Method and system for mapping between connectivity requests and a security rule set

A rule-set manager operating in conjunction with a security gateway operating in accordance with an ordered security rule-set, the rule-set manager capable of automatically managing the ordered security rule-set, the rule-set manager comprising a processor operatively coupled to a memory and to an interface, wherein:

• the memory is configured to store at least two different revisions of the rule-set corresponding to two different points-in-time the interface is configured to obtain and to store in the memory data characterizing a first set of combinations of values specified in a connectivity request;
• the processor is configured to:
• recognize, in each of the at least two different revisions of the rule-set, at least one rule which at least partially controls a traffic requested in the connectivity request, whereby each of the at least two different revisions of the rule-set gives rise, respectively, to at least one rule engaged with respect to the connectivity request, wherein a second set of combinations of values specified in the at least one engaged rule intersects with the first set of combinations of values specified in the connectivity request;
• evaluate by the processor, in each of the at least two revisions of the rule-set, a ratio between an un-shadowed volume corresponding to an intersection between the first set of combinations of values specified in the connectivity request and the second set of combinations of values specified in the at least one engaged rule and an un-shadowed allowable volume corresponding to the second set of combinations of values of the at least one engaged rule, to yield, for each of the at least two different revisions, a conformity ratio characterizing a degree of satisfaction of the connectivity request by the at least one engaged rule,
• identify, among the at least two revisions of the rule-set, at least one revision of the rule-set matching a predefined criterion with respect to the connectivity request, the predefined criteria related, at least, to a predefined value of the conformity ratio;
• and
• enable implementing on the security gateway the identified at least one revision of the rule-set.

A computer program product comprising a non-transitory computer useable medium having computer readable program code embodied therein for automatically managing an ordered security rule-set, the computer program product comprising:

• computer readable program code for recognizing, upon obtaining data characterizing a first set of combinations of values specified in a connectivity request and in each of at least two different revisions of the rule-set corresponding to two different points-in-time, at least one rule which at least partially controls a traffic requested in the connectivity request, wherein each of the at least two different revisions of the rule-set gives rise, respectively, to at least one rule engaged with respect to the connectivity request, wherein a second set of combinations of values specified in the at least one engaged rule intersects with the first set of combinations of values specified in the connectivity request;
• computer readable program code for evaluating by a processor, in each of the at least two revisions of the rule-set, a ratio between an un-shadowed volume corresponding to an intersection between the first set of combinations of values specified in the connectivity request and the second set of combinations of values specified in the at least one engaged rule and an un-shadowed allowable volume corresponding to the second set of combinations of values of the at least one engaged rule, to yield, for each of the at least two different revisions, a conformity ratio characterizing a degree of satisfaction of the connectivity request by the at least one engaged rule,
• computer readable program code for identifying, by the processor and among the at least two revisions of the rule-set, at least one revision of the rule-set matching a predefined criterion with respect to the connectivity request, the predefined criteria related, at least, to a predefined value of the conformity ratio;
• and
• computer readable program code for implementing the identified at least one revision of the rule-set.