Palmtrie: A ternary key matching algorithm for IP packet filtering rules

Abstract

Network security has become crucial to our society and industry. A firewall is an essential function in network operations for security enhancement. Network access control lists (ACLs) have been used to describe multi-layer security rules to determine whether a packet is passed or dropped by the firewall. An entry in ACLs contains so-called don't care bits, and consequently, ACL matching is generalized as a ternary matching problem. As ternary matching typically relies on dedicated hardware, high-performance ternary matching with commodity CPUs is challenging. We propose a practical algorithm for network ACL matching trie, named Palmtrie, that allows the multi-bit stride extension to achieve better performance. We evaluate the Palmtrie using synthetic ACLs that emulate an existing campus network and Internet backbone policies. The evaluation results demonstrate that the Palmtrie outperforms the existing ACL matching algorithms on extensive ACLs. For example, the lookup performance of the optimized Palmtrie achieves 4.76 times faster than the algorithm implemented in the widely used library (DPDK) for the scanning attack traffic on an ACL with one million entries. We also prove that the Palmtrie solves the problem with the build time of data structures in the existing algorithms.