Efficient evaluation of rules

• US 7,143,439 B2
• Filed: 06/08/2001
• Issued: 11/28/2006
• Est. Priority Date: 01/07/2000
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: The Security Center Incorporated
• Inventors: Sherlock, Kieran G., Cooper, Geoffrey, Valente, Luis, Shaw, Bob
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): Gyorfi, Thomas
• Application Number:
  US09/878,093
• Publication Number:
  US 20020069200A1
• Time in Patent Office: 1,999 Days
• Field of Search: 713/200, 713/201, 707/9, 707/7, 707/100, 707/104.1, 709/223, 709/224, 709/225, 709/226, 705/57, 705/58, 705/59, 706/46, 706/47, 706/48, 726/11, 726/13, 726/14
• US Class Current: 726/11
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers

Abstract

A method and apparatus uses a proprietary algorithm for organizing network security policy rules in a way that minimizes the number of rules considered when determining the set of rules applicable to a given protocol event.

Claims

1. A computer-implemented method for a policy engine first to organize pre-runtime and second to select policy rules in a way to effect an efficient evaluation of a protocol event at runtime, said protocol event having an agent descriptor, a protocol name, and a protocol action, said method comprising the steps of:

providing a policy engine first to organize pre-runtime and second to select policy rules in a way to effect an efficient evaluation of a protocol event at runtime, said protocol event having an agent descriptor, a protocol name, and a protocol action, said policy engine;

creating a first associative array having a first key and a first value, wherein said first key corresponds to an agent descriptor and said first value is a reference to a second associative array having a second key and a second value;

creating a second associative array, wherein said second key corresponds to a protocol name and said second value is a reference to a third associative array having a third key and a third value;

creating a third associative array, wherein said third key corresponds to a protocol action and said third value is a reference to a fourth associative array having a fourth key and a fourth value;

creating a fourth associative array, wherein said fourth key corresponds to a set of policy rules and said fourth value is a rank number associated with said any of said policy rules;

upon receiving at runtime an incoming protocol event comprising an associated agent descriptor, an associated protocol name, and an associated protocol action, selecting said first associative array, wherein said first key corresponds to said associated agent descriptor and said first value is a reference to said second associative array;

selecting said second associative array, wherein said second key corresponds to said associated protocol name and said second value is a reference to said third associative array;

selecting said third associative array, wherein said third key corresponds to said associated protocol action and said third value is a reference to said fourth associative array; and

selecting said fourth associative array, wherein said fourth key corresponds to any of said policy rules and said fourth value is a said rank number associated with said any of said policy rules, wherein said rank number is a relative value dependent on, and does not have to be unique with respect to, other rank numbers in said fourth associative array.

2. The computer-implemented method of claim 1, further comprising ordering said policy rules in decreasing order of rank number.

3. The computer-implemented method of claim 2, further comprising incorporating constraints into said ordering.

4. The computer-implemented method of claim 2, further comprising ordering in lexical order rules having a same rank number.

5. The computer-implemented method of claim 1, wherein said any of said policy rules is referenced by a plurality of said fourth associative arrays.

6. A computer system for a policy engine first to organize pre-runtime and second to select policy rules in a way to effect an efficient evaluation of a protocol event at runtime, said protocol event having an agent descriptor, a protocol name, and a protocol action, said computer system comprising:

at least one computer with accessibly coupled computer memory;

a policy engine first to organize pre-runtime and second to select policy rules in a way to effect an efficient evaluation of a protocol event at runtime, said protocol event having an agent descriptor, a protocol name, and a protocol action contains program code segments residing in said computer memory accessibly coupled to said computer of said computer system comprised of;

a program code segment supporting creating a first associative array having a first key and a first value, wherein said first key corresponds to an agent descriptor and said first value is a reference to a second associative array having a second key and a second value;

a program code segment supporting creating a second associative array, wherein said second key corresponds to a protocol name and said second value is a reference to a third associative array having a third key and a third value;

a program code segment supporting creating a third associative array, wherein said third key corresponds to a protocol action and said third value is a reference to a fourth associative array having a fourth key and a fourth value;

a program code segment supporting creating a fourth associative array, wherein said fourth key corresponds to a set of policy rules and said fourth value is a rank number associated with said any of said policy rules;

a program code segment supporting, upon receiving at runtime an incoming protocol event comprising an associated agent descriptor, an associated protocol name, and an associated protocol action, selecting said first associative array, wherein said first key corresponds to said associated agent descriptor and said first value is a reference to a said second associative array;

a program code segment supporting selecting said second associative array, wherein said second key corresponds to said associated protocol name and said second value is a reference to said third associative array;

a program code segment supporting selecting said third associative array, wherein said third key corresponds to said associated protocol action and said third value is a reference to said fourth associative array; and

a program code segment supporting selecting said fourth associative array, wherein said fourth key corresponds to any of said policy rules and said fourth value is said rank number associated with said any of said policy rules, wherein said rank number is a relative value dependent on, and does not have to be unique with respect to, other rank numbers in said fourth associative array.

7. The computer system of claim 6, further comprising a program code segment supporting ordering said policy rules in decreasing order of rank number.

8. The computer system of claim 7, further comprising a program code segment supporting incorporating constraints into said ordering.

9. The computer system of claim 7, further comprising a program code segment supporting ordering in lexical order rules having a same rank number.

10. The computer system of claim 6, wherein said any of said policy rules is referenced, by a plurality of said fourth associative arrays.