Presentation is loading. Please wait.

Presentation is loading. Please wait.

A Difference Resolution Approach to Compressing Access Control Lists James Daly, Alex Liu, Eric Torng Michigan State University INFOCOM 2013.

Similar presentations


Presentation on theme: "A Difference Resolution Approach to Compressing Access Control Lists James Daly, Alex Liu, Eric Torng Michigan State University INFOCOM 2013."— Presentation transcript:

1 A Difference Resolution Approach to Compressing Access Control Lists James Daly, Alex Liu, Eric Torng Michigan State University INFOCOM 2013

2 Motivation Classifiers used for many applications Packet Forwarding Firewalls Quality of Service Classifiers are growing New threats New services 2

3 Motivation Classifier compression is an important problem Device imposed rule limits NetScreen-100 allows only 733 rules Simplifies rule management DIFANE [Yu et al. SIGCOMM 2010] 3

4 Background F1F2Color 13White White 1-35White Black 4 F1F2Color 23Black 1-33White Black White Packet: [2, 4]

5 Classifier Definition Classifier : list of rules Tuple of d intervals over finite, discrete fields Decision (accept, deny, physical port number, etc.) Only first matching rule applies Classifiers equivalent if they give the same result for all inputs 5 F1F2Color 13White White 1-35White Black F1F2Color 23Black 1-33White Black White

6 Problem Definition Problem Input: classifier Output: smallest equivalent classifier NP-Hard 66 F1F2Color 13White White 1-35White Black F1F2Color 23Black 1-33White Black White

7 Prior Work Redundancy Removal [eg. Liu and Gouda. DBSec 2005] Iterated Strip Rule [Applegate et al. SODA 2007] Only two dimensions Approximation guarantee: O(min(n 1/3, Opt 1/2 )) Firewall Compressor [Liu et al. INFOCOM 2008] Optimal weighted 1-D case Works on higher dimensions 7

8 Motivating Example 8

9 Dimension Reduction 9

10 FC: Fully Solve Each Row 10 XYColor 22-3Green 25-6Red 24-8White 21-9Black 45Red 46-7Blue 43-8White 41-9Black Red White Black XYColor 22-3Green 25-6Red 24-8White 21-9Black 45Red 46-7Blue 43-8White 41-9Black XYColor 22-3Green 25-6Red 24-8White 21-9Black

11 Diplomat: Identify and Resolve Differences 11 XYColor 2-32Green

12 Diplomat: Identify and Resolve Differences 12 XYColor 2-32Green

13 Diplomat: Identify and Resolve Differences 13 XYColor 2-32Green XYColor 2-32Green 6-74Blue

14 Diplomat: Identify and Resolve Differences 14 XYColor 2-32Green 6-74Blue XYColor 2-32Green 6-74Blue Red White Black

15 Higher Dimensions 15

16 Diplomat Three parts Base solver for the last row Firewall Compressor for 1D case Diplomat otherwise Resolver Given two rows identify and resolve differences Merge rows together into one Scheduler Find best order to resolve rows 16

17 F1F2Color 11-5White 25-9White F1F2Color White 16Black 18 Different Resolvers 17 F1F2Color 11-5White 25-9White 1-22Black 1-24Black 1-26Black 1-28Black White F1F2Color 11-5White 16Black Black 1-24Black White

18 Scheduling 18 Multi-row resolver: greedy schedule Single-row resolver: dynamic programming schedule

19 Dynamic Schedule :01:1 2:2 1:1 2:4 3:1 1:2 2:3 3:2 4:3 22:02:2 3:1 2:3 3:2 4:3 33:03:1 4:2 44:0 19 Remaining Row Source Row Upper Bound Lower Bound

20 Results Comparison of Firewall Compressor and Diplomat on 40 real-life classifiers Divided into sets based on size Diplomat requires 30% fewer rules on largest sets 2-D bounds: O(min(n 1/3, Opt 1/2 )) SetFirewall Compressor Diplomat Small67.4%67.2% Medium50.8%45.7% Large44.5%30.2% All56.1%50.6% 20 Mean Compression Ratio

21 Conclusion Diplomat offers significant improvements over Firewall Compressor because it focuses on the differences between rows Results are most pronounced on larger classifiers Can guarantee approximation bound for 2-D classifiers 21

22 Questions? 22


Download ppt "A Difference Resolution Approach to Compressing Access Control Lists James Daly, Alex Liu, Eric Torng Michigan State University INFOCOM 2013."

Similar presentations


Ads by Google