Efficient evaluation of rules

• US 20020069200A1
• Filed: 06/08/2001
• Published: 06/06/2002
• Est. Priority Date: 01/07/2000
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Securify, Inc. (McAfee, LLC)
• Inventors: Sherlock, Kieran G., Cooper, Geoffrey, Shaw, Bob, Valente, Luis
• Granted Patent: US 7,143,439 B2
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers

Abstract

A method and apparatus uses a proprietary algorithm for organizing network security policy rules in a way that minimizes the number of rules considered when determining the set of rules applicable to a given protocol event.

Claims

1. A method for a policy engine to organize policy rules in a way to effect an efficient evaluation of a protocol event, said protocol event having an agent descriptor, a protocol name, and a protocol action, said method comprising:

providing a first associative array having a first key and a first value, wherein said first key corresponds to said agent descriptor and said first value is a reference to a second associative array having a second key and a second value;

providing said second associative array, wherein said second key corresponds to said protocol name and said second value is a reference to a third associative array having a third key and a third value;

providing said third associative array, wherein said third key corresponds to said protocol action and said third value is a reference to a fourth associative array having a fourth key and a fourth value; and

providing said fourth associative array, wherein said fourth key corresponds to any of said rules and said fourth value is a rank number associated with said any rule.

2. The method of claim 1, further comprising ordering said rules in decreasing order of rank number.

3. The method of claim 2, further comprising incorporating constraints into said ordering.

4. The method of claim 2, further comprising ordering in lexical order rules having a same rank number.

5. The method of claim 1, wherein said any rule is referenced by a plurality of said fourth associative arrays.

6. The method of claim 1, wherein said rank number of said any rule is a relative value dependent on other rank numbers in said fourth associative array.

7. An apparatus for a policy engine to organize policy rules in a way to effect an efficient evaluation of a protocol event, said protocol event having an agent descriptor, a protocol name, and a protocol action, said apparatus comprising:

means for providing a first associative array having a first key and a first value, wherein said first key corresponds to said agent descriptor and said first value is a reference to a second associative array having a second key and a second value;

means for providing said second associative array, wherein said second key corresponds to said protocol name and said second value is a reference to a third associative array having a third key and a third value;

means for providing said third associative array, wherein said third key corresponds to said protocol action and said third value is a reference to a fourth associative array having a fourth key and a fourth value; and

means for providing said fourth associative array, wherein said fourth key corresponds to any of said rules and said fourth value is a rank number associated with said any rule.

8. The apparatus of claim 7, further comprising means for ordering said rules in decreasing order of rank number.

9. The apparatus of claim 8, further comprising means for incorporating constraints into said ordering.

10. The apparatus of claim 8, further comprising means for ordering in lexical order rules having a same rank number.

11. The apparatus of claim 7, wherein said any rule is referenced by a plurality of said fourth associative arrays.

12. The apparatus of claim 7, wherein said rank number of said any rule is a relative value dependent on other rank numbers in said fourth associative array.