A Scalable and Dynamic ACL System for In-Network Defense

In-network/in-switch Access Control List (ACL) is an essential security component of modern networks. In high-speed networks, ACL rules are often placed in a switch's Ternary Content-Addressable Memory (TCAM) for timely ACL match-action and management (e.g., insertion and deletion). However, TCAM-based ACL systems are encountering an scalability issue owing to increasing demand on AI-powered autonomous defenses that detect and block attacks online, which inevitably derives finer-grained ACL rules. Existing solutions minimize the TCAM usage by partially offloading ACL matching into larger Static Random-Access Memory (SRAM) or customized hardware. Nevertheless, current SRAM-based solutions induce high management costs, especially a high rule-deployment latency, which delays time-sensitive defense actions. Also, the customized hardware approaches have its own scalability issue. To support autonomous defenses at a scale, in this paper, we propose an in-switch ACL system called PortCatcher, which breaks the trade-off between scalability and rule management latency. Systemwise, we detach layer-4 port matching from TCAM for improving its memory efficiency. Algorithm-wise, we introduce a novel port (range) rule representation concept, called linear range map (LRM), which enables port (range) matching in SRAM-based hash tables. LRM guarantees not only fast and scalable port matching but also low-latency ACL management for timely defenses. With static ACL datasets, we show that PortCatcher saves 74%∼90% TCAM space compared to state-of-the-art approaches by adding a small overhead to SRAM (0.49 SRAM entry per ACL rule). Also, we deploy Port-Catcher on a programmable switch to demonstrate that PortCatcher can serve the 5-tuple rule matching at a line rate, where port rules are completely matched in SRAM. With an attack traffic-driven dynamic ACL dataset, our use case study shows that PortCatcher's rule deployment is 168x faster than the state-of-the-art approach, allowing our in-network defense system to block 92.09% (55.45% more) malicious packets and all flows in an attack trace.