US 6,715,081 B1 · Security rule database searching in a network security environment

Abstract

Ipsec rules are searched in order from rules containing the most specificity to those containing the least specificity of attributes. The static rules include placeholders for sets of dynamic rules. Dynamic rules are searched only if a placeholder is the first matching rule in the static table. Sets of dynamic rules are partitioned into separate groups. Within each group there is no rule order dependence. Each such group is searched with an enhanced search mechanism, such as a search tree. For connection oriented protocols, security rule binding information is stored in association with the connection. This allows the searching of the rules to be performed only when a connection is first established. If a static or dynamic rule is changed during a connection, a search is repeated. For selected connectionless protocols, packets are treated as if they were part of a simulated connection. A pseudo-connection memory block is allocated with the creation of each socket and Ipsec security binding information is stored in the pseudo-connection memory block on a first packet.

Claims16

Dependent claims

A method of searching a database of security rules for a match between attributes specified in the rules and the corresponding attributes in a packet, comprising

arranging the database into a set of relatively stable static rules and one or more sets of dynamic security rules, wherein a static rule can be a placeholder for a set of dynamic rules, and wherein the rule including placeholders for dynamic sets of rules are arranged in the order of most specific attributes to least specific attributes,
partitioning a set of dynamic rules into groups according to attributes such that within each group there is no order dependency of the rules,
representing each group of dynamic rules by an order independent search mechanism,
searching the static rules of the database for the first static rule having attributes that match the corresponding attributes of the packet,
determining if the matching static rule is a placeholder for a set of dynamic rules,
if the matching static rule is a placeholder for a set of dynamic rules, searching the groups of dynamic rules associated with the matching static rule using the order independent search mechanism for a match with the packet attributes, and
applying security processing to the packet as specified by a matching static or dynamic rule.

4 more elements

Apparatus for searching a database of security rules for a match between attributes specified in the rules and the corresponding attributes in a packet, comprising

a database arranged into a set of relatively stable static rules and one or more sets of dynamic security rules, wherein a static rule can be a placeholder for a set of dynamic rules, and wherein the rules including placeholders for dynamic sets of rules are arranged in the order of most specific attributes to least specific attributes, and further wherein each set of dynamic rules is partitioned into groups according to attributes such that within each group there is no order dependency of the rules, and further wherein each group of dynamic rules is represented by an order independent search mechanism,
means for searching the static rules of the database for the first static rule having attributes that match the corresponding attributes of the packet,
means for determining if the matching static rule is a placeholder for a set of dynamic rules,
means responsive to a determination that the matching static rule is a placeholder for a set of dynamic rules for searching the groups of dynamic rules associated with the matching static rule using the order independent search mechanism for a match with the packet attributes, and
means for applying security processing to the packet as specified by a matching static or dynamic rule.

2 more elements

A storage medium containing stored executable computer instructions for controlling a computer to search a database of security rules for a match between attributes specified in the rules and the corresponding attributes in a packet, the stored computer instructions comprising

a first code segment for arranging the database into a set of relatively stable static rules and one or more sets of dynamic security rules, wherein a static rule can be a placeholder for a set of dynamic rules, and wherein the rules including placeholders for dynamic sets of rules are arranged in the order of most specific attributes to least specific attributes,
a second code segment for partitioning a set of dynamic rules into groups according to attributes such that within each group there is no order dependency of the rules,
A third code segment for representing each group of dynamic rules by an order independent search mechanism,
a fifth code segment for searching the static rules of the database for the first static rule having attributes that match the corresponding attributes of the packet,
a sixth code segment for determining if the matching static rule is a placeholder for a set of dynamic rules,
a seventh code segment responsive to a determination that the matching static rule is a placeholder for a set of dynamic rules for searching the groups of dynamic rules associated with the matching static rule using the order independent search mechanism for a match with the packet attributes, and
an eighth code segment for applying security processing to the packet as specified by a matching static or dynamic rule.

4 more elements

A carrier wave embodying a computer data signal containing executable computer instructions for controlling a computer to search a database of security rules for a match between attributes specified in the rules and the corresponding attributes in a packet, the computer instructions comprising

a first code segment for arranging the database into a set of relatively stable static rules and one or more sets of dynamic security rules, wherein a static rule can be a placeholder for a set of dynamic rules, and wherein the rules including placeholders for dynamic sets of rules are arranged in the order of most specific attributes to least specific attributes,
a second code segment for partitioning a set of dynamic rules into groups according to attributes such that within each group there is no order dependency of the rules,
a third code segment for representing each group of dynamic rules by an order independent search mechanism,
a fifth code segment for searching the static rules of the database for the first static rule having attributes that match the corresponding attributes of the packet,
a sixth code segment for determining if the matching static rule is a placeholder for a set of dynamic rules,
a seventh code segment responsive to a determination tat the matching static rule is a placeholder for a set of dynamic rules for searching the groups of dynamic rules associated with the matching static rule using the order independent search mechanism for a match with the packet attributes, and
an eighth code segment for applying security processing to the packet as specified by a matching static or dynamic rule.

4 more elements

Dependencies are inferred from the claim text.

Security rule database searching in a network security environment

Life of this patent

Security rule database searching in a network security environment

Life of this patent

Abstract

Claims16