Complete redundancy removal for packet classifiers in TCAMs

IEEE Transactions on Parallel and Distributed Systems

Volumn 21, Issue 4, 2010, Pages 424-437

  Liu, Alex X ^a   Gouda, Mohamed G ^b  

^a Michigan State University   (United States)

^b University of Texas at Austin   (United States)

Author keywords

Packet classification; Packet Classification; Packet switching networks; Redundant Rules; Redundant rules; Routers; Ternary Content Addressable Memory (TCAM)

Indexed keywords

CLASSIFICATION RULES; CONSTANT TIME; DE FACTO STANDARD; EQUIVALENT TRANSFORMATIONS; FIREWALL PACKETS; HIGH-SPEED; LIMITED CAPACITY; NETWORKING SERVICES; NUMBER OF SERVICES; PACKET CLASSIFICATION; PACKET FILTERING; POWER CONSUMPTION; REDUNDANCY REMOVAL; REDUNDANT RULES; SUFFICIENT CONDITIONS; TERNARY CONTENT ADDRESSABLE MEMORIES;

ASSOCIATIVE STORAGE; EXPERIMENTS; INTERNET; LOGIC GATES; PACKET NETWORKS; QUALITY ASSURANCE; REDUNDANCY; SECURITY OF DATA; SWITCHING NETWORKS; TABLE LOOKUP; TELECOMMUNICATION INDUSTRY;

CLASSIFIERS;

EID: 77649275003     PISSN: 10459219     EISSN: None     Source Type: Journal    
DOI: 10.1109/TPDS.2008.216     Document Type: Article

References (42)

1. Cypress Semiconductor Corp., Content Addressable Memory, http://www.cypress.com/, 2008.
2. A Guide to Search Engines and Networking Memory, http://www.linleygroup.com/pdf/NMv4.pdf, 2008.
3. Integrated Device Technology, Inc., Content Addressable Memory, http://www.idt.com/, 2008.
4. Netlogic Microsystems, Content Addressable Memory, http://www.netlogicmicro.com/, 2008.
5. D.A. Applegate, G. Calinescu, D.S. Johnson, H. Karloff, K. Ligett, and J. Wang, "Compressing Rectilinear Pictures and Minimizing Access Control Lists," Proc. 18th Ann. ACM-SIAM Symp. Discrete Algorithms (SODA '07), Jan. 2007.
6. A. Bremler-Barr and D. Hendler, "Space-Efficient TCAM-Based Classification Using Gray Coding," Proc. IEEE INFOCOM '07, May 2007.
7. H. Che, Z. Wang, K. Zheng, and B. Liu, "DRES: Dynamic Range Encoding Scheme for TCAM Coprocessors," IEEE Trans. Computers, vol. 57, no. 7, pp. 902-915, 2008.
8. Q. Dong, S. Banerjee, J. Wang, D. Agrawal, and A. Shukla, "Packet Classifiers in Ternary CAMs Can Be Smaller," Proc. ACM SIGMETRICS '06, pp. 311-322, 2006.
9. R. Draves, C. King, S. Venkatachary, and B. Zill, "Constructing Optimal IP Routing Tables," Proc. IEEE INFOCOM '99, pp. 88-97, 1999.
10. M. Frantzen, F. Kerschbaum, E. Schultz, and S. Fahmy, "A Framework for Understanding Vulnerabilities in Firewalls Using a Dataflow Model of Firewall Internals," Computers and Security, vol. 20, no. 3, pp. 263-270, 2001.
11. M. Gouda, A.X. Liu, and M. Jafry, "Verification of Distributed Firewalls," Proc. IEEE Global Comm. Conf. (GLOBECOM), 2008.
12. M.G. Gouda and A.X. Liu, "Firewall Design: Consistency, Completeness and Compactness," Proc. 24th IEEE Int'l Conf. Distributed Computing Systems (ICDCS '04), pp. 320-327, Mar. 2004.
13. M.G. Gouda and A.X. Liu, "A Model of Stateful Firewalls and its Properties," Proc. IEEE Int'l Conf. Dependable Systems and Networks (DSN '05), pp. 320-327, June 2005.
14. M.G. Gouda and A.X. Liu, "Structured Firewall Design," Computer Networks J., vol. 51, no. 4, pp. 1106-1120, Mar. 2007.
15. P. Gupta, "Algorithms for Routing Lookups and Packet Classification," PhD thesis, Stanford Univ., 2000.
16. P. Gupta and N. McKeown, "Packet Classification on Multiple Fields," Proc. ACM SIGCOMM '99, pp. 147-160, 1999.
17. P. Gupta and N. McKeown, "Packet Classification Using Hierarchical Intelligent Cuttings," Proc. Seventh Symp. High-Performance Interconnects (Hot Interconnects '99), Aug. 1999.
18. P. Gupta and N. McKeown, "Algorithms for Packet Classification, " IEEE Network, vol. 15, no. 2, pp. 24-32, 2001.
19. J. Hwang, T. Xie, F. Chen, and A.X. Liu, "Systematic Structural Testing of Firewall Policies," Proc. 27th IEEE Int'l Symp. Reliable Distributed Systems (SRDS), 2008.
20. Java, http://java.sun.com/, Sept. 2004.
21. S. Kamara, S. Fahmy, E. Schultz, F. Kerschbaum, and M. Frantzen, "Analysis of Vulnerabilities in Internet Firewalls," Computers and Security, vol. 22, no. 3, pp. 214-232, 2003.
22. K. Lakshminarayanan, A. Rangarajan, and S. Venkatachary, "Algorithms for Advanced Packet Classification with Ternary CAMs," Proc. ACM SIGCOMM '05, pp. 193-204, Aug. 2005.
23. A.X. Liu, "Change-Impact Analysis of Firewall Policies," Proc. 12th European Symp. Research Computer Security (ESORICS '07), pp. 155-170, Sept. 2007.
24. A.X. Liu, "Firewall Policy Verification and Troubleshooting," Proc. IEEE Int'l Conf. Comm. (ICC '08), May 2008.
25. A.X. Liu and M.G. Gouda, "Diverse Firewall Design," Proc. Int'l Conf. Dependable Systems and Networks (DSN '04), pp. 595-604, June 2004.
26. A.X. Liu and M.G. Gouda, "Complete Redundancy Detection in Firewalls," Proc. 19th Ann. IFIP Conf. Data and Applications Security, pp. 196-209, Aug. 2005.
27. A.X. Liu and M.G. Gouda, "Diverse Firewall Design," IEEE Trans. Parallel and Distributed Systems, vol. 19, no. 8, 2008.
28. A.X. Liu, M.G. Gouda, H.H. Ma, and A.H. Ngu, "Firewall Queries," Proc. Eighth Int'l Conf. Principles of Distributed Systems (OPODIS '04), T. Higashino, ed., pp. 124-139, Dec. 2004.
29. A.X. Liu, C.R. Meiners, and Y. Zhou, "All-Match Based Complete Redundancy Removal for Packet Classifiers in TCAMs," Proc. IEEE INFOCOM '08, Apr. 2008.
30. A.X. Liu, E. Torng, and C. Meiners, "Firewall Compressor: An Algorithm for Minimizing Firewall Policies," Proc. IEEE INFOCOM '08, Apr. 2008.
31. H. Liu, "Efficient Mapping of Range Classifier into Ternary-CAM," Proc. 14th Symp. High-Performance Interconnects (Hot Interconnects '02), pp. 95-100, 2002.
32. C.R. Meiners, A.X. Liu, and E. Torng, "TCAM Razor: A Systematic Approach towards Minimizing Packet Classifiers in TCAMs," Proc. 15th IEEE Conf. Network Protocols (ICNP '07), pp. 266-275, Oct. 2007.
33. M.H. Overmars and A.F. van der Stappen, "Range Searching and Point Location among Fat Objects," J. Algorithms, vol. 21, no. 3, pp. 629-656.
34. D. Pao, P. Zhou, B. Liu, and X. Zhang, "Enhanced Prefix Inclusion Coding Filter-Encoding Algorithm for Packet Classification with Ternary Content Addressable Memory," IET Computers & Digital Techniques, vol. 1, pp. 572-580, Apr. 2007.
35. E. Spitznagel, D. Taylor, and J. Turner, "Packet Classification Using Extended TCAMs," Proc. 11th IEEE Int'l Conf. Network Protocols (ICNP '03), pp. 120-131, Nov. 2003.
36. S. Suri, T. Sandholm, and P. Warkhede, "Compressing Two-Dimensional Routing Tables," Algorithmica, vol. 35, pp. 287-300, 2003.
37. D.E. Taylor, "Survey & Taxonomy of Packet Classification Techniques," ACM Computing Surveys, vol. 37, no. 3, pp. 238-275, 2005.
38. J. van Lunteren and T. Engbersen, "Fast and Scalable Packet Classification," IEEE J. Selected Areas in Comm., vol. 21, no. 4, pp. 560-571, 2003.
39. T.Y.C. Woo, "A Modular Approach to Packet Classification: Algorithms and Results," Proc. IEEE INFOCOM '00, pp. 1213-1222, 2000.
40. F. Yu, T.V. Lakshman, M.A. Motoyama, and R.H. Katz, "SSA: A Power and Memory Efficient Scheme to Multi-Match Packet Classification," Proc. Symp. Architectures for Networking and Comm. Systems (ANCS '05), pp. 105-113, Oct. 2005.
41. K. Zheng, H. Che, Z. Wang, B. Liu, and X. Zhang, "DPPC-RE: TCAM-Based Distributed Parallel Packet Classification with Range Encoding," IEEE Trans. Computers, vol. 55, no. 8, pp. 947-961, 2006.
42. K. Zheng, C. Hu, H. Lu, and B. Liu, "A TCAM-Based Distributed Parallel IP Lookup Scheme and Performance Analysis," IEEE/ACM Trans. Networking, vol. 14, no. 4, pp. 863-875, 2006.