# US 2017/0288968 A1 · Compiling network policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0288968 A1 - Document ID: US20170288968A1 - Status: Published application - Kind: A1 - Application number: 15/507,489 - Filed: 2015-03-23 - Published: 2017-10-05 - Earliest claimed: 2015-03-23 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Duane Edward Mentze; Charles F. CLARK; Shaun WACKERLY - Web page: https://patentgrep.com/patent/US20170288968A1 ## CPC - H04L 12/6418: {Hybrid transport} - H04L 41/0894: Policy-based network configuration management - H04L 41/20: {Network management software packages} - H04L 69/03: {Protocol definition or specification (protocol conformance testing H04L1/244)} - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Example implementations relate to compiling network policies. In an example, a method includes dividing a plurality of network policies into an exclusive policy group and a non-exclusive policy group, compiling the policies in the exclusive policy group into a first plurality of orthogonal policies, compiling the policies in the non-exclusive policy group into at least a second plurality of orthogonal policies, where the compiling of each policy group occurs separately. ## Claims ### Claim 1 A method for compiling network policies, comprising, by a processor: dividing a plurality of network policies into an exclusive policy group and a non-exclusive policy group; compiling the policies in the exclusive policy group into a first plurality of orthogonal policies; compiling the policies in the non-exclusive policy group into at least a second plurality of orthogonal policies, the compiling of each policy group occurring separately. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating a first plurality of protocol-specific instructions to implement the first plurality of orthogonal policies; and generating a second plurality of protocol-specific instructions to implement the second plurality of orthogonal policies. ### Claim 3 (depends on 2) The method of claim 2, further comprising: instructing a network device to create a first plurality of entries in a table of a packet processing pipeline of the network device according to the first plurality of protocol-specific instructions; and instructing the network device to create a second plurality of entries in the table according to the second plurality of protocol-specific instructions, such that the first plurality of entries are given priority over the second plurality of entries in the packet processing pipeline. ### Claim 4 (depends on 3) The method of claim 3, wherein the processor is part of a controller in a software defined network, the network device is a SDN-enabled switch, and the controller communicates with the network device in accordance with the OpenFlow protocol. ### Claim 5 (depends on 1) The method of claim 1, further comprising: dividing the policies in the non-exclusive policy group into an inert policy group and a non-inert policy group; compiling the policies in the inert policy group into the second plurality of orthogonal policies; and compiling the policies in the non-inert policy group into a third plurality of orthogonal policies, the compiling of each group occurring separately. ### Claim 6 (depends on 5) The method of claim 5, comprising: generating a first plurality of protocol-specific instructions to implement the first plurality of orthogonal policies; generating a second plurality of protocol-specific instructions to implement the second plurality of orthogonal policies; and generating a third plurality of protocol-specific instructions to implement the third plurality of orthogonal policies. ### Claim 7 (depends on 6) The method of claim 6, comprising: instructing a network device to create a first plurality of entries in a first table of a packet processing pipeline of the network device according to the first plurality of protocol-specific instructions; instructing the network device to create a second plurality of entries in a second table of the packet processing pipeline according to the second plurality of protocol-specific instructions; and instructing the network device to create a third plurality of entries in a third table of the packet processing pipeline according to the third plurality of protocol-specific instructions, such that the first plurality of entries are given priority over the second plurality of entries, and the second plurality of entries are given priority over the third plurality of entries. ### Claim 8 (depends on 7) The method of claim 7, wherein if a packet matches an entry in the first table in the packet-processing pipeline, the network device does not attempt to match the packet to an entry in the second table or the third table. ### Claim 9 (depends on 7) The method of claim 7, wherein if a packet does not match an entry in the first table in the packet-processing pipeline, the network device attempts to match the packet both to an entry in the second table and to an entry in the third table. ### Claim 10 A controller in a software defined network (SDN), comprising: a grouping module to group a plurality of network policies into an exclusive policy group and a non-exclusive policy group; and a policy compilation module to: compile the policies in the exclusive policy group into a first plurality of orthogonal policies, and compile the policies in the non-exclusive policy group into at least a second plurality of orthogonal policies, the policy compilation module performing the compilation of each policy group separately. ### Claim 11 (depends on 10) The controller of claim 10, the grouping module to group the policies in the non-exclusive policy group into an inert policy group and a non-inert policy group, the policy compilation module to compile the policies in the inert policy group into the second plurality of orthogonal policies and compile the policies in the non-inert policy group into a third plurality of orthogonal policies. ### Claim 12 (depends on 11) The controller of claim 11, wherein an exclusive policy is a policy that cannot be combined with another policy, an inert policy is a policy that does not change a packet the policy is applied to or alter the packet's delivery to an intended destination, and a non-inert policy is a policy that does change a packet the policy is applied to or alter the packet's delivery to an intended destination. ### Claim 13 (depends on 10) The controller of claim 10, wherein an orthogonal policy is a policy generated from one or more policies in the plurality of network polices that does not conflict with any other orthogonal policy, such that polices to be applied to any single packet would be implemented by a single orthogonal policy. ### Claim 14 (depends on 10) The controller of claim 10, wherein at least one of the plurality of network policies is received from an SDN application executing in the SDN. ### Claim 15 (depends on 10) The controller of claim 10, further comprising an instruction module to instruct a network device to add flow entries in accordance with the first plurality of protocol-specific instructions and second plurality of protocol-specific instructions in such a way that the network device attempts to match a received packet to a flow entry in accordance with the first plurality of protocol-specific instructions before the network device attempts to match the received packet to a flow entry in accordance with the second plurality of protocol-specific instructions. ### Claim 16 A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to: divide a plurality of network policies into an exclusive policy group and a non-exclusive policy group; compile the policies in the exclusive policy group into a first plurality of orthogonal policies; and compile the policies in the non-exclusive policy group into at least a second plurality of orthogonal policies, the compiling of each policy group occurring separately.