# US 2016/0366182 A1 · Evaluation system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366182 A1
- Document ID: US20160366182A1
- Status: Published application
- Kind: A1
- Application number: 15/067,484
- Filed: 2016-03-11
- Published: 2016-12-15
- Earliest claimed: 2015-06-10
- Assignees: Hitachi, Ltd.
- Applicants: Hitachi, Ltd.
- Inventors: Hiroki UCHIYAMA; Yusuke FUJIHARA; Toru OWADA; Makoto KAYASHIMA; Satoshi OHKUBO; Jun HAMANAKA
- Web page: https://patentgrep.com/patent/US20160366182A1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 67/125: involving control of end-device applications over a network
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An evaluation system includes a network device, a gateway device, a policy evaluation device, and first and second control devices. The network device copies a packet received from the first control device and transmits to the gateway device and the policy evaluation device. The gateway device receives the copied packet, performs a first filtering based on the policy stored in a first policy storage unit, transmits the packet to the second control device while storing the result of the first filtering, and transmits the result of the stored first filtering to the policy evaluation device. The policy evaluation device receives the copied packet, performs a second filtering based on the policy stored in a second policy storage unit, stores the result of the second filtering, and evaluates the policy stored in the second policy storage unit based on the results of the two filterings.

## Claims

### Claim 1

An evaluation system comprising a network device, a gateway device, a policy evaluation device, a first control device, and a second control device,
wherein the network device copies a packet received from the first control device and transmits to the gateway device and the policy evaluation device,
wherein the gateway device receives the copied packet, performing a first filtering process based on the policy stored in a first policy storage unit, transmitting the packet that has passed through the first filtering process to the second control device while storing the result of the first filtering process, and transmitting the result of the stored first filtering process to the policy evaluation device, and
wherein the policy evaluation device receives the copied packet, performing a second filtering process based on the policy stored in a second policy storage unit, storing the result of the second filtering process, and evaluating the policy stored in the second policy storage unit based on the result of the transmitted first filtering process and the result of the stored second filtering process.

### Claim 2 (depends on 1)

The evaluation system according to claim 1,
wherein the gateway device includes a first result, which is the accepting or blocking of the passage of the copied packet, into the result of the first filtering process, and
wherein the policy evaluation device includes a second result, which is the accepting or blocking of the passage of the copied packet, into the result of the second filtering process, and determines the difference between the first result and the second result to evaluate the policy stored in the second policy storage unit.

### Claim 3 (depends on 2)

The evaluation system according to claim 2,
wherein the gateway device includes a first processing time of the first filtering process into the result of the first filtering process, and
wherein the policy evaluation device includes a second processing time of the second filtering process into the result of the second filtering process, determining the difference between the first processing time and the second processing time, comparing the second processing time with a predetermined processing time as limitation, and evaluating the policy stored in the second policy storage unit.

### Claim 4 (depends on 3)

The evaluation system according to claim 3,
wherein the policy evaluation device generates an evaluation list by extracting the proposed measure according to the difference between the first result and the second result, or by extracting the proposed measure according to the result of comparing the second processing time with the predetermined processing time as limitation, and outputs the evaluation list.

### Claim 5 (depends on 4)

The evaluation system according to claim 4,
wherein the policy evaluation device transmits the policy stored in the second policy storage unit to the gateway device based on the result of the evaluation, and
wherein the gateway device stores the transmitted policy in the first policy storage unit.

### Claim 6 (depends on 5)

The evaluation system according to claim 5,
wherein the policy evaluation device extracts the result associated with the predetermined operation from the result of the transmitted first filtering process, extracting the result associated with the particular predetermined operation from the result of the stored second filtering process, and evaluating the policy stored in the second policy storage unit.

### Claim 7 (depends on 6)

The evaluation system according to claim 6,
wherein the policy evaluation device extracts the result associated with the predetermined operation by comparing the pattern of the packet included in the result of the transmitted first filtering process with the pattern of the packet used for the particular predetermined operation, extracting the result associated with the predetermined operation by comparing the pattern of the packet included in the result of the stored second filtering process with the pattern of the packet used for the particular predetermined operation, and extracting the result associated with the particular predetermined operation.

### Claim 8 (depends on 7)

The evaluation system according to claim 7,
wherein the policy evaluation device that, when it is determined that the result of the transmitted first filtering process includes the result associated with all the predetermined operations, evaluates the policy stored in the second policy storage unit.

### Claim 9 (depends on 8)

The evaluation system according to claim 8,
wherein the evaluation system further comprises a test server,
wherein the test server transmits a test packet to the policy evaluation device in response to a request of the policy evaluation device,
wherein the policy evaluation device comprises a first communication unit for performing communication with the network device and a second communication unit for performing communication with the test server, receiving the test packet through the second communication unit, performing the second filtering process based on the policy stored in the second policy storage unit, and storing the result of the second filtering process.

### Claim 10 (depends on 9)

The evaluation system according to claim 9,
wherein the policy evaluation device that, when it is determined that a predetermined evaluation period has elapsed, transmits the request to the test server.

### Claim 11

An evaluation system comprising a gateway device, a first control device, and a second control device,
wherein the gateway device includes:
a first communication unit for receiving a packet from the first control device;
a packet copying unit for copying the packet received in the first communication unit and transmitting to the gateway device and to the policy evaluation device;
a first policy storage unit in which the policy is stored;
a first filtering processing unit for performing a first filtering process on the copied packet based on the policy stored in the first policy storage unit;
a first communication unit for transmitting the packet that has passed through the first filtering process by the first filtering processing unit, to the second control device;
a first filter log storage unit in which the result of the first filtering process by the first filtering processing unit is stored;
a second policy storage unit in which the policy is stored;
a second filtering processing unit for performing a second filtering process on the copied packet based on the policy stored in the second policy storage unit;
a second filter log storage unit in which the result of the second filtering process by the second filtering processing unit is stored; and
a policy evaluation unit for evaluating the policy stored in the second policy storage unit, based on the result of the first filtering process stored in the first filter log storage unit, and based on the result of the second filtering process stored in the second filter log storage unit.

### Claim 12 (depends on 11)

The evaluation system according to claim 11,
wherein the first filter log storage unit stores the result of the first filtering process, including a first result which is the accepting or blocking of the passage of the copied packet,
wherein the second filter log storage unit stores the result of the second filtering process, including a second result which is the accepting or blocking of the passage of the copied packet, and
wherein the policy evaluation unit determines the difference between the first result and the second result to evaluate the policy stored in the second policy storage unit.

### Claim 13 (depends on 12)

The evaluation system according to claim 12,
wherein the first filter log storage unit stores the result of the first filtering process, including a first processing time of the first filtering process,
wherein the second filter log storage unit stores the result of the second filtering process, including a second processing time of the second filtering process, and
wherein the policy evaluation unit determines the difference between the first processing time and the second processing time, comparing the second processing time with a predetermined processing time as limitation, and evaluating the policy stored in the second policy storage unit.

### Claim 14 (depends on 13)

The evaluation system according to claim 13,
wherein the policy evaluation unit evaluates the policy stored in the second policy storage unit based on completion notice from the first filtering processing unit and the second filtering processing unit.

### Claim 15 (depends on 14)

The evaluation system according to claim 14, further comprising a test server,
wherein the test server transmits a test packet to the policy evaluation device in response to a request of the gateway device,
wherein the gateway device further includes a third communication unit for performing communication with the test server, and
wherein the second filtering processing unit performs the second filtering process on the packet received in the third communication unit based on the policy stored in the second policy storage unit.