Efficient evaluation of rules
AssigneeSecurity, Inc.
InventorsGeoffrey Cooper, Kieran G. Sherlock, Bob Shaw, Luis Valente
Life of this patent
Estimating the term…
Abstract
A method and apparatus uses a proprietary algorithm for organizing network security policy rules in a way that minimizes the number of rules considered when determining the set of rules applicable to a given protocol event.
Claims12
A method for a policy engine to organize policy rules in a way to effect an efficient evaluation of a protocol event, said protocol event having an agent descriptor, a protocol name, and a protocol action, said method comprising:
- providing a first associative array having a first key and a first value, wherein said first key corresponds to said agent descriptor and said first value is a reference to a second associative array having a second key and a second value;
- providing said second associative array, wherein said second key corresponds to said protocol name and said second value is a reference to a third associative array having a third key and a third value;
- providing said third associative array, wherein said third key corresponds to said protocol action and said third value is a reference to a fourth associative array having a fourth key and a fourth value;
- and
- providing said fourth associative array, wherein said fourth key corresponds to any of said rules and said fourth value is a rank number associated with said any rule.
An apparatus for a policy engine to organize policy rules in a way to effect an efficient evaluation of a protocol event, said protocol event having an agent descriptor, a protocol name, and a protocol action, said apparatus comprising:
- means for providing a first associative array having a first key and a first value, wherein said first key corresponds to said agent descriptor and said first value is a reference to a second associative array having a second key and a second value;
- means for providing said second associative array, wherein said second key corresponds to said protocol name and said second value is a reference to a third associative array having a third key and a third value;
- means for providing said third associative array, wherein said third key corresponds to said protocol action and said third value is a reference to a fourth associative array having a fourth key and a fourth value;
- and
- means for providing said fourth associative array, wherein said fourth key corresponds to any of said rules and said fourth value is a rank number associated with said any rule.
Dependencies are inferred from the claim text.