EP0856974A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Session cache and rule caching method for a dynamic filter
Assignee: AT&T Inc
•
Filing: 1998-01-07
•
Granted: —
•
Expires: 2018-01-07
Abstract
Abstract A cache for use with a network filter that receives, stores and ejects local rule bases dynamically. The cache stores a rule that was derived from a rule base in the filter. The cache rule is associated in the cache with a rule base indicator indicating from which rule base the cache rule was derived, and a rule base version number indicating the version of the rule base from which the cache rule was derived. When the filter receives a packet, the cache is searched for a rule applicable to a received packet. If no such rule is found, the filter rule base is found, and an applicable rule is carried out and copied to the cache along with a rule base indicator and version number. If a cache rule is found, it is implemented if its version number matches the version number of the rule base from which it was derived. Otherwise, the cache rule is deleted. The cache provides an efficient way of accurately implementing the rules of a dynamic rule base without having to search the entire rule base for each packet. <IMAGE>
Inventors
- 👤 Daniel N. Zenchelsky
- 👤 Partha P. Dutta
- 👤 Thomas B. London
- 👤 Dalibor F. Vrsalovic
- 👤 Karl Andres Sül
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-11-01 04:21
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0254; H04L63/0263
Claims Analysis
Total Claims: 22
Claim 1
Independent Claim
62 words
A cache for a dynamic filter, the dynamic filter
including a rule base having at least one rule base
version number associated therewith, said cache comprising
a storage medium having stored therein a cache entry
having a cache key, a cache action, and a cache version
number, said cache entry derived from a rule in a rule
base of the dynamic filter.
Claim 2
Dependent Claim
28 words
The cache of claim 1, wherein said cache key is a
network source address, a network destination address, a
source port, a destination port, and a protocol
identifier.
Claim 3
Dependent Claim
13 words
The cache of claim 1, wherein said cache key is a
circuit identifier.
Claim 4
Dependent Claim
14 words
The cache of claim 1, wherein said cache action is
either PASS or DROP.
Claim 5
Dependent Claim
26 words
The cache of claim 1, wherein said cache entry
further includes a rule base indicator that indicates from
which rule base said session entry is derived.
Claim 6
Independent Claim
162 words
A method for providing peer-level access control on
a network that carries packets of information having
packet identification data, said method using a dynamic
filter having a cache that stores a cache entry having a
cache key, a cache version number, a cache action and a
rule base indicator, the cache entry derived from at least
one rule having a rule key and rule action in at least one
rule base, said method comprising: a. receiving a packet; b. searching the cache to identify a cache entry
having a cache key that corresponds to he
identification data of the received packet; c. if a corresponding cache entry is identified and
if the rule base indicator of the cache entry
indicates that the cache entry was derived from
a rule base having associated therewith a rule
base version number: i. determining if the cache entry version
number corresponds to the version number of
the rule base from which the cache entry
was derived.
Claim 7
Dependent Claim
45 words
The method of claim 6, step c further comprising the
step of: ii. carrying out the cache action of the
corresponding cache entry if the cache entry
version number corresponds to the version number
of the rule base from which the cache entry was
derived.
Claim 8
Dependent Claim
134 words
The method of claim 6, step c further comprising the
step of: ii. if the cache entry version number does not
correspond to the version number of the rule
base from which the cache entry was derived,
searching at least one rule base of the filter
to identify a corresponding rule that
corresponds to the identification data of the
received packet; iii. if a corresponding rule is identified, carrying
out the action of the corresponding rule; iv. storing a cache entry derived from the
corresponding rule, the cache entry comprising
the identification data of the received packet,
the action prescribed by the corresponding rule
and carried out on said packet in step iii, and
a rule base indicator that indicates the rule
base of the corresponding rule from which the
cache entry was derived.
Claim 9
Dependent Claim
46 words
The method of claim 8, further Comprising the step
of: v. If a rule base version number is associated with
the rule base of the corresponding rule, storing
the rule base version number as the cache entry
version number of the cache entry of step iv.
Claim 10
Dependent Claim
55 words
The method of claim 6, further comprising the step
of: ii. ejecting the corresponding cache entry from the
cache if the cache entry version number does not
correspond to the rule base version number of
the rule base of the rule from which the cache
entry was derived, as indicated by the rule base
indicator.
Claim 11
Dependent Claim
94 words
The method of claim 6, wherein if a corresponding
cache entry is identified and if the rule base indicator
indicates that the cache entry was derived from a rule of
a global rule base, further comprising the steps of: i. determining if the cache entry version
number corresponds to the global rule base
version number of the global rule base of
the rule from which the cache entry was
derived; ii. deleting all cache entries from the cache
if the cache entry version number does not
correspond to the global rule base version
number.
Claim 12
Dependent Claim
34 words
The method of claim 11, further comprising the step
of: iii. carrying out the cache action of the cache
entry if the cache entry version number
corresponds to the global rule base version
number.
Claim 13
Dependent Claim
154 words
A cache for a dynamic filter, the dynamic filter
including a rule in a rule base, said cache having a cache
entry, said cache comprising: a. means for receiving a packet having
identification data; b. means for searching said cache to identify a
cache entry that corresponds to the
identification data of the received packet; c. means for carrying out an action on the received
packet as prescribed by a corresponding cache
entry of step b whose version number corresponds
to the version number of the rule base from
which the cache entry was derived; d. means for carrying out an action on the received
packet as prescribed by a rule that corresponds
to the identification data of the received
packet if there is no corresponding cache entry
or if the version number of the cache entry does
not correspond to the version number of the rule
base from which the rule was derived.
Claim 14
Dependent Claim
34 words
The cache of claim 13, further comprising: e. means for ejecting a cache entry whose version
number does not correspond to the version number
of the rule base from which the entry was
derived.
Claim 15
Dependent Claim
51 words
The cache of claim 13, further comprising: e. means for storing a cache entry, the cache entry
comprising the identification data of the
received packet, the action carried out on said
packet in step d, and a rule base indicator that
indicates from which rule base the cache entry
was derived.
Claim 16
Dependent Claim
51 words
The cache of claim 15, further comprising: f. means for storing a rule base version number as
the cache entry version number of the cache
entry of step e, if a rule base version number
is associated with the rule base of the rule
from which the cache entry was derived.
Claim 17
Dependent Claim
114 words
Computer readable medium having a computer program
encoded thereon, comprising: a. a first portion of said medium having a first
program segment for receiving a packet having
identification data over a computer network; b. a second portion of said medium having a second
program segment for searching a cache to
identify a cache entry having a cache key that
corresponds to the identification data of the
received packet; c. a third portion of said medium having a third
program segment for determining if the cache
entry version number of a corresponding cache
entry identified by said second portion
corresponds to the version number of the rule
base from which the cache entry was derived.
Claim 18
Dependent Claim
63 words
The cache of claim 17, further comprising: d. a fourth portion of said medium having a fourth
program segment for carrying out the action of
a corresponding cache entry whose cache key
corresponds to the identification data of the
received packet and whose cache entry version
number corresponds to the version number of the
rule base from which the cache entry was
derived.
Claim 19
Dependent Claim
80 words
The cache of claim 18, further comprising: e. a fifth portion of said medium having a fifth
program segment for searching a filter rule base
to identify a rule having a rule key that
corresponds `to the identification data of the
received packet if no corresponding cache entry
was identified, or if the cache entry version
number of a corresponding cache entry does not
correspond to the version number of the rule
base from which the cache entry was derived.
Claim 20
Dependent Claim
36 words
The cache of claim 19, further comprising: f. a sixth portion of said medium having a sixth
program segment for carrying out the action of
a corresponding rule identified by said fifth
segment of said medium.
Claim 21
Dependent Claim
69 words
The cache of claim 20, further comprising: g. a seventh portion of said medium having a
seventh program segment for storing a cache
entry comprising the identification data of the
received packet, the action prescribed by a
corresponding rule and carried out by said sixth
portion of said medium, and a rule base
indicator indicating the rule base of the
corresponding rule from which the cache entry
was derived.
Claim 22
Dependent Claim
51 words
The cache of claim 21, further comprising: h. an eighth portion of said medium having an
eighth program segment for deleting a cache
entry from the cache when the cache entry
version number does not correspond to the
version number of the rule base from which the
cache entry was derived.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.