System and method for dynamic macro placement of IP connection filters

A system for dynamically placing a connection filter within a set of filters, comprising:

• a first computer useable medium having computer readable code module for initializing a filter set to include a policy filter;
• a second computer useable medium having computer readable program code module for matching said connection filter sequentially against filters within said set of filters;
• and
• a third computer useable medium having computer readable program code module, responsive to finding a match of said connection filter with a matching policy filter, for placing said connection filter in said set of filters before said matching policy filter.

Method for dynamically ordering filters within a set of filters, comprising the steps of:

• initializing a filter set to include a plurality of policy filters, the ordering of said plurality of policy filters determining the responder-mode order of search for data protection policies;
• matching a connection filter sequentially against filters within said set of filters;
• and
• responsive to finding a match of said connection filter with a matching policy filter, placing said connection filter in said set of filters before said matching policy filter.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by a machine to perform method steps for dynamically placing a connection filter within a set of filters, said method steps comprising:

• initializing a filter set to include a policy filter;
• matching said connection filter sequentially against filters within said set of filters;
• and
• responsive to finding a match of said connection filter with a matching policy filter, placing said connection filter in said set of filters before said matching policy filter.

An article of manufacture comprising:

• a computer useable medium having computer readable program code means embodied therein for dynamically placing a connection filter within a set of filters, the computer readable program means in said article of manufacture comprising:
• computer readable program code means for causing a computer to effect initializing a filter set to include a policy filter;
• computer readable program code means for causing a computer to effect matching said connection filter sequentially against filters within said set of filters;
• and
• computer readable program code means for causing a computer to effect responsive to finding a match of said connection filter with a matching policy filter, placing said connection filter in said set of filters before said matching policy filter.

A system for dynamically placing a connection filter within a set of filters, comprising:

• means for initializing a filter set to include a policy filter;
• means for matching said connection filter sequentially against filters within said set of filters;
• means, responsive to finding a match of said connection filter with a matching policy filter, for placing said connection filter in said set of filters before said matching policy filter;
• means for testing said datagram sequentially against filters in said set of filters;
• means, responsive to first finding a matching policy filter, for rejecting said datagram;
• and
• means, responsive to first finding a matching connection filter, for executing said datagram against said matching connection filter.