Compressing network access control lists

IEEE Transactions on Parallel and Distributed Systems

Volumn 22, Issue 12, 2011, Pages 1969-1977

  Liu, Alex X ^a   Torng, Eric ^a   Meiners, Chad R ^a  

^a Michigan State University   (United States)

Author keywords

Access control list; algorithm; firewall; packet classification

Indexed keywords

ACCESS CONTROL LISTS; DYNAMIC PROGRAMMING TECHNIQUES; EXPLOSIVE GROWTH; FIREWALL; INTERNET-BASED APPLICATIONS; MALICIOUS ATTACK; MANAGEMENT COMPLEXITY; NETWORK ACCESS CONTROL; NETWORK POLICY; OPTIMAL SOLUTIONS; PACKET CLASSIFICATION; PRIVATE NETWORKS; RANGE-BASED; RULE SET;

COMPRESSION RATIO (MACHINERY); COMPRESSORS; DYNAMIC PROGRAMMING; NETWORK MANAGEMENT; NETWORK PERFORMANCE; NETWORK SECURITY; SECURITY SYSTEMS; SEMANTICS;

ACCESS CONTROL;

EID: 80055048663     PISSN: 10459219     EISSN: None     Source Type: Journal    
DOI: 10.1109/TPDS.2011.114     Document Type: Article

References (18)

1. D.A. Applegate, G. Calinescu, D.S. Johnson, H. Karloff, K. Ligett, and J. Wang, "Compressing Rectilinear Pictures and Minimizing Access Control Lists," Proc. ACM-SIAM Symp. Discrete Algorithms (SODA), Jan. 2007.
2. Q. Dong, S. Banerjee, J. Wang, D. Agrawal, and A. Shukla, "Packet Classifiers in Ternary CAMs Can Be Smaller," Proc. ACM Joint Int'l Conf. Measurement and Modeling of Computer Systems (SIGMETRICS), pp. 311-322, 2006. (Pubitemid 44619101)
3. D. Eastlake and P. Jones, "US Secure Hash Algorithm 1 (SHA1)," RFC 3174, 2001.
4. M.G. Gouda and A.X. Liu, "Firewall Design: Consistency, Completeness and Compactness," Proc. IEEE 24th Int'l Conf. Distributed Computing Systems, pp. 320-327, Mar. 2004.
5. M.G. Gouda and A.X. Liu, "Structured Firewall Design," Computer Networks: The Int'l J. Computer and Telecomm. Networking, vol. 51, no. 4, pp. 1106-1120, Mar. 2007. (Pubitemid 44970013)
6. A.X. Liu and M.G. Gouda, "Complete Redundancy Detection in Firewalls," Proc. 19th Ann. IFIP Conf. Data and Applications Security, pp. 196-209, Aug. 2005.
7. A.X. Liu and M.G. Gouda, "Diverse Firewall Design," IEEE Trans. Parallel and Distributed Systems, vol. 19, no. 8, pp. 1237- 1251, Sept. 2008.
8. A.X. Liu and M.G. Gouda, "Complete Redundancy Removal for Packet Classifiers in TCAMs," IEEE Trans. Parallel and Distributed Systems, vol. 21, no. 4, pp. 424-437, Apr. 2010.
9. A.X. Liu, C.R. Meiners, and E. Torng, "TCAM Razor: A Systematic Approach towards Minimizing Packet Classifiers in TCAMs," IEEE Trans. Networking, vol. 18, no. 2, pp. 490-500, Apr. 2010.
10. A.X. Liu, Y. Zhou, and C.R. Meiners, "All-Match Based Complete Redundancy Removal for Packet Classifiers in TCAMs," Proc. IEEE INFOCOM, Apr. 2008.
11. R. McGeer and P. Yalagandula, "Minimizing Rulesets for TCAM Implementation," Proc. IEEE INFOCOM, 2009.
12. C.R. Meiners, A.X. Liu, and E. Torng, "TCAM Razor: A Systematic Approach towards Minimizing Packet Classifiers in TCAMs," Proc. IEEE 15th Int'l Conf. Network Protocol (ICNP), pp. 266-275, Oct. 2007.
13. C.R. Meiners, A.X. Liu, and E. Torng, "Bit Weaving: A Non-Prefix Approach to Compressing Packet Classifiers in TCAMs," Proc. IEEE Int'l Conf. Network Protocol (ICNP), 2009.
14. R. Rivest, "The MD5 Message-Digest Algorithm," RFC 1321, 1992.
15. D. Rovniagin and A. Wool, "The Geometric Efficient Matching Algorithm for Firewalls," technical report, http://www.eng. tau.ac.il/yash/ees2003-6.ps, July 2003.
16. Y.-W. E. Sung, X. Sun, S.G. Rao, G.G. Xie, and D.A. Maltz, "Towards Systematic Design of Enterprise Networks," Proc. ACM CoNEXT Conf., 2008.
17. Y.-W.E. Sung, X. Sun, S.G. Rao, G.G. Xie, and D.A. Maltz, "Towards Systematic Design of Enterprise Networks," IEEE Trans. Networking, vol. 19, no. 3, pp. 695-708, June 2011.
18. M. Yu, J. Rexford, M.J. Freedman, and J. Wang, "Scalable Flow- Based Networking with DIFANE," Proc. ACM SIGCOMM, 2010.