Method and framework for integrating a plurality of network policies

• US 20070204154A1
• Filed: 02/01/2007
• Published: 08/30/2007
• Est. Priority Date: 06/06/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Dixon, William, Swander, Brian
• Granted Patent: US 7,761,708 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system is disclosed for managing and implementing a plurality of network policies in a network device. Each of the plurality of policies are defined by one or more filters. The filters are installed in a policy engine. A layer identifies the network policy to be applied to a packet by sending a request to the policy engine. The policy engine then returns the policy to the requesting layer. The method and system may be used to implement a programmable, host-based, distributed, authenticating firewall that enables security and other policies to be applied at several protocol layers.

Claims

1. A framework for integrating a plurality of filter based policies to be applied to packets of data including at least a firewall policy and a security policy, comprising:

a set of layer processes for identifying at least one parameter associated with a packet;

a policy engine in communication with the set of layer processes; and

a set of filters stored in the policy engine, each filter in the set of filters having filter conditions, an action identifying the firewall policy, and a policy context identifying the security policy.

2. The framework of claim 1, wherein the plurality of filter based policies further include a quality of service policy that identifies communication settings to be applied to packets, the quality of service policy being defined by the policy context in the set of filters.

3. The framework of claim 1, further comprising:

a requesting layer process in the set of layer processes that sends the at least one parameter to the policy engine and the policy engine identifies a matching filter from the set of filters having filter conditions that match the at least one parameter and the policy engine returns the firewall policy and the security policy to the requesting layer.

4. The framework of claim 3, wherein the requesting layer is a keying module layer and the security policy in the matching filter identifies a policy for negotiating a security association according to a key negotiation protocol.

5. The framework of claim 4, wherein the at least one parameter is a plurality of parameters and the plurality of parameters comprise source and destination IP addresses, source and destination ports, and a protocol type.

6. The framework of claim 4 wherein the key negotiation protocol is an IKE protocol.

7. The framework of claim 3, wherein the requesting layer further sends packet context and the policy engine further identifies the matching filter from the packet context.

8. A computer-readable medium for executing computer-executable instructions for facilitating a framework for integrating a plurality of filter based policies to be applied to packets of data including at least a firewall policy and a security policy, comprising:

a set of layer processes for identifying at least one parameter associated with a packet;

a policy engine in communication with the set of layer processes; and

a set of filters stored in the policy engine, each filter in the set of filters having filter conditions, an action identifying the firewall policy, and a policy context identifying the security policy.

9. The computer readable medium of claim 8, wherein the plurality of filter based policies further include a quality of service policy that identifies communication settings to be applied to packets, the quality of service policy being defined by the policy context in the set of filters.

10. The computer readable medium of claim 8, further comprising:

a requesting layer process in the set of layer processes that sends the at least one parameter to the policy engine and the policy engine identifies a matching filter from the set of filters having filter conditions that match the at least one parameter and the policy engine returns the firewall policy and the security policy to the requesting layer.

11. The computer readable medium of claim 10, wherein the requesting layer is a keying module layer and the security policy in the matching filter identifies a policy for negotiating a security association according to a key negotiation protocol.