Embedded filtering policy manager using system-on-chip

• US 20040059943A1
• Filed: 09/23/2002
• Published: 03/25/2004
• Est. Priority Date: 09/23/2002
• Status: Abandoned Application

• Current Assignee: Alcatel Canada Inc. (Nokia Corporation)
• Original Assignee: Alcatel Canada Inc. (Nokia Corporation)
• Inventors: Marquet, Bertrand, DʼSouza, Scott
• Application Number:
  US10/251,782
• Publication Number:
  US 20040059943A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/12 Protocol engines

Abstract

A packet filter for filtering data packets in a communications network is described. The packet filter has input and output ports for receiving and transmitting respective data packets. A data filter selectively passes packets from the input port to the output port in accordance with filtering policies. A policy manager determines filtering policies and controls operation of the data filter. The policy manager is independent of its implementation and not related to any particular operating system. This independence allows for a generic path of managing policies across devices implementing a system and for more flexibility in the implementation of packet filters. Flexibility may be enhanced by implementing the policy manager in system-on-chip technology.

Claims

1. A packet filter for filtering data packets in a communications network, comprising:

an input port for receiving data packets;

an output port for transmitting filtered data packets;

a data filter coupled between the input and output ports, and being operable to selectively pass data packets from the input port to the output port in accordance with packet filtering policies; and

a policy manager coupled to the data filter and input port, and having an interface adapted for exchanging policy information with other policy managers and having means for determining the packet filtering policies, the policy manager being operable to control operation of the data filter by effecting changes to the packet filtering policies.

2. The packet filter as defined in claim 1 wherein the means for determining the packet filtering policies are filtering algorithms and associate parameters.

3. The packet filter as defined in claim 2 wherein the policy manager is further operable to effect a change to a packet filtering policy in response to a particular data packet entering the data filter.

4. The packet filter as defined in claim 3 wherein the policy manager is further operable to send a request for a policy change to other policy managers in the communications network, thereby effecting a global policy change in the communications network.

5. The packet filter as defined in claim 4 wherein the policy manager is in the form of a Java virtual machine within a hardware Java processor.

6. The packet filter as defined in claim 1 wherein said policy manager is implemented in a universal programming language.

7. The packet filter as defined in claim 6 wherein said data filter and said policy manager are fabricated using a field programmable gate array (FPGA).

8. The packet filter as defined in claim 6 wherein said data filter and said policy manager are fabricated using ASIC technology.

9. The packet filter as defined in claim 6 wherein said data filter and said policy manager are fabricated in a system-on-chip format.