Credential/condition assertion verification optimization

• US 6,871,284 B2
• Filed: 06/14/2001
• Issued: 03/22/2005
• Est. Priority Date: 01/07/2000
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Securify, Inc. (McAfee, LLC)
• Inventors: Sherlock, Kieran G., Cooper, Geoffrey, Shaw, Bob, Valente, Luis
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/882,570
• Publication Number:
  US 20020053033A1
• Time in Patent Office: 1,377 Days
• Field of Search: 713/200, 713/189, 713/187
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method and apparatus ascertain which credential and which condition both from a network security policy best describe, respectively, information about initiator and target principals involved in an interaction, and tests performed on a state of an associated protocol event.

Claims

1. A method for performing credential and condition assertion verification corresponding to a policy file, comprising:

during an initialization process, dynamically creating comparing functions for principals, said principals having credentials, said credentials from said policy file, and dynamically creating comparing functions for states of protocol events, said events having conditions, said conditions from said policy file;

during said initialization process, dynamically creating and loading a module, said module containing said comparing functions;

during runtime, ensuring an installed policy file corresponds to said module, and, if not, repeating said initialization process using said installed policy file, thereby dynamically generating an updated module containing updated comparing functions, said updated module and said updated comparing functions corresponding to said installed policy file; and

calling said comparing functions as appropriate.

2. The method of claim 1, further comprising:

using in a high level language to generate said module.

3. A method for performing credential and condition assertion verification corresponding to a policy file, said policy file comprising credentials, conditions, and a hash value, said method comprising:

loading said policy file into an in-memory representation;

requesting loading an assertion verification dynamically loadable library, herein referred to as DLL, said DLL comprising a predetermined hash return function, principal/credential comparing functions, and protocol/condition comparing functions;

if said DLL exists;

loading said DLL into said memory; and

calling a predetermined function in said DLL for a return value, whereby said loading is complete if said returned value equals said hash value of said policy file;

if said DLL does not exist or if said loading said DLL is not complete;

invoking a code generation function for generating an updated assertion verification DLL from an assertion code file, said generated DLL corresponding to said policy file;

compiling and linking said assertion code file, thereby generating said updated assertion verification DLL corresponding to said policy file;

loading said updated assertion verification DLL into said memory; and

during runtime, calling said comparing functions in said DLL in memory as appropriate.

4. The method of claim 3, further comprising said code generation function:

adding header information to said assertion code file;

adding a predetermined function that returns said hash value of said policy file;

interating through said credentials of said loaded policy file for generating said principal/credential comparing functions; and

interating through said conditions of said loaded policy file for generating said protocol/condition comparing functions.

5. The method of claim 4, wherein said principal/credential comparing functions perform:

calling other credential comparison methods for any credentials used in definition of said each credential;

making calls to other comparison operations based on allowable operations of built-in types of a policy language corresponding to said policy file; and

combining results of above comparisons using logical operators.

6. The method of claim 4, wherein said protocol/condition comparing functions perform:

calling other condition comparison methods for any conditions used in definition of said each condition;

making calls to other comparison operations based on allowable operations of built-in types of a policy language corresponding to said policy file; and

combining results of above comparisons using logical operators.

7. The method of claim 3, during runtime, further comprising:

each time for deciding if a principal is described by a tested credential, computing a name of a comparison function of said principal/credential comparing functions, said comparison function name based on name of said tested credential;

calling said principal/credential comparison function, said principal/credential comparison function returning a value representing if said tested credential matches said principal;

each time for deciding if a protocol state satisfies a tested condition, computing a name of a comparison function of said protocol/condition comparing functions, said comparison function name based on name of said tested condition; and

calling said protocol/condition comparison function, said protocol/condition comparison function returning a value representing if said tested condition matches said protocol state.

8. An apparatus for performing credential and condition assertion verification corresponding to a policy file, said policy file comprising credentials, conditions, and a hash value, said apparatus comprising:

means for loading said policy file into an in-memory representation;

means for requesting loading an assertion verification dynamically loadable library, herein referred to as DLL, said DLL comprising a predetermined hash return function, principal/credential comparing functions, and protocol/condition comparing functions;

if said DLL exists;

means for loading said DLL into said memory; and

means for calling a predetermined function in said DLL for a return value, whereby said loading is complete if said returned value equals said hash value of said policy file;

if said DLL does not exist or if said loading said DLL is not complete;

means for invoking a code generation function for generating an updated assertion verification DLL from an assertion code file, said generated DLL corresponding to said policy file;

means for compiling and linking said assertion code file, thereby generating said updated assertion verification DLL corresponding to said policy file;

means for loading said updated assertion verification DLL into said memory; and

during runtime, means for calling said comparing functions in said DLL in memory as appropriate.

9. The apparatus of claim 8, said code generation function further comprising:

means for adding header information to said assertion code file;

means for adding a predetermined function that returns said hash value of said policy file; and

means for interating through said credentials of said loaded policy file for generating said principal/credential comparing functions; and

means for interating through said conditions of said loaded policy file for generating said protocol/condition comparing functions.

10. The apparatus of claim 9, said principal/credential comparing functions further comprising:

means for calling other credential comparison methods for any credentials used in definition of said each credential;

means for making calls to other comparison operations based on allowable operations of built-in types of a policy language corresponding to said policy file; and

means for combining results of above comparisons using logical operators.

11. The apparatus of claim 9, said protocol/condition comparing functions further comprising:

means for calling other condition comparison methods for any conditions used in definition of said each condition;

means for making calls to other comparison operations based on allowable operations of built-in types of a policy language corresponding to said policy file; and

means for combining results of above comparisons using logical operators.

12. The apparatus of claim 8, during runtime, further comprising:

each time for deciding if a principal is described by a tested credential, means for computing a name of a comparison function of said principal/credential comparing functions, said comparison function name based on name of said tested credential;

means for calling said principal/credential comparison function, said principal/credential comparison function returning a value representing if said tested credential matches said principal;

each time for deciding if a protocol state satisfies a tested condition, means for computing a name of a comparison function of said protocol/condition comparing functions, said comparison function name based on name of said tested condition; and

means for calling said protocol/condition comparison function, said protocol/condition comparison function returning a value representing if said tested condition matches said protocol state.