A DIFFERENCE RESOLUTION APPROACH TO COMPRESSING ACCESS

CONTROL LISTS

ABSTRACT:
Access control lists (ACLs) are the core of many networking and security devices. As
new threats and vulnerabilities emerge, ACLs on routers and firewalls are getting larger.
Therefore, compressing ACLs is an important problem. In this paper, we propose a new
approach, called Diplomat, to ACL compression. The key idea is to transform higher
dimensional target patterns into lower dimensional patterns by dividing the original pattern
into a series of hyper planes and then resolving differences between two adjacent hyperplanes
by adding rules that specify the differences. This approach is fundamentally different from
prior ACL compression algorithms and is shown to be very effective. We implemented
Diplomat and conducted side-by-side comparison with the prior Firewall Compressor,
TCAM Razor, and ACL Compressor algorithms on real life classifiers. Our experimental
results show that Diplomat outperforms all of them on most of our real-life classifiers, often
by a considerable margin, particularly as classifier size and complexity increases. In
particular, on our largest ACLs, Diplomat has an average improvement ratio of 34.9% over
Firewall Compressor on range-ACLs, of 14.1% over TCAM Razor on prefix-ACLs, and
8.9% over ACL Compressor on mixed-ACLs.

#13/ 19, 1st Floor, Municipal Colony, Kangayanellore Road, Gandhi Nagar, Vellore 6.
Off: 0416-2247353 / 6066663 Mo: +91 9500218218
Website: www.shakastech.com, Email - id: shakastech@gmail.com,
info@shakastech.com