Optimized data-over-cable service interface specifications filter processing for batches of data packets using a single access control list lookup

Patent metadata

Field	Value
Publication number	US-12432208-B2
Application number	US-202217841386-A
Country	US
Kind code	B2
Filing date	Jun 15, 2022
Priority date	Nov 3, 2021
Publication date	Sep 30, 2025
Grant date	Sep 30, 2025

Abstract

The present disclosure provides mechanisms to optimize filter processing. Conventional filter processing techniques involve dividing a batch of received data packets into multiple Access Control Lists (ACLs) per filter group, and thus, cannot leverage of optimal ACL processing of large packet batches using the latest processor instruction sets such as 512 bit wide instructions. The filter processing techniques discussed in the present disclosure, some or all rules for a batch of packets are included in a single ACL look-up by including a filter group identifier (ID) in each rule, and also adding the filter group ID to a field of the packet undergoing the ACL look-up. This avoids false matches while also employing a single ACL look-up for an entire batch of packets, regardless of batch-size. The filter processing techniques can be applied to DOCSIS packet processing pipelines and/or other filtering mechanisms.

First claim

The invention claimed is:

1. An apparatus for a filter processing stage of a packet processing pipeline, the apparatus comprising:
interface circuitry to receive a batch of packets to be processed by the packet processing pipeline, wherein each packet in the batch of packets includes a filter group identifier (GrpId), and at least one packet in the batch of packets has a first GrpId different than a second GrpId of at least one other packet in the batch of packets; and
processor circuitry connected to the interface circuitry, the processor circuitry is to operate the filter processing stage of the packet processing pipeline to perform a single access control list (ACL) lookup operation on a single ACL, wherein the single ACL includes a set of filter rules, and each filter rule of the set of filter rules includes a GrpId of a filter group to which it belongs.

2. The apparatus of claim 1 , wherein the processor circuitry is to operate the filter processing stage to:
utilize a most optimal code path of an ACL library for performing the filter processing.

3. The apparatus of claim 1 , wherein, to perform the single ACL lookup operation, the processor circuitry is to operate the filter processing stage to:
send an entirety of the batch of packets to an ACL library in a single function call.

4. The apparatus of claim 1 , wherein each packet is a Internet Protocol (IP) version 4 (IPv4) packet, and the GrpId is included in an identification field of a header of each packet.

5. The apparatus of claim 1 , wherein each packet is a IP version 6 (Ipv6) packet, and the GrpId is included in an identification field of a header of each packet or in a flow label field of the header of each packet.

6. The apparatus of claim 1 , wherein the GrpId of each packet is based on an equipment type of a destination address included in each packet.

7. The apparatus of claim 6 , wherein the equipment type is an equipment type of customer premises equipment (CPE), and the GrpId is based on a filter group assigned to a cable modem (CM) associated with the CPE.

8. The apparatus of claim 1 , wherein the processor circuitry is to operate the filter processing stage to:
determine a CM and CPE type of each received packet; and
determining a filter group to which each packet belongs based on the CPE type and a filter group assigned to the CM;
create an ACL lookup object for each packet, wherein the ACL lookup object includes all tuple fields and the GrpId, and the ACL lookup object defines the set of filter rules and is an input to an ACL batch classification algorithm; and
perform the ACL lookup for all packets in the batch and across all filter groups using the created ACL lookup object.

9. The apparatus of claim 8 , wherein the ACL library is a Data Plane Development Kit (DPDK) ACL library, and the processor circuitry is to operate the filter processing stage to:
perform the ACL lookup using a single call to a DPDK rte_acl_classify( ) application programming interface (API).

10. The apparatus of claim 1 , wherein the processor circuitry is to operate the filter processing stage to:
use a 512-bit instruction set to process the batch when the batch has more than 32 packets;
use a 256-bit instruction set to process the batch when the batch has 16 or more packets and less than 32 packets;
use a Streaming Single Instruction Multiple Data Extensions 8 (sse8) instruction set to process the batch when the batch has between 8 and 16 packets;
use a Streaming Single Instruction Multiple Data Extensions 4 (sse4) instruction set to process the batch when the batch has between 4 and 8 packets; and
use a scalar processor instruction set or a single instruction single data (SISD) processor instruction set to process the batch when the batch has less than 4 packets.

11. The apparatus of claim 10 , wherein the 512-bit instruction set and the 256-bit instruction set are advanced vector extension (AVX)-512 instructions.

12. The apparatus of claim 1 , wherein the packet processing pipeline is a Data Over Cable Service Interface Specification (DOCSIS) Medium Access Control (MAC) packet processing pipeline, and the apparatus is a virtualized cable modem termination system (vCMTS) platform.

13. One or more non-transitory computer-readable media (NTCRM) comprising instructions of a filter stage of a Data Over Cable Service Interface Specification (DOCSIS) packet processing pipeline, wherein execution of the instructions by one or more processors of a compute node is to cause the compute node to:
receive a batch of packets to be filtered, wherein each packet in the batch of packets includes a filter group identifier (GrpId), and the batch of packets includes multiple GrpIds; and
for each packet in the batch of packets,
determine a cable modem (CM) and a customer premises equipment (CPE) type,
determine a filter group to which the packet belongs based on the CPE type and a filter group assigned to the CM, and
create a filter lookup object including the determined filter group; and
perform a single access control list (ACL) lookup operation for all packets in the batch of packets and across all filter groups in a single ACL, wherein the single ACL includes a set of filter rules, and each filter rule of the set of filter rules in the single ACL includes a GrpId of a filter group to which it belongs.

14. The one or more NTCRM of claim 13 , wherein execution of the instructions is to cause the compute node to:
determine the filter group based on a group object indicated by each packet.

15. The one or more NTCRM of claim 14 , wherein execution of the instructions is to cause the compute node to:
perform the ACL lookup using the created filter object.

16. The one or more NTCRM of claim 15 , wherein execution of the instructions is to cause the compute node to:
send an entirety of the batch of packets to an ACL library in a single function call.

17. The one or more NTCRM of claim 16 , wherein the ACL library is a Data Plane Development Kit (DPDK) ACL library, and execution of the instructions is to cause the compute node to:
perform the ACL lookup using a single call to a DPDK rte_acl_classify ( ) application programming interface (API).

18. The one or more NTCRM of claim 13 , wherein execution of the instructions is to cause the compute node to:
use an advanced vector extension (AVX)-512 512-bit instruction set to process the batch when the batch has more than 32 packets;
use an AVX-512 256-bit instruction set to process the batch when the batch has 16 or more packets and less than 32 packets;
use a Streaming Single Instruction Multiple Data Extensions 8 (sse8) instruction set to process the batch when the batch has between 8 and 16 packets;
use a Streaming Single Instruction Multiple Data Extensions 4 (sse4) instruction set to process the batch when the batch has between 4 and 8 packets; and
use a scalar processor instruction set or a single instruction single data (SISD) processor instruction set to process the batch when the batch has less than 4 packets.

19. The one or more NTCRM of claim 17 , wherein the compute node is a virtual cable modem termination system (vCMTS) platform.

20. The one or more NTCRM of claim 19 , wherein the compute node is one or more servers in a data center.

21. The one or more NTCRM of claim 19 , wherein the compute node is one or more edge compute nodes co-located with one or more network access nodes.

Assignees

• Intel Corp

Inventors

• Coyle David
• Ryan Brendan
• Ananyev Konstantin

Classifications

• H04L12/2801 Primary

  Broadband local area networks · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title