SYSTEMS AND METHODS FOR CONFIGURING POLICY BANK INVOCATIONS

• US 20140108635A1
• Filed: 12/16/2013
• Published: 04/17/2014
• Est. Priority Date: 03/12/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Khemani, Prakash, Bandekar, Vishal
• Granted Patent: US 9,450,837 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups. These policy configurations and processing may allow configuration and processing of complex network behaviors relating to load balancing, VPNs, SSL offloading, content switching, application security, acceleration, and caching.

Claims

1. A method of processing groups of policies, the method comprising:

(a) establishing, by a device, a first group of policies and a second group of policies to apply to packets received by the device, a policy of the first group of policies identifying an action to apply the second group of policies subsequent to processing of the policy of the first group;

(b) applying, by the device, one or more policies of the first group of policies to a packet;

(c) determining, by the device, to apply the second group of policies to the packet responsive to evaluation of the policy of the first group identifying the action to apply the second group of policies; and

(d) applying, by the device responsive to the determination and after processing of the policy of the first group, one or more policies of the second group of policies to the packet.

2. The method of claim 1, wherein step (a) further comprises receiving, by the device, configuration of the first group of policies and the second group of policies.

3. The method of claim 1, wherein step (a) further comprises receiving, by the device, configuration of the policy to have the action of the policy to apply the second group of policies upon evaluation to true of an expression of the policy.

4. The method of claim 1, wherein step (b) further comprising applying the one or more policies of the first group to the packet in an execution order.

5. The method of claim 1, wherein step (c) further comprises evaluating an object-oriented expression of the policy to the packet, a result of the evaluation identifying to take the action of applying the second group of policies.

6. The method of claim 1, wherein step (d) further comprises changing, by the device responsive to the determination, a flow of execution of applying the first group of policies to applying the second group of policies.

7. The method of claim 1, further comprising determining, by the device, that evaluation of a second policy of the second group identifies a second action to apply a third group of policies to the packet.

8. The method of claim 1, further comprising determining, by the device, that evaluation of a second policy of the second group identifies a section action to apply a third policy of the first group of policies to apply to the packet.

9. The method of claim 1, further comprising determining, by the device, that evaluation of a second policy of the second group identifies a second action to halt execution of applying policies to the packet.

10. The method of claim 1, further comprising executing, by the device, a plurality of actions collected in a list resulting from evaluation of policies from the first group and the second group of policies to the packet.

11. A system of processing groups of policies, the system comprising:

a device configured to establish a first group of policies and a second group of policies to apply to packets received by the device, a policy of the first group of policies identifying an action to apply the second group of policies subsequent to processing of the policy of the first group;

wherein the device is configured to apply one or more policies of the first group of policies to a packet; and

wherein the device is configured to determine to apply the second group of policies to the packet responsive to evaluation of the policy of the first group identifying the action to apply the second group of policies and responsive to the determination to apply, after processing of the policy of the first group, one or more policies of the second group of policies to the packet.

12. The system of claim 11, wherein the device is further configured to receive configuration of the first group of policies and the second group of policies.

13. The system of claim 11, wherein the device is further configured to receive configuration of the policy to have the action of the policy to apply the second group of policies upon evaluation to true of an expression of the policy.

14. The system of claim 11, wherein the device is further configured to apply the one or more policies of the first group to the packet in an execution order.

15. The system of claim 11, wherein the device is further configured to evaluate an object-oriented expression of the policy to the packet, a result of the evaluation identifying to take the action of applying the second group of policies.

16. The system of claim 11, wherein the device is further configured to change, responsive to the determination, a flow of execution of applying the first group of policies to applying the second group of policies.

17. The system of claim 11, wherein the device is further configured to determine that evaluation of a second policy of the second group identifies a second action to apply a third group of policies to the packet.

18. The system of claim 11, wherein the device is further configured to determine that evaluation of a second policy of the second group identifies a section action to apply a third policy of the first group of policies to apply to the packet.

19. The system of claim 11, wherein the device is further configured to determine that evaluation of a second policy of the second group identifies a second action to halt execution of applying policies to the packet.

20. The system of claim 11, wherein the device is further configured to execute a plurality of actions collected in a list resulting from evaluation of policies from the first group and the second group of policies to the packet.