System and method providing automatic pushdown hierarchical filters

Patent metadata

Field	Value
Publication number	US-9825960-B2
Application number	US-201514724874-A
Country	US
Kind code	B2
Filing date	May 29, 2015
Priority date	May 29, 2015
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

Systems, methods, and other embodiments are disclosed that are configured to generate a hierarchy of access rules in a protocol stack. Access rules corresponding to a first layer in a protocol stack are analyzed. The access rules determine, at the first layer, whether network sources are permitted access to a computing device. Dependent access rules are generated based at least in part on a combination of the access rules from the first layer. The dependent access rules are pushed down to a second layer in the protocol stack by implementing the dependent access rules at the second layer to determine, at the second layer, whether the network sources are permitted access to the computing device.

First claim

What is claimed is:

1. A method implemented by a computing device including at least a processor, the method comprising:
analyzing, by the processor, access rules corresponding to a first layer in a protocol stack, wherein the protocol stack includes a plurality of layers, wherein the access rules determine, at the first layer, whether network sources are permitted access to the computing device, wherein a first access rule is maintained for the first layer;
generating, by the processor, a filter including dependent access rules based at least in part on combining a plurality of the access rules from the first layer, wherein the dependent access rules include one or more of the same access rules as the plurality of access rules, wherein a first dependent access rule is derived from the first access rule;
assigning, by the processor, the filter including the dependent access rules to a second layer in the protocol stack by implementing the filter including the dependent access rules at the second layer to determine, at the second layer, whether the network sources are permitted access to the computing device;
in response to receiving a packet from a network resource at the second layer, using the first dependent access rule of the filter at the second layer to permit or deny the packet at the second layer; and
in response to receiving the packet at the first layer, using the first access rule to permit or deny the packet at the first layer,
wherein the dependent access rule of the filter is used at the second layer for filtering the packet before the packet is delivered to the first layer.

2. The method of claim 1 , further comprising:
grouping a first set of the access rules into a first group based upon the first set of access rules comprising inclusion rules;
grouping a second set of access rules into a second group based upon the second set of access rules comprising exclusion rules; and
integrating the first set of the access rules and the second set of the access rules to create dependent access rules derived from the access rules of the first layer.

3. The method of claim 1 , wherein the first layer comprises at least one first layer feature, and the second layer comprises at least one second layer feature.

4. The method of claim 3 , wherein the at least one first layer feature comprises at least one service, and the at least one second layer feature comprises at least one socket.

5. The method of claim 1 , wherein analyzing the access rules includes:
sorting the access rules of the first layer according to a layer feature and an access type to form groups of sorted rules;
performing a union operation on at least two groups of the sorted rules to generate data identifying allowed network sources to be allowed access to the computing device at the second layer; and
performing an intersection operation on at least two other groups of the sorted rules to generate data identifying denied network sources to be denied access to the computing device at the second layer.

6. The method of claim 5 , wherein the assigning includes integrating the data identifying the allowed network sources with the data identifying the denied network sources to form an access filter for the second layer.

7. The method of claim 1 , further comprising:
analyzing the dependent access rules corresponding to the second layer in the protocol stack, wherein the dependent access rules determine, at the second layer, whether the network sources are permitted access to the computing device;
generating second dependent access rules based at least in part on a combination of the dependent access rules from the second layer; and
assigning the second dependent access rules to a third layer in the protocol stack by implementing the second dependent access rules at the third layer to determine, at the third layer, whether the network sources are permitted access to the computing device.

8. The method of claim 7 , wherein the first layer is an application layer, the second layer is a session layer, and the third layer is a network layer.

9. The method of claim 7 , wherein analyzing the dependent access rules includes:
sorting the dependent access rules of the second layer according to a layer feature and an access type to form groups of sorted rules;
performing a union operation on at least two groups of the sorted rules to generate data identifying allowed network sources to be allowed access to the computing device at the third layer; and
performing an intersection operation on at least two other groups of the sorted rules to generate data identifying denied network sources to be denied access to the computing device at the third layer.

10. The method of claim 9 , wherein assigning the second dependent access rules includes integrating the data identifying the allowed network sources with the data identifying the denied network sources to form an access filter for the third layer.

11. A computing system, comprising:
at least one processor;
at least one memory;
a non-transitory computer-readable medium, wherein the at least one memory and the non-transitory computer-readable medium are connected to the processor via at least one communication channel;
an inclusion module, including instructions stored in the non-transitory computer-readable medium that when executed by the at least one processor cause the processor to generate data identifying allowed network sources to be allowed access to the computing system from access rules assigned to a first layer in the protocol stack, wherein a first access rule is maintained for the first layer;
an exclusion module, including instructions stored in the non-transitory computer-readable medium that when executed by the at least one processor cause the processor to generate data identifying denied network sources to be denied access to the computing system from the access rules assigned to the first layer in the protocol stack; and
an integration module, including instructions stored in the non-transitory computer-readable medium that when executed by the at least one processor cause the processor to integrate the data identifying the allowed network sources with the data identifying the denied network sources to form an access filter for the computing system, and to assign the access filter to a second layer in the protocol stack, wherein the first layer is above the second layer in the protocol stack, wherein a first dependent access rule is derived from the first access rule for inclusion within the access filter,
wherein the access filter uses the first dependent access rule at the second layer to permit or deny a packet at the second layer that was received from a network resource,
wherein the first access rule is used at the first layer to permit or deny the packet at the first layer, and
wherein the dependent access rule of the access filter is used at the second layer for filtering the packet before the packet is delivered to the first layer.

12. The computing system of claim 11 , further comprising a database device configured to store at least the access rules assigned to the first layer in the protocol stack.

13. The computing system of claim 11 , further comprising a rule sorting module, including instructions stored in the non-transitory computer-readable medium, configured to sort the access rules for the first layer in the protocol stack according to a layer feature and an access type to form groups of sorted rules.

14. The computing system of claim 13 , wherein the inclusion module is configured to perform a union operation on at least two groups of the sorted rules to generate the data id

Assignees

• Oracle Int Corp

Inventors

• Khan Feroz Alam
• Mathur Bhaskar
• Patel Kant C

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/16

  Implementing security features at a particular protocol layer · CPC title

• H04L63/0263

  Rule management · CPC title