ACCESS LIST KEY COMPRESSION

• US 20080165783A1
• Filed: 03/19/2008
• Published: 07/10/2008
• Est. Priority Date: 12/04/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Desanti, Claudio
• Granted Patent: US 8,782,739 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/325 in the network layer [OSI layer 3], e.g. X.25 H04L69/16 takes precedence

Abstract

Methods and apparatus for implementing an access list key for accessing information associated with a packet from an access list are disclosed. The packet includes an IP source address field and an IP destination address field, the IP source address field including an IP source address and the IP destination address field including an IP destination address, the IP source address and the IP destination address each having a number of bits (e.g., 128 bits in the case of IPv6). An IP source address is obtained from the IP source address field of the packet and an IP destination address is obtained from the IP destination address field of the packet. A modified IP source address is generated from the obtained IP source address such that the number of bits in the modified IP source address is less than the number of bits in the obtained IP source address. In addition, a modified IP destination address is generated from the obtained IP destination address such that the number of bits in the modified IP destination address is less than the number of bits in the obtained IP destination address. The access list key is then composed from the modified IP source address and the modified IP destination address.

Claims

1. An apparatus for composing an access list key, comprising:

a processor; and

a memory, at least one of the processor or the memory being adapted for;

ascertaining a protocol of a packet, the packet including an IP source address and an IP destination address;

when the protocol is one of a first set of protocols, composing the access list key and handling the packet in hardware; and

when the protocol is one of a second set of protocols, handling the packet in software.

2. The apparatus as recited in claim 1, wherein composing the access list key comprises:

generating a modified IP source address including selected bits from the IP source address of the packet; and

generating a modified IP destination address including selected bits from the IP destination address of the packet, wherein the access list key includes the modified IP source address and the modified IP destination address.

3. The apparatus as recited in claim 2, wherein the IP source address and IP destination address are IPv6 addresses.

4. The apparatus as recited in claim 1, wherein the first set of protocols comprises TCP, UDP, SCTP, ESP, and ICMP.

5. The apparatus as recited in claim 2, wherein generating a modified IP source address comprises:

removing one or more bits from the obtained IP source address.

6. The apparatus as recited in claim 2, wherein generating a modified IP destination address comprises:

removing one or more bits from the obtained IP destination address.

7. The apparatus as recited in claim 1, at least one of the processor or the memory being further adapted for:

classifying the packet prior to composing the access list key, thereby enabling the access list key to be composed according to an access list key format.

8. The apparatus as recited in claim 7, wherein classifying the packet comprises:

obtaining contents of a Next_Header field of the packet to determine the protocol of the packet, wherein the protocol determines the access list key format.

9. The apparatus as recited in claim 7, wherein classifying the packet comprises:

determining whether the packet is compatible with one of a first set of protocols including TCP, UDP, and SCTP, a second set of protocols including ICMP, or a third set of protocols including ESP;

wherein composing the access list key is performed according to an access list key format, the access list key format being a first format when the packet is compatible with one of the first set of protocols or the third set of protocols, a second format when the packet is compatible with one of the second set of protocols, or a third format when the packet is not classified as being compatible with one of the first, second, or third set of protocols.

10. The apparatus as recited in claim 1, at least one of the processor or the memory being further adapted for:

classifying the packet as being compatible with one of a first set of one or more protocols or a second set of one or more protocols;

handling the packet in hardware when the packet is classified as being compatible with one of the first set of one or more protocols; and

handling the packet in software when the packet is classified as being compatible with one of the second set of one or more protocols.

11. The apparatus as recited in claim 10, wherein the packet is classified as being compatible with one of the second set of protocols when the packet is not classified as being compatible with one of the first set of protocols.

12. The apparatus as recited in claim 2, wherein the modified IP destination address comprises a zone_ID.

13. The apparatus as recited in claim 12, wherein the zone_ID replaces a multicast prefix of the obtained IP destination address when the IP destination address is a multicast address.

14. The apparatus as recited in claim 12, wherein the zone_ID replaces a local use prefix of the obtained IP destination address when the IP destination address is a local use unicast address.

15. The apparatus as recited in claim 12, wherein the zone_ID identifies a link local zone or a site local zone.

16. The apparatus as recited in claim 2, wherein the modified IP destination address includes a multicast-unicast bit that indicates whether the modified IP destination address is multicast or unicast.

17. The apparatus as recited in claim 2, wherein the modified IP source address and modified IP destination address each include two bits used to indicate whether the corresponding address is a link-local, site local, or global scoped address.

18. The apparatus as recited in claim 2, wherein the modified IP source address comprises a zone_ID.

19. The apparatus as recited in claim 18, wherein the zone_ID replaces a local use prefix of the obtained IP source address when the IP source address is a local use unicast address.

20. The apparatus as recited in claim 18, wherein the zone_ID identifies a link local zone or a site local zone.

21. The apparatus as recited in claim 2, wherein generating a modified IP destination address comprises removing the middle 16 bits of the Interface_ID portion of the obtained IP destination address when the IP destination address is a unicast address.

22. The apparatus as recited in claim 2, wherein generating a modified IP source address comprises removing the middle 16 bits of the Interface_ID portion of the obtained IP source address when the IP source address is a unicast address.

23. The apparatus as recited in claim 2, wherein generating a modified IP destination address comprises removing the first 16 bits or another group of 16 bits of the obtained IP destination address and generating a modified IP source address comprises removing the first 16 bits or another group of 16 bits of the obtained IP source address.

24. The apparatus as recited in claim 23, wherein the obtained IP destination address is an IPv6 address that is IPv4 compatible or mapped and wherein the obtained IP source address is an IPv6 address that is IPv4 compatible or mapped.

25. The apparatus as recited in claim 23, wherein the access list key includes a source port number and a destination port number.

26. The apparatus as recited in claim 23, wherein the modified IP destination address includes a destination port number and the modified IP source address includes a source port number.

27. The apparatus as recited in claim 23, wherein the access list key includes a SPI.

28. The apparatus as recited in claim 23, wherein the modified IP destination address includes a first half of a SPI and the modified IP source address comprises a second half of the SPI, the first half and the second half of the SPI together being a SPI used in the ESP protocol.

29. The apparatus as recited in claim 2, wherein generating a modified IP destination address comprises removing the middle 16 bits of the Interface_ID portion of the obtained IP destination address when the IP destination address is a unicast address and wherein generating a modified IP source address comprises removing the middle 16 bits of the Interface_ID portion of the obtained IP source address when the IP source address is a unicast address.

30. The apparatus as recited in claim 29, wherein the access list key includes a source port number and a destination port number.

31. The apparatus as recited in claim 29, wherein the modified IP destination address includes a destination port number and the modified IP source address includes a source port number.

32. The apparatus as recited in claim 29, wherein the access list key includes a SPI.

33. The apparatus as recited in claim 29, wherein the modified IP destination address includes a first half of a SPI and the modified IP source address comprises a second half of the SPI, the first half and the second half of the SPI together being a SPI used in the ESP protocol.

34. The apparatus as recited in claim 1, wherein the IP source address and the IP destination address are IPv6 addresses.

35. The apparatus as recited in claim 1, wherein the access list key is a policy access list key for accessing a policy access list.

36. The apparatus as recited in claim 1, wherein the access list key is a QoS access list key for accessing a quality of service access list.

37. The apparatus as recited in claim 1, the access list key including a key bit indicating whether the access list key is a policy access list key or a QoS access list key.

38. The apparatus as recited in claim 1, at least one of the processor or the memory being further adapted for:

accessing an access list using the access list key.

39. The apparatus as recited in claim 1, at least one of the processor or the memory being further adapted for:

accessing a TCAM using the access list key.

40. The apparatus as recited in claim 1, wherein the IP source address and the IP destination address are each 128 bits long.

41. The apparatus as recited in claim 1, wherein the packet is an IPv6 packet, the IP source address is an IPv6 address and the IP destination address is an IPv6 address.

42. A computer-readable medium for storing thereon computer-readable instructions for composing an access list key, comprising:

instructions for ascertaining a protocol of a packet, the packet including an IP source address and an IP destination address;

instructions for composing the access list key and handling the packet in hardware when the protocol is one of a first set of protocols; and

instructions for handling the packet in software when the protocol is one of a second set of protocols.

43. A method of composing an access list key, comprising:

ascertaining a protocol of a packet, the packet including an IP source address and an IP destination address;

when the protocol is one of a first set of protocols, composing the access list key and handling the packet in hardware; and

when the protocol is one of a second set of protocols, handling the packet in software.

44. An apparatus for composing an access list key, comprising:

means for ascertaining a protocol of a packet, the packet including an IP source address and an IP destination address;

means for composing the access list key and handling the packet in hardware when the protocol is one of a first set of protocols; and

means for handling the packet in software when the protocol is one of a second set of protocols.