Method of resolving conflicts in access control lists in router by comparing elements in the lists based on subsumption relations
First Claim
1. A method of analysis of access list subsumption in routing devices of an actual or planned routed computer network, comprising:
- producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include elements with address/mask pairs, and wherein said structured data associates respective access lists with respective router names;
determining whether respective access lists in the structured data include two or more elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list, wherein the respective access lists are structured such that the first element is encountered prior to the second element during typical processing of the respective access lists; and
storing in electronic memory a report of access list elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list.
0 Assignments
0 Petitions
Accused Products
Abstract
Methods are described for analyzing access list subsumption in routing devices of a computer network and for identifying computer network integrity violations, by producing structured data that includes stored router names and access lists that include elements with address/mask pairs, or patterns used to filter data into and out of a routing device, respectively; determining whether access lists in the structured data include elements in which a first element in the access list has a more general or equal address/mask pair, or pattern, respectively, than a second or subsequent element, or pattern; and storing in electronic memory a report of elements or a list of patterns, respectively, in which a first element or pattern is more general than or equal to a second or subsequent element or pattern.
-
Citations
20 Claims
-
1. A method of analysis of access list subsumption in routing devices of an actual or planned routed computer network, comprising:
-
producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include elements with address/mask pairs, and wherein said structured data associates respective access lists with respective router names;
determining whether respective access lists in the structured data include two or more elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list, wherein the respective access lists are structured such that the first element is encountered prior to the second element during typical processing of the respective access lists; and
storing in electronic memory a report of access list elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list. - View Dependent Claims (2, 3, 4)
-
-
5. A method of identifying network integrity violations in a computer network, comprising:
-
producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include patterns used to filter data into and out of a routing device, and wherein said structured data associates respective access lists with respective router names;
determining whether respective access lists in the structured data include a subsumption relation in which a first pattern is more general than or equal to a second pattern, wherein the respective access lists are structured such that the first pattern is encountered prior to the second pattern during typical processing of the respective access lists; and
storing in electronic memory a list of subsumption relations identifying respective pairs of first and second patterns. - View Dependent Claims (6, 7, 8)
-
-
9. A computer-readable medium carrying one or more sequences of instructions for analyzing access list subsumption in routing devices of an actual or planned routed computer network, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:
-
producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include elements with address/mask pairs, and wherein said structured data associates respective access lists with respective router names;
determining whether respective access lists in the structured data include two or more elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list, wherein the respective access lists are structured such that the first element is encountered prior to the second element during typical processing of the respective access lists; and
storing in electronic memory a report of access list elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list. - View Dependent Claims (10, 11, 12)
-
-
13. A computer-readable medium carrying one or more sequences of instructions for identifying network integrity violations in a computer network, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:
-
producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include patterns used to filter data into and out of a routing device, and wherein said structured data associates respective access lists with respective router names;
determining whether respective access lists in the structured data include a subsumption relation in which a first pattern is more general than or equal to a second pattern, wherein the respective access lists are structured such that the first pattern is encountered prior to the second pattern during typical processing of the respective access lists; and
storing in electronic memory a list of subsumption relations identifying respective pairs of first and second patterns. - View Dependent Claims (14, 15, 16)
-
-
17. An apparatus for analyzing access list subsumption in routing devices of an actual or planned routed computer network, comprising:
-
means for producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include elements with address/mask pairs, and wherein said structured data associates respective access lists with respective router names;
means for determining whether respective access lists in the structured data include two or more elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list, wherein the respective access lists are structured such that the first element is encountered prior to the second element during typical processing of the respective access lists; and
means for storing in electronic memory a report of access list elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list.
-
-
18. An apparatus for identifying network integrity violations in a computer network, comprising:
-
means for producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include patterns used to filter data into and out of a routing device, and wherein said structured data associates respective access lists with respective router names;
means for determining whether respective access lists in the structured data include a subsumption relation in which a first pattern is more general than or equal to a second pattern, wherein the respective access lists are structured such that the first pattern is encountered prior to the second pattern during typical processing of the respective access lists; and
means for storing in electronic memory a list of subsumption relations identifying respective pairs of first and second patterns.
-
-
19. An apparatus for analyzing access list subsumption in routing devices of an actual or planned routed computer network, comprising:
-
a network interface coupled to the routed computer network for receiving one or more packet flows therefrom;
a processor;
one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;
producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include elements with address/mask pairs, and wherein said structured data associates respective access lists with respective router names;
determining whether respective access lists in the structured data include two or more elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list, wherein the respective access lists are structured such that the first element is encountered prior to the second element during typical processing of the respective access lists; and
storing in electronic memory a report of access list elements in which a first element in the access list has a more general or equal address/mask pair than a second element in the access list.
-
-
20. An apparatus for identifying network integrity violations in a computer network, comprising:
-
a network interface coupled to the routed computer network for receiving one or more packet flows therefrom;
a processor;
one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;
producing structured data in electronic memory which includes respective stored router names and respective stored access lists which respectively include patterns used to filter data into and out of a routing device, and wherein said structured data associates respective access lists with respective router names;
determining whether respective access lists in the structured data include a subsumption relation in which a first pattern is more general than or equal to a second pattern, wherein the respective access lists are structured such that the first pattern is encountered prior to the second pattern during typical processing of the respective access lists; and
storing in electronic memory a list of subsumption relations identifying respective pairs of first and second patterns.
-
Specification