Rule engine

Abstract

A rule engine for a computer network traverses a rule mesh having path nodes and path edges in form of a tree part and a graph part. The rule engine evaluates data packets flowing through a network to determine rules matched for every packet. Subsequent packets having same expression values as an already checked packet are not rechecked against the same nodes in the rule mesh through the use of a session entry. The rule engine performs a search on every path node of rule mesh to determine the next path edge to traverse. A Tree-Id and Rule Confirmation Bitmap that are indicative of path traversed and rules matched by a packet are generated at the end of rule mesh traversal. These are appended in the packet extension for subsequent modules of Policy Agent.

Description

CROSS REFERENCE TO RELATED APPLICATION [0001] This application is a continuation application of U.S. application Ser. No. 10 / 264,803, filed Oct. 4, 2002, entitled, ‘Rule Engine’ by Parekh, et alBACKGROUND [0002] The invention relates to integrated policy enforcement systems for computer networks. In particular the invention provides a method and system for evaluating data packets against configured rules and mapping the packets to the rules that have matched for an integrated policy enforcement system. [0003] The emergence and advancement of networks and networking technologies has revolutionized information exchange between organizations. A network may be defined as a group of computers and associated devices that are connected via communication links. These communication links can be wireless communication links. All the devices connected over a network are capable of communicating (i.e. sending and receiving information) with other devices connected to the network. [0004] A netwo...

AI Technical Summary

Benefits of technology

[0018] Still another object of the present invention is to improve efficiency of rule mesh traversal for subsequent packets of a session by ensuring that subsequent packets having same expression values as an already checked packet are not rechecked against same nodes.

Problems solved by technology

Such information exchange poses a security risk as the organization's intranet becomes accessible to outsiders.

Illegitimate users can change data, gain unauthorized access to data, destroy data, or make unauthorized use of computer resources.

These security issues require organizations to implement safeguards that ensure security of their networks.

Hence, the performance of a firewall suffers with an increase in the number of rules, because each data packet has to be checked against an increased number of rules.

Moreover, an increase in the volume of network traffic increases the number of packets that have to be checked against the rules per unit time.

Due to these limitations, conventional firewall systems are capable of implementing only a limited number of rules and can handle only a limited volume of network traffic.

Though, most networks are protected by firewalls but firewalls do not provide a complete security solution.

Moreover, a firewall alone cannot provide information regarding any attack that is successfully repelled.

This reprocessing will make the above system inefficient if there are a large number of policies to be implemented or if the volume of network traffic increases.

Images