Back to results
US 7,031,297 B1Granted
Policy enforcement switching
AssigneeAvaya Communication Israel Ltd.
InventorsLior Shabtay, Yaron Nachman, Ofir Friedman, Eyal Amitai
Life of this patent
Estimating the term…
Abstract
A method of performing policy enforcement by a switch, including receiving a plurality of frames, examining at least some of the received frames to determine whether they require non-default policy enforcement according to pre-programmed policy rules which pertain to at least one protocol, and forwarding, with default policy handling, at least some of the received frames which belong to the protocol to which the rules pertain, regardless of the policy enforcement they require.
Claims57
A method of performing policy enforcement by a switch, comprising:
- receiving a plurality of frames;
- examining at least some of the received frames to determine whether they require non-default policy enforcement according to pre-programmed policy rules which pertain to at least one protocol;
- and
- forwarding, with default policy handling, at least some of the received frames which belong to the protocol to which the rules pertain, regardless of the policy enforcement they require.
1 more element
A method of performing policy enforcement by a switch, comprising:
- receiving a plurality of frames;
- comparing the values of one or more fields of at least some of the plurality of frames to entries of a list;
- determining whether to additionally analyze the frames for which no match was found in the comparison;
- additionally analyzing at least some of the frames for which no match was found in the comparison;
- and
- forwarding at least some of the frames for which no match was found in the comparison without performing additional analysis.
3 more elements
A switch for forwarding frames, comprising:
- at least one port which receives frames;
- and
- a table which includes entries which list policies of groups of frames, and indicates for at least one of the entries different behavior for leading and non-leading frames of sessions matching the entry.
A method of performing policy enforcement by a switch comprising:
- receiving a plurality of frames:
- comparing at least some of the received frames to a list of groups of frames and respective policies;
- and
- creating entries in the list for less than all of the compared frames for which no match was found in the comparison to the list;
- wherein creating entries in the list for less than all of the compared frames comprises creating entries only for frames received through physical ports connected directly to end-stations.
2 more elements
A method of performing policy enforcement by a switch, comprising:
- receiving a plurality of frames;
- comparing at least some of the received frames to a list of groups of frames and respective policies;
- and
- creating entries in the list for less than all of the compared frames for which no match was found in the comparison to the list:
- wherein creating entries in the list for less than all of the compared frames comprises not creating entries for at least some of the frames which require a policy which differs from a default policy only in quality of service.
2 more elements
A method of performing policy enforcement by a switch, comprising:
- receiving a plurality of frames;
- comparing at least some of the received frames to a list of groups of frames and respective policies;
- and
- creating entries in the list for less than all of the compared frames for which no match was found in the comparison to the list;
- wherein creating entries in the list for less than all of the compared frames comprises not creating entries for at least some of the frames which require a policy which differs from a default policy only in tasks other than quality of service.
2 more elements
A method of forwarding a frame by a switch, comprising:
- receiving a frame;
- checking one or more layer-3 or above fields of the frame for adherence to security rules;
- and
- performing layer-2 hardware switching of the frame, if the frame adheres to the security rules;
- wherein performing layer-2 switching of the frame comprises forwarding without changing a destination MAC address of the frame.
2 more elements
A method of forwarding a frame by a switch, comprising:
- receiving a frame;
- checking one or more layer-3 or above fields of the frame for adherence to security rules;
- and
- performing layer-2 hardware switching of the frame, if the frame adheres to the security rules;
- wherein performing layer-2 switching of the frame comprises forwarding without changing a source MAC address of the frame.
2 more elements
A switch for forwarding frames, comprising:
- at least one port which receives frames;
- a security unit which checks the received frames for adherence to security rules;
- and
- a forwarding unit which performs layer-2 switching of frames which adhere to the security rules;
- wherein the security unit comprises a policy table which has a plurality of entries to which the received frames are compared and the switch has at least one group of eight ports and the policy table has room for up to 256 entries for each group of eight physical ports of the switch.
2 more elements
A switch for forwarding frames, comprising:
- at least one port which receives frames;
- a policy table which includes entries, addressed by at least two key fields, for sessions which should receive non-default policy behavior;
- a policy unit which checks whether at least some of the received frames which do not have respective entries in the policy table require non-default policy behavior;
- and
- a forwarding unit which performs layer-2 switching of the at least some of the received frames in accordance with the policy behavior determined by the policy unit.
2 more elements
A method of updating a policy table of a switch, comprising:
- receiving a frame which is not directed to the switch;
- determining whether the received frame requires non-default policy enforcement;
- creating an entry in the policy table of the switch for the session to which the received frame belongs if the received frame requires non-default policy enforcement;
- and
- performing layer-2 switching of the received frame;
- wherein determining whether the received frame requires non-default policy enforcement comprises checking whether the frame requires sniffing.
3 more elements
A method of updating a policy table of a switch, comprising:
- receiving a frame which is not directed to the switch;
- creating an entry in the policy table of the switch, for the session to which the received frame belongs;
- and
- performing layer-2 switching of the received frame;
- wherein receiving the frame comprises receiving a frame which does not relate to the same session as addressed by any recently received control message.
2 more elements
Dependencies are inferred from the claim text.