Complete Redundancy Removal for Packet Classifiers in TCAMs

Liu, A.X.; Gouda, Mohamed G.

doi:10.1109/tpds.2008.216

Cited by 55 publications

(35 citation statements)

References 37 publications

(52 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An algorithm of polynomial time optimal was proposed for the weighted onedimensional prefix compression problem of Access control lists by means of dynamic programming [6] [15]. This algorithm is on the basis of three explanations such as: initially the last rule of g can forever have its predicate altered to a defaulting predicate and this alteration is potential for the reason that g is absolute and as a result extending the assortment of the interval of last rule cannot modify the semantics of g. An added default rule to g can be appended devoid of altering the semantics of the consequential access control lists [9].…”

Section: Methodsmentioning

confidence: 99%

Access Control List Provides Security in Network

Chate¹,

Chirchi²

2015

IJCA

View full text Add to dashboard Cite

A significant component representing network security is access control list inspects values of every packet's field and come to a decision how to implement the network policy. Real-life access control list are naturally four dimensional over fields of four packets such as: IP address of source, destination, port number of destination and type of protocol. In several access control list, the source and destination port number fields make use of a range field constraint while the internet protocol address of source and destination and protocol type fields make use of a prefix or else ternary field constraint. Compression of access control lists is functional for system management of network and optimization for the reason that diminishing large access control lists rule sets to a great extent reduces the difficulty of supervising and optimizing configurations of network. Due to an augment in Internet applications besides enhancement in identified vulnerabilities and attacks, compression lists of access control may perhaps sanction users with outsized access control lists to make use of such devices and moreover this may develop into an increasingly critical concern intended for several users. An algorithm of polynomial time optimal was proposed for the weighted one-dimensional prefix compression problem of Access control lists by means of dynamic programming.

show abstract

Section: Methodsmentioning

confidence: 99%

Access Control List Provides Security in Network

Chate¹,

Chirchi²

2015

IJCA

View full text Add to dashboard Cite

show abstract

“…The redundant rules are classified into downward redundant rules and upward redundant rules and they formally conclude that after executing the two algorithms, resulting classifiers have no redundant rules. TCAMs are widely used but they are costly and their power consumption is very high [5].…”

Section: Working Of Firewallmentioning

confidence: 99%

A Novel Technique for Effective Optimization of Cross Domain Network Protocol for Redundancy Removal in Firewall Policies

Unde¹,

Khiani²

2015

IJCA

View full text Add to dashboard Cite

In today's rapidly progressing professional world, internet is being used as a medium for almost every operation. Firewalls are extensively implemented to prevent unauthorized access to concealed networks and secure them. Based upon the applied policies a firewall can approve or decline the data packet by scrutinizing them. The large size and intricacy of modern networks result in big and complex firewall policies. Optimizing these policies is crucial for network performance inflation. Existing system facilitates inter-firewall or intrafirewall optimization within similar sets of administrative domains. They try to achieve optimization but at the cost of decreased network performance. In this paper, a protocol to increase the network performance while the cross domain firewall rules are optimized is explained. Rule optimization is achieved by redundant rule removal between the two firewalls. For boosting the performance and security, the data sent over the network will be encrypted and decrypted over a session key. Two types of rules i.e. network and user rules are supported. User can configure his own rules as per the required configuration in appropriate domain. Network rules will be common for both the domains and can be updated by the network administrator. The key technical experimentation is that firewall policies cannot be involved within similar domain areas because a firewall strategy contains exhaustive information and even potential security holes.

show abstract

“…All prior TCAM-based classifier compression schemes (i.e., [3], [6], [7], [13], [16], [23]) suffer from one fundamental limitation: they only produce prefix classifiers, which means they all miss some opportunities for compression. A prefix classifier is a classifier in which every rule is a prefix rule.…”

Section: Limitations Of Prior Artmentioning

confidence: 99%

Bit Weaving: A Non-Prefix Approach to Compressing Packet Classifiers in TCAMs

Meiners

Liu

Torng

2012

IEEE/ACM Trans. Networking

Self Cite

141

View full text Add to dashboard Cite

Abstract-Ternary Content Addressable Memories (TCAMs) have become the de facto standard in industry for fast packet classification. Unfortunately, TCAMs have limitations of small capacity, high power consumption, high heat generation, and high cost. The well-known range expansion problem exacerbates these limitations as each classifier rule typically has to be converted to multiple TCAM rules. One method for coping with these limitations is to use compression schemes to reduce the number of TCAM rules required to represent a classifier. Unfortunately, all existing compression schemes only produce prefix classifiers. Thus, they all miss the compression opportunities created by non-prefix ternary classifiers.In this paper, we propose bit weaving, the first non-prefix compression scheme. Bit weaving is based on the observation that TCAM entries that have the same decision and whose predicates differ by only one bit can be merged into one entry by replacing the bit in question with *. Bit weaving consists of two new techniques, bit swapping and bit merging, to first identify and then merge such rules together. The key advantages of bit weaving are that it runs fast, it is effective, and it is composable with other TCAM optimization methods as a pre/post-processing routine.We implemented bit weaving and conducted experiments on both real-world and synthetic packet classifiers. Our experimental results show the following: (i) bit weaving is an effective stand-alone compression technique (it achieves an average compression ratio of 23.6%) and (ii) bit weaving finds compression opportunities that other methods miss. Specifically, bit weaving improves the prior TCAM optimization techniques of TCAM Razor and Topological Transformation by an average of 12.8% and 36.5%, respectively.

show abstract

Complete Redundancy Removal for Packet Classifiers in TCAMs

Cited by 55 publications

References 37 publications

Access Control List Provides Security in Network

Access Control List Provides Security in Network

A Novel Technique for Effective Optimization of Cross Domain Network Protocol for Redundancy Removal in Firewall Policies

Bit Weaving: A Non-Prefix Approach to Compressing Packet Classifiers in TCAMs

Contact Info

Product

Resources

About