SYSTEMS AND METHODS FOR CONFIGURING POLICY BANK INVOCATIONS

• US 20080225722A1
• Filed: 03/12/2007
• Published: 09/18/2008
• Est. Priority Date: 03/12/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Bandekar, Vishal, Khemani, Prakash
• Granted Patent: US 8,631,147 B2
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups. These policy configurations and processing may allow configuration and processing of complex network behaviors relating to load balancing, VPNs, SSL offloading, content switching, application security, acceleration, and caching.

Claims

1. A method for configuring flow control among policy groups used in a network device processing a packet stream, the method comprising:

(a) providing a configuration interface for configuring a plurality of policy groups for a network device;

(b) identifying, by the configuration interface, a first policy of a first policy group, the first policy specifying a rule comprising a first expression; and

(c) receiving, via the interface, information identifying a second policy group to be processed based on an evaluation of the rule.

2. The method of claim 1, wherein step (a) comprises providing a command-line configuration interface.

3. The method of claim 1, wherein step (a) comprises providing a configuration interface comprising one or more of a drag-and-drop interface, a list-selection interface, or a syntax-highlighting interface.

4. The method of claim 1, wherein step (a) comprises executing the configuration interface on a device in communication with the network device.

5. The method of claim 1, wherein step (a) comprises executing the configuration interface on the network device.

6. The method of claim 1, wherein step (a) comprises providing, to a user, a configuration interface for creating a plurality of policy groups.

7. The method of claim 1, wherein the first policy specifies a rule having an object-oriented expression.

8. The method of claim 1, wherein the first policy specifies an action to be taken based on an evaluation of the rule.

9. The method of claim 1, wherein the first policy specifies an action to be taken if the rule evaluates to true;

the action comprising performing one of;

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

10. The method of claim 1, wherein the first policy specifies a second policy of the first policy group to be processed after the second policy group is processed.

11. The method of claim 1, wherein step (c) comprises receiving, via the interface, information identifying a second policy group to be processed if the rule evaluates to true.

12. The method of claim 1, wherein step (c) comprises receiving, via the interface, a label of a second policy group to be processed based on an evaluation of the rule.

13. A method of flow control among policy groups used in a network device processing a packet stream, the method comprising:

(a) identifying, by an appliance, a first policy group to apply to a received packet stream;

(b) processing, by the appliance, a first policy of the first policy group, the first policy identifying (i) a rule comprising a first expression, and (ii) information identifying a second policy group;

(c) evaluating, by the appliance, the rule; and

(d) processing, by the appliance in response to the evaluation of the rule, the identified second policy group.

14. The method of claim 13, wherein step (c) comprises evaluating an object-oriented expression.

15. The method of claim 13, wherein the first policy specifies an action to be taken based on an evaluation of the rule.

16. The method of claim 13, further comprising the step of performing, in response to the determination, the action identified by the first policy.

17. The method of claim 13, wherein the action comprises performing one of:

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

18. The method of claim 13, further comprising storing in a list, in response to the determination, the action identified by the first policy.

19. The method of claim 18, further comprising storing, in the list, at least one other action, the at least one other action identified in a second policy of the second policy group.

20. The method of claim 18, further comprising performing each action stored in the list of actions.

21. The method of claim 13, further comprising, processing, by the appliance after processing the second policy group, a second policy of the first policy group.

22. The method of claim 13, further comprising, processing, by the appliance, a third policy group, the third policy group identified by a second policy of the second policy group.

23. The method of claim 13, further comprising, processing, by the appliance, a third policy group, the third policy group identified by a second policy of the first policy group.

24. The method of claim 13, wherein the first policy specifies a second policy of the first policy group to be processed after the second policy group is processed.

25. The method of claim 24, further comprising, processing, by the appliance after processing the second policy group, the second policy.

26. An appliance providing flow control among policy groups used in processing a packet stream, the appliance comprising:

a packet processor which receives a packet stream; and

a policy engine which identifies a first policy group to apply to a received packet stream;

processes a first policy of the first policy group, the first policy identifying (i) a rule comprising a first expression and (ii) information identifying a second policy group;

evaluates the rule; and

processes, in response to the evaluation of the rule, the identified second policy group.

27. The system of claim 26, wherein the policy engine evaluates an object-oriented expression.

28. The system of claim 26, wherein the policy engine performs, in response to the determination, an action identified by the first policy.

29. The system of claim 26, wherein the policy engine performs one of:

load balancing, content switching, application security, application delivery, network acceleration, or application acceleration.

30. The system of claim 26, wherein the policy engine stores in a list, in response to the determination, an action identified by the first policy.

31. The system of claim 26, wherein the policy engine stores in the list at least one other action, the at least one other action identified in a second policy of the second policy group.

32. The system of claim 31, wherein the policy engine performs each action stored in the list of actions.

33. The system of claim 26, wherein the policy engine processes, after processing the second policy group, a second policy of the first policy group.

34. The system of claim 26, wherein the policy engine processes a third policy group, the third policy group identified by a policy of the second policy group.

35. The system of claim 26, wherein the policy engine, after processing the second policy group, resumes processing the first policy group.

36. The system of claim 26, wherein the policy engine processes a third policy group, the third policy group identified by a second policy of the first policy group.

37. The system of claim 26, wherein the first policy specifies a second policy of the first policy group to be processed after the second policy group is processed.

38. The system of claim 37, wherein the policy engine processes, after processing the second policy group, the second policy.