Efficient Management of Groups in TCAM-Based Network Security System

To allow or protect the traffic in any network security system like firewalls and Intrusion Prevention System (IPS), a packet classification scheme is used along with the application of TCAM-based flow identification [1]. But these applications share a common demand, which is the ability to process, maintain, and correlate huge amount of events. In these applications, the rate of the events is usually much higher than applications in other areas. Furthermore, the ability to quickly search for some specific entry (e.g., scan attempts from the same source IP address) inside any group in TCAM is a key challenge in most cases. The TCAM, however, matches the first rule among multiple matched rules, so the ordering of TCAM entries is strictly kept while rules are added or deleted in groups. Partial ordering though have made some major improvements by decreasing sequential movements [1], but the problem still exists with efficient storing of entries into specific groups. In this paper, we have shown how this searching or insertion of entries into the TCAM groups can be improved by introducing the Ternary Tree data structure and lead to the wellorganized storing of entries [2].