Method and framework for integrating a plurality of network policies

• US 20050010765A1
• Filed: 06/06/2003
• Published: 01/13/2005
• Est. Priority Date: 06/06/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Swander, Brian D., Dixon, William H.
• Granted Patent: US 7,308,711 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system is disclosed for managing and implementing a plurality of network policies in a network device. Each of the plurality of policies are defined by one or more filters. The filters are installed in a policy engine. A layer identifies the network policy to be applied to a packet by sending a request to the policy engine. The policy engine then returns the policy to the requesting layer. The method and system may be used to implement a programmable, host-based, distributed, authenticating firewall that enables security and other policies to be applied at several protocol layers.

Claims

1. A framework for integrating a plurality of filter based policies to be applied to packets of data including at least a firewall policy and a security policy, comprising:

a set of layer processes for identifying at least one parameter associated with a packet;

a policy engine in communication with the set of layer processes; and

a set of filters stored in the policy engine, each filter in the set of filters having filter conditions, an action identifying the firewall policy, and a policy context identifying the security policy.

2. The framework of claim 1, wherein the plurality of filter based policies further include a quality of service policy that identifies communication settings to be applied to packets, the quality of service policy being defined by the policy context in the set of filters.

3. The framework of claim 1, further comprising:

a requesting layer process in the set of layer processes that sends the at least one parameter to the policy engine and the policy engine identifies a matching filter from the set of filters having filter conditions that match the at least one parameter and the policy engine returns the firewall policy and the security policy to the requesting layer.

4. The framework of claim 3, wherein the requesting layer is a keying module layer and the security policy in the matching filter identifies a policy for negotiating a security association according to a key negotiation protocol.

5. The framework of claim 4, wherein the at least one parameter is a plurality of parameters and the plurality of parameters comprise source and destination IP addresses, source and destination ports, and a protocol type.

6. The framework of claim 4 wherein the key negotiation protocol is an IKE protocol.

7. The framework of claim 3, wherein the requesting layer further sends packet context and the policy engine further identifies the matching filter from the packet context.

8. A method for determining a plurality of network policies to be applied to a packet at a layer process, comprising:

identifying, by the layer process, a set of parameters associated with the packet;

sending, by the layer process, a request to identify the network policies to be applied to the packet;

the request including the parameters associated with the packet; and

receiving, at the layer process, a response that includes a first policy value identifying a first network policy and a second policy value identifying a second network policy.

9. The method of claim 8, wherein the layer process is a user layer.

10. The method of claim 8, wherein the layer process is a kernel layer.

11. The method of claim 8, wherein the first network policy is a firewall policy and the first policy value is an action value.

12. The method of claim 11, wherein the action value is one of permit or block.

13. The method of claim 8, wherein the second network policy is a security policy that defines key negotiation protocol parameters.

14. A method for maintaining a plurality of network policies in a network device, comprising:

installing a set of filters into a policy engine, each of the filters comprising;

a set of filter conditions;

a first policy value identifying a first network policy and a second policy value identifying a second network policy.

15. The method of claim 14, wherein the first network policy is a firewall policy and the second network policy is a security policy.

16. The method of claim 15, wherein the security policy is an IPSec policy.

17. The method of claim 15, wherein the first policy value is an action and the second policy value is a policy context.

18. The method of claim 14, further comprising:

identifying, by a policy engine, a matching filter from the set of filters that includes filter conditions matching a packet to which the plurality of network policies is to be applied; and

executing at least the first network policy on the packet.

19. The method of claim 14, wherein the step of installing the set of filters is executed in an operating system user mode.

20. The method of claim 14, wherein the step of installing the set of filters is executed in an operating system kernel mode.

21. The method of claim 14, wherein the plurality of policies include a firewall policy, a security policy, and a quality of service policy.

22. The method of claim 14, wherein the set of filter conditions is dynamically configurable such that filter conditions are added or deleted according to desired policy.

23. A computer-readable medium having stored thereon a data structure defining a filter, comprising:

a first set of data comprising a set of filter conditions defining matching packets;

a second set of data comprising a first network policy; and

a third set of data comprising a second network policy, wherein the first network policy is distinct from the second network policy.

24. The computer-readable medium of claim 23, wherein the set of filter conditions is adapted to included a plurality of filter conditions that are dynamically configurable.

25. The computer-readable medium of claim 23, wherein the set of filter conditions include a data type and corresponding data matching the data type.

26. The computer-readable medium of claim 23, wherein the first network policy is a firewall policy.

27. The computer-readable medium of claim 26, wherein the second network policy is a quality of service policy.

28. The computer-readable medium of claim 26, wherein the second network policy is a security policy.

29. The computer-readable medium of claim 26, wherein the data structure further comprises a filter weight identifying a priority of the filter.

30. A computer-readable medium for executing computer-executable instructions for facilitating a framework for integrating a plurality of filter based policies to be applied to packets of data including at least a firewall policy and a security policy, comprising:

a set of layer processes for identifying at least one parameter associated with a packet;

a policy engine in communication with the set of layer processes; and

a set of filters stored in the policy engine, each filter in the set of filters having filter conditions, an action identifying the firewall policy, and a policy context identifying the security policy.

31. The computer readable medium of claim 30, wherein the plurality of filter based policies further include a quality of service policy that identifies communication settings to be applied to packets, the quality of service policy being defined by the policy context in the set of filters.

32. The computer readable medium of claim 30, further comprising:

a requesting layer process in the set of layer processes that sends the at least one parameter to the policy engine and the policy engine identifies a matching filter from the set of filters having filter conditions that match the at least one parameter and the policy engine returns the firewall policy and the security policy to the requesting layer.

33. The computer readable medium of claim 32, wherein the requesting layer is a keying module layer and the security policy in the matching filter identifies a policy for negotiating a security association according to a key negotiation protocol.

34. A computer-readable medium for executing computer-executable instructions for determining a plurality of network policies to be applied to a packet at a layer process, comprising:

identifying, by the layer process, a set of parameters associated with the packet;

sending, by the layer process, a request to identify the network policies to be applied to the packet;

the request including the parameters associated with the packet; and

receiving, at the layer process, a response that includes a first policy value identifying a first network policy and a second policy value identifying a second network policy.

35. A computer-readable medium for executing computer-executable instructions for maintaining a plurality of network policies in a network device, comprising:

installing a set of filters into a policy engine, each of the filters comprising;

a set of filter conditions;

a first policy value identifying a first network policy and a second policy value identifying a second network policy.

36. The computer-readable medium of claim 35, further comprising:

identifying, by a policy engine, a matching filter from the set of filters that includes filter conditions matching a packet to which the plurality of network policies is to be applied; and

executing at least the first network policy on the packet.

37. The computer-readable medium of claim 35, wherein the set of filter conditions is dynamically configurable such that filter conditions are added or deleted according to desired policy.