Policy caching method and apparatus for use in a communication device based on contents of one data unit in a subset of related data units

• US 5,842,040 A
• Filed: 06/18/1996
• Issued: 11/24/1998
• Est. Priority Date: 06/18/1996
• Status: Expired due to Fees

• Current Assignee: Storage Technologies Corporation (Oracle Corporation)
• Original Assignee: Storage Technologies Corporation (Oracle Corporation)
• Inventors: Olson, Steve A., Hughes, James P.
• Primary Examiner(s): Lee, Thomas C.
• Assistant Examiner(s): YUAN, CHIEN H
• Application Number:
  US08/666,638
• Time in Patent Office: 889 Days
• Field of Search: 370/231, 370/256, 370/392, 370/232, 371/57.2, 371/30, 395/403, 395/440, 395/447, 395/455, 395/200.11, 395/703, 395/309, 340/825.22, 348/441, 380/21
• US Class Current: 710/11
• CPC Class Codes: H04L 2012/5619 Network Node Interface, e.g. tandem connections, transit switching
• CPC Class Codes: H04L 2012/5626 Network management, e.g. Intelligent nets
• CPC Class Codes: H04L 2012/563 Signalling, e.g. protocols, reference model
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04Q 11/0478 Provisions for broadband connections

Abstract

A policy caching method for use in a communication device is provided. The communication device determines which instance of protocol data unit (PDU) network policy from a plurality of policies is to be applied to related-received PDUs based on contents of one of the related-received PDUs. Subsequently, policy identification information identifying the instance PDU policy is cached for future application to other of the related-received PDUs. Also, a communication device which implemented this policy caching method is provided.

Claims

1. A policy caching method for use in a communication device, comprising the steps of:

determining an instance of protocol data unit (PDU) network policy from a plurality of policies to be applied to related-received PDUs based on contents of one of the related-received PDUs, wherein the related-received PDUs are a subset of a stream of PDUs and may be distributed throughout said stream of PDUs; and

caching policy identification information identifying the instance of PDU policy which is to be applied to other PDUs of the related-received PDUs.

2. The policy caching method of claim 1 further comprising a step of applying the instance of PDU policy from the plurality of policies to another PDU of the related-received PDUs based on using the cached policy identification information.

3. The policy caching method of claim 1 wherein the determining step comprises determining the instance of PDU policy based on contents of a first PDU of the related-received PDUs received by the communication device.

4. The policy caching method of claim 1, further comprising a step of receiving the stream of PDUs from a communication link including related-received PDUs.

5. The policy caching method of claim 4 wherein the communication link is selected from a group consisting of:

an asynchronous transfer mode (ATM) network, a synchronous optical network (SONET), fiber distributed data interchange (FDDI) network, a frame relay network, Ethernet, 100-Mbps Ethernet, gigabit Ethernet, high performance parallel interface (HIPPI), Fibre Channel, switched multimegabit data Service (SMDS), X.25 network, integrated services digital network (ISDN), token ring, public switched telephone network (PSTN), a cable modem network, a serial interface, a parallel interface, and a computer bus.

6. The policy caching method of claim 4 wherein the communication link utilizes a network signaling protocol selected from a group consisting of:

transmission control protocol/internet protocol (TCP/IP), AppleTalk, DECNet, system network architecture (SNA), private network node interface (PNNI), user-network interface (UNI), simple protocol for asynchronous transfer mode network signaling (SPANS), interim local management interface (ILMI), and operations administration and maintenance (OAM) interface.

7. The policy caching method of claim 4, further comprising a step of grouping together the subset of PDUs from the stream of PDUs as the related-received PDUs based on selection criteria selected from a group consisting of:

a) the stream of PDUs comprising a stream of cells and the related-received PDUs comprising cells of a particular packet;

b) the stream of PDUs comprising PDUs from the stream of PDUs having identical circuit numbers;

c) the stream of PDUs comprising packets in a series of frames and the related-received PDUs comprising a number of the packets;

d) the related-received PDUs comprising PDUs from the stream of PDUs having identical source addresses;

e) the related-received PDUs comprising PDUs from the stream of PDUs having identical destination addresses;

f) the related-received PDUs comprising PDUs from the stream of PDUs having identical source ports on a communication interface;

g) the related-received PDUs comprising PDUs from the stream of PDUs having destination source ports on a communication interface;

h) the related-received PDUs comprising PDUs from the stream of PDUs having identical network protocols;

i) the related-received PDUs comprising PDUs from the stream of PDUs having identical transport protocols;

j) the related-received PDUs comprising PDUs from the stream of PDUs having identical security options; and

k) the related-received PDUs comprising PDUs from the stream of PDUs having identical contents in any PDU field.

8. The policy caching method of claim 4 further comprising a step of performing the instance of network policy by filtering or auditing the stream of PDUs.

9. The policy caching method of claim 1 wherein the communication device is selected from a group consisting of:

a data network device, a computer, a monitoring device, a switch, a router, a bridge, and.

10. The policy caching method of claim 1 wherein each PDU comprises a cell and the related-received PDUs comprise cells of a particular packet such that the policy caching method is performed by the communication device on a cell by cell basis without reassembling the cells into the particular packet.

11. A policy caching method for use in a communication device, comprising steps of:

(a) receiving a stream of PDUs from a communication link;

(b) grouping together a subset of PDUs from the stream of PDUs as related-received PDUs based on selection criteria;

(c) determining an instance of protocol data unit (PDU) network policy from a plurality of policies to be applied to the related-received PDUs based on contents of one of the related-received PDUs;

(d) caching policy identification information identifying the instance of PDU policy which is to be applied to other PDUs of the related-received PDUs;

(e) applying the instance of PDU policy from the plurality of policies to another PDU of the related-received PDUs based on using the cached policy identification information; and

(f) performing the instance of network policy by filtering or auditing the stream of PDUs.

12. The policy caching method of claim 11 wherein the determining step comprises determining the instance of PDU policy based on contents of a first PDU of the related-received PDUs received by the communication device.

13. The policy caching method of claim 11 wherein the communication link is selected from a group consisting of:

an asynchronous transfer mode (ATM) network, a synchronous optical network (SONET), fiber distributed data interchange (FDDI) network, a frame relay network, Ethernet, 100-Mbps Ethernet, gigabit Ethernet, high performance parallel interface (HIPPI), Fibre Channel, switched multimegabit data Service (SMDS0, X.25 network, integrated services digital network (ISDN), token ring, public switched telephone network (PSTN), a cable modem network, a serial interface, a parallel interface, and a computer bus.

14. The policy caching method of claim 11 wherein the communication link utilizes a network signaling protocol selected from a group consisting of:

transmission control protocol/internet protocol (TCP/IP), AppleTalk, DECNet, system network architecture (SNA), private network node interface (PNNI), user-network interface (UNI), simple protocol for asynchronous transfer mode network signaling (SPANS), interim local management interface (ILMI), and operations administration and maintenance (OAM) interface.

15. The policy caching method of claim 11 wherein the selection criteria for the grouping step is selected from a group consisting of:

(a) the stream of PDUs comprising a stream of cells and the related-received PDUs comprising cells of a particular packet;

(b) the stream of PDUs comprising PDUs from the stream of PDUs having identical circuit numbers;

(c) the stream of PDUs comprising packets in a series of frames and the related-received PDUs comprising a number of the packets;

(d) the related-received PDUs comprising PDUs from the stream of PDUs having identical source addresses;

(e) the related-received PDUs comprising PDUs from the stream of PDUs having identical destination addresses;

(f) the related-received PDUs comprising PDUs from the stream of PDUs having identical source ports on a communication interface;

(g) the related-received PDUs comprising PDUs from the stream of PDUs having identical destination ports on a communication interface;

(h) the related-received PDUs comprising PDUs from the stream of PDUs having identical network protocols;

(i) the related-received PDUs comprising PDUs from the stream of PDUs having identical transport protocols;

(j) the related-received PDUs comprising PDUs from the stream of PDUs having identical security options; and

(k) the related-received PDUs comprising PDUs from the stream of PDUs having identical contents in any PDU field.

16. The policy caching method of claim 11 wherein the communication device is selected from a group consisting of a data network device, a computer, a monitoring device, a switch, a router, a bridge, and a firewall.

17. The policy caching method of claim 11 wherein each PDU comprises a cell and the related-received PDUs comprise cells of a particular packet such that the policy caching method is performed by the communication device on a cell by cell basis without reassembling the cells into the particular packet.

18. A policy cache for use in a communication device, comprising:

a) exception processing means for determining an instance of protocol data unit (PDU) network policy from a plurality of policies to be applied to related-received PDUs based on contents of one of the related-received PDUs, wherein the related-received PDUs are a subset of a stream of PDUs and may be distributed throughout said stream of PDUs; and

b) cached instance classification means, operatively coupled to the exception processing means, for caching policy identification information identifying the instance of PDU policy which is to be applied to other PDUs of the related-received PDUs.

19. The policy cache of claim 18 further comprising instance policy cache means, operatively coupled to the exception processing means, for caching the instance of PDU policy which is to be applied to other of the related-received PDUs.

20. The policy cache of claim 18 wherein the exception processing means comprises means for determining the instance of PDU policy based on contents of a first PDU of the related-received PDUs received by the exception processing means.

21. The policy cache of claim 18 wherein each PDU comprises a cell and the related-received PDUs comprise cells of a particular packet such that the exception processing means and the cached instance classification means are performed operations on a cell by cell basis without reassembling the cells into the particular packet.

22. A communication device comprising the policy cache of claim 19 and further comprising a data stream processing means, operatively coupled to the policy cache, for applying the instance of PDU policy from the plurality of policies to another PDU of the related-received PDUs by utilizing the cached policy identification information to retrieve the cached instance of PDU policy from the instance policy cache means.

23. The communication device of claim 22 wherein the cached instance classification means comprises a content addressable memory (CAM) such that the data stream processing means provides field values from the other of the related-received PDUs to the CAM and receives the policy identification information for the other of the related-received PDUs back from the CAM.

24. The communication device of claim 22 wherein the cached instance classification means comprises a hash mechanism which performs a hashing function on field values from the other of the related-received PDUs provided by the data stream processing means, uses results of the hashing function to select the policy identification information for the other of the related-received PDUs from a hashing table, and provides the selected policy identification information to the data stream processing means.

25. The communication device of claim 22 wherein the cached instance classification means comprises a lookup table mechanism such that the data stream processing means uses field values from the other of the related-received PDUs as an index to the lookup table mechanism and retrieves the policy identification information for the other of the related-received PDUs in the lookup table mechanism pointed to by the index.

26. The communication device of claim 22 wherein the data stream processing means comprises means for utilizing field values from each PDU to check the policy cache for a cached instance of PDU policy from the instance policy cache means for each PDU and means for retrieving the cached instance of PDU policy when the field values correspond to cached policy identification information such that the data stream processing means checks for a cached instance of PDU policy for each PDU and obtains an instance of PDU policy from the exception processing means when a cached instance of PDU policy is not found in the instance policy cache means.

27. The communication device of claim 22, wherein the data stream processing means comprises a receiving unit which receives the stream of PDUs from a communication link, the stream of PDUs including the related-received PDUs.

28. The communication device of claim 27 wherein the data stream processing means further comprises enforcement means for performing the instance of network policy by filtering or auditing the stream of PDUs into a policy-enforced stream of PDUs.

29. The communication device of claim 28 wherein the data stream processing means further comprises sending means, operatively coupled to the enforcement means, for sending the policy-enforced stream of PDUs out of the communication device as the output data stream of PDUs.

30. The communication device of claim 27 wherein the data stream processing means comprises a first receiving unit which receives a first stream of PDUs from an upstream communication link and a second receiving unit which receives a second stream of PDUs from a downstream communication link, only one of the first and the second streams of PDUs includes the related-received PDUs upon which network policy is to be determined, the data stream processing means further comprises enforcement means for performing the instance of network policy by filtering or auditing one of the first and the second stream of PDUs into a policy-enforced stream of PDUs such that instances of network policy are enforced in the upstream and downstream communication links.

31. The communication device of claim 27 wherein the communication link is selected from a group consisting of:

an asynchronous transfer mode (ATM) network, a synchronous optical network (SONET), fiber distributed data interchange (FDDI) network, a frame relay network, Ethernet, 100-Mbps Ethernet, gigabit Ethernet, high performance parallel interface (HIPPI), Fibre Channel, switched multimegabit data Service (SMDS), X.25 network, integrated services digital network (ISDN), token ring, public switched telephone network (PSTN), a cable modem network, a serial interface, a parallel interface, and a computer bus.

32. The communication device of claim 27 wherein the communication link utilizes a network signaling protocol selected from a group consisting of:

transmission control protocol/internet protocol (TCP/IP), AppleTalk, DECNet, system network architecture (SNA), private network node interface (PNNI), user-network interface (UNI), simple protocol for asynchronous transfer mode network signaling (SPANS), interim local management interface (ILMI), and operations administration and maintenance (OAM) interface.

33. The communication device of claim 27, wherein the data stream processing means receiving unit comprises means for grouping together the subset of PDUs from the stream of PDUs as the related-received PDUs based on selection criteria selected from a group consisting of:

a) the stream of PDUs comprising a stream of cells and the related-received PDUs comprising cells of a particular packet;

b) the stream of PDUs comprising PDUs from the stream of PDUs having identical circuit numbers;

c) the stream of PDUs comprising packets in a series of frames and the related-received PDUs comprising a number of the packets;

d) the related-received PDUs comprising PDUs from the stream of PDUs having identical source addresses;

e) the related-received PDUs comprising PDUs from the stream of PDUs having identical destination addresses;

f) the related-received PDUs comprising PDUs from the stream of PDUs having identical source ports on a communication interface;

g) the related-received PDUs comprising PDUs from the stream of PDUs having destination source ports on a communication interface;

h) the related-received PDUs comprising PDUs from the stream of PDUs having identical network protocols;

i) the related-received PDUs comprising PDUs from the stream of PDUs having identical transport protocols;

j) the related-received PDUs comprising PDUs from the stream of PDUs having identical security options; and

k) the related-received PDUs comprising PDUs from the stream of PDUs having identical contents in any PDU field.

34. The communication device of claim 22 further comprising a general policy storage mechanism, operatively coupled to the exception processing means, which stores the plurality of network policies such that the exception processing means can query the general policy storage mechanism for instances of PDU network policies which may be applicable to the related-received PDUs.

35. The communication device of claim 22 wherein the communication device is selected from a group consisting of:

a data network device, a computer, a monitoring device, a switch, a router, a bridge, and a firewall.