Issue No.12 - December (2011 vol.22)
E. Torng , Dept. of Comput. Sci. & Eng., Michigan State Univ., East Lansing, MI, USA
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/TPDS.2011.114
An access control list (ACL) provides security for a private network by controlling the flow of incoming and outgoing packets. Specifically, a network policy is created in the form of a sequence of (possibly conflicting) rules. Each packet is compared against this ACL, and the first rule that the packet matches defines the decision for that packet. The size of ACLs has been increasing rapidly due to the explosive growth of Internet-based applications and malicious attacks. This increase in size degrades network performance and increases management complexity. In this paper, we propose ACL Compressor, a framework that can significantly reduce the number of rules in an access control list while maintaining the same semantics. We make three major contributions. First, we propose an optimal solution using dynamic programming techniques for compressing one-dimensional range-based access control lists. Second, we present a systematic approach for compressing multidimensional access control lists. Last, we conducted extensive experiments to evaluate ACL Compressor. In terms of effectiveness, ACL Compressor achieves an average compression ratio of 50.22 percent on real-life rule sets. In terms of efficiency, ACL runs in seconds, even for large ACLs with thousands of rules.
telecommunication security, authorisation, dynamic programming, Internet, packet classification, network access control lists, ACL compressor, network policy, Internet, malicious attacks, management complexity, dynamic programming, 1D range-based access control lists, multidimensional access control lists, Access control, Packet switching, Dynamic programming, IP networks, Heuristic algorithms, Firewalls, algorithm., Access control list, packet classification, firewall
E. Torng, "Compressing Network Access Control Lists", IEEE Transactions on Parallel & Distributed Systems, vol.22, no. 12, pp. 1969-1977, December 2011, doi:10.1109/TPDS.2011.114