qualifiers from the set of ACL qualifiers and a marking action to mark the packet with a tag if the packet comprises data or has associated metadata that matches the first subset of qualifiers;
and
generating, for a second information handling system, a second rule comprising a second subset of qualifiers that comprises a remaining set of ACL qualifiers from the set of ACL qualifiers that were not included in the first subset of qualifiers, the tag, and the ACL action, such that execution of the first rule and second rule applies the ACL action to the packet at the second information handling system.

1 more element

A processor-implemented method comprising:

receiving, from a first information handling system at a second information handling system, a packet that comprises a tag, the tag, which was added by the first information handling system according to a first rule, indicating that the packet comprises data or associated metadata that matches a first qualifier set comprising one or more qualifiers, the first qualifier set being defined by an Access Control List (ACL) rule that relates at least the first qualifier set and a second qualifier set comprising one or more qualifiers to an ACL action, in which, responsive to the ACL rule exceeding a threshold amount of memory, the ACL rule was split into the first rule for the first information handling system and a second rule comprising the second qualifier set and the ACL action for a second information handling system;
and
in response to determining that the packet comprises data or has associated metadata that matches the second qualifier set, initiating execution of the ACL action to process according to the ACL rule.

Dependencies are inferred from the claim text.

Systems and methods for hierarchical access control across devices in a network environment

Life of this patent

Systems and methods for hierarchical access control across devices in a network environment

Life of this patent

Abstract

Claims20