Apparatus and methods for processing filter rules

• US 8,407,778 B2
• Filed: 08/11/2005
• Issued: 03/26/2013
• Est. Priority Date: 08/11/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Moonen, Scott Christopher
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): WRIGHT, BRYAN F
• Application Number:
  US11/161,654
• Publication Number:
  US 20070039044A1
• Time in Patent Office: 2,784 Days
• Field of Search: 726/13
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

Techniques for processing filter rules are disclosed. To this end, filter rules having one or more attributes where each attribute indicates a condition to qualify whether a filter rule applies to a subsequent event are received. Summary rules are generated where each summary rule has a number of summary conditions. Some filter rules become associated with the generated summary rules. The summary conditions are extended to span the attributes of the associated filter rules.

Claims

1. A computer-implemented method for filtering data packets in a network comprising,

collecting configured filter rules containing logical expressions for processing data packets,

determining simple form filter rules based on the configured filter rules, wherein the simple form filter rules comprises a filter group name and attributes to correlate the simple form rules to a complex form filter rule,

assembling a sub-list summary structure, wherein the sub-list summary structure comprises simple form filter rules recombined into complex form filter rules by common attribute data and wherein the sub-list summary structure further includes sub-list summary rules each containing a plurality of filter rules and sub-list summary attributes containing the narrowest ranges which encompass all of the ranges or values of the corresponding attributes in the filter rules associated with the sub-list summary rule,

receiving a packet with attributes,

determining applicable filter rule by comparing the attributes of the received packet with the attributes of the sub-list summary structure.

2. The computer-implemented method of claim 1 wherein the configured filter rules are ordered from most specific rule to least specific rule.

3. The computer-implemented method of claim 1 wherein the attribute is a packets address.

4. The computer-implemented method of claim 1 wherein the attribute is a user configured name.

5. The computer-implemented method of claim 1 wherein the step of determining applicable filter rule includes:

determining whether attributes of the received packet meet the corresponding summary attributes of a first one of the sub-list summary rules; and

determining whether attributes of the received packet meet the summary attributes of a second one of the sub-list summary rules, if the attributes of the received packet do not meet the summary attributes of the first one of the sub-list summary rules.

6. The computer-implemented method of claim 1 wherein the filter rules are distributed substantially equally across the sub-list summary rules.

7. A computer system for filtering data packets in a network comprising a processor configured to perform:

collecting configured filter rules containing logical expressions for processing data packets,

determining simple form filter rules based on the configured filter rules, wherein the simple form filter rules comprises a filter group name and attributes to correlate the simple form rules to a complex form filter rule,

assembling a sub-list summary structure, wherein the sub-list summary structure comprises simple form filter rules recombined into complex form filter rules by common attribute data and wherein the sub-list summary structure further includes sub-list summary rules each containing a plurality of filter rules and sub-list summary attributes containing the narrowest ranges which encompass all of the ranges or values of the corresponding attributes in the filter rules associated with the sub-list summary rule,

receiving a packet with attributes,

determining applicable filter rule by comparing the attributes of the received packet with the attributes of the sub-list summary structure.

8. The computer system of claim 7 wherein the configured filter rules are ordered from most specific rule to least specific rule.

9. The computer system of claim 7 wherein the attribute is a packets address.

10. The computer system of claim 7 wherein the attribute is a user configured name.

11. The computer system of claim 7 wherein the processor is further configured to perform:

determining whether attributes of the received packet meet the corresponding summary attributes of a first one of the sub-list summary rules; and

determining whether attributes of the received packet meet the summary attributes of a second one of the sub-list summary rules, if the attributes of the received packet do not meet the summary attributes of the first one of the sub-list summary rules.

12. The computer system of claim 7 wherein the filter rules are distributed substantially equally across the sub-list summary rules.

13. A computer program product comprising a computer usable storage medium having stored therein computer usable program code for filtering data packets in a network, wherein the medium is not a transient signal, the computer usable program code, when executed by a computer, causing the computer to perform the steps of:

collecting configured filter rules containing logical expressions for processing data packets, determining simple form filter rules based on the configured filter rules, wherein the simple form filter rules comprises a filter group name and attributes to correlate the simple form rules to a complex form filter rule, assembling a sub-list summary structure, wherein the sub-list summary structure comprises simple form filter rules recombined into complex form filter rules by common attribute data and wherein the sub-list summary structure further includes sub-list summary rules each containing a plurality of filter rules and sub-list summary attributes containing the narrowest ranges which encompass all of the ranges or values of the corresponding attributes in the filter rules associated with the sub-list summary rule, receiving a packet with attributes, determining applicable filter rule by comparing the attributes of the received packet with the attributes of the sub-list summary structure.

14. The computer program product of claim 13 wherein the configured filter rules are ordered from most specific rule to least specific rule.

15. The computer program product of claim 13 wherein the attribute is a packets address.

16. The computer program product of claim 13 wherein the attribute is a user configured name.

17. The computer program product of claim 13 wherein the step of determining applicable filter rule includes:

determining whether attributes of the received packet meet the corresponding summary attributes of a first one of the sub-list summary rules; and

determining whether attributes of the received packet meet the summary attributes of a second one of the sub-list summary rules, if the attributes of the received packet do not meet the summary attributes of the first one of the sub-list summary rules.

18. The computer program product of claim 13 wherein the filter rules are distributed substantially equally across the sub-list summary rules.