Method and framework for integrating a plurality of network policies
View Patent ↗A method and system is disclosed for managing and implementing a plurality of network policies in a network device. Each of the plurality of policies are defined by one or more filters. The filters are installed in a policy engine. A layer identifies the network policy to be applied to a packet by sending a request to the policy engine. The policy engine then returns the policy to the requesting layer. The method and system may be used to implement a programmable, host-based, distributed, authenticating firewall that enables security and other policies to be applied at several protocol layers.
1. A method for determining a plurality of network policies to be applied to a packet at a first layer process from a plurality of layer processes, comprising:
identifying, by the first layer process, a set of parameters associated with the packet received from a second layer process from the plurality of layer processes;
sending, by the first layer process, a request to identify the network policies to be applied to the packet; the request including the parameters associated with the packet and parameters associated with the first layer process;
receiving, at the first layer process, a response that includes a first policy value identifying a first network policy and a second policy value identifying a second network policy, wherein the first policy value comprises an action and the second policy value comprises a policy context; and
if the action is an instruction to allow the packet to continue network traversal, processing the packet according to a protocol implemented by the first layer process and sending the packet to a third layer process from the plurality of layer processes.
2. The method of claim 1 , wherein the first layer process is a user layer.
3. The method of claim 1 , wherein the first layer process is a kernel layer.
4. The method of claim 1 , wherein the first network policy is a firewall policy and the first policy value is an action value.
5. The method of claim 4 , wherein the action value is permit indicating that the packet is permitted to further traverse a network or block indicating that the packet is blocked from further network traversal.
6. The method of claim 1 , wherein the second network policy is a security policy that defines key negotiation protocol parameters.
7. A method for installing and maintaining a plurality of network policies in a policy engine associated with a network device, comprising:
receiving a new filter to be installed into the policy engine including a plurality of filters, wherein each filter comprises a set of filter conditions, a first policy value identifying a first network policy, and a second policy value identifying a second network policy;
comparing the new filter to each filter from the plurality of filters;
if installing the new filter results in a conflict between the new filter and at least one filter from the plurality of filters, resolving the conflict;
installing the new filter; and
if the new filter comprises the first network policy being a firewall policy and the first policy value being a callout to at least one callout module, notifying the at least one callout module about the new filter.
8. The method of claim 7 , wherein the first network policy is a firewall policy and the second network policy is a security policy.
9. The method of claim 8 , wherein the security policy is an IPSec policy.
10. The method of claim 8 , wherein the first policy value is an action and the second policy value is a policy context.
11. The method of claim 7 , further comprising: identifying, by the policy engine, a matching filter from the plurality of filters that includes filter conditions matching a packet to which the plurality of network policies is to be applied; and executing at least the first network policy on the packet.
12. The method of claim 7 , wherein the step of installing the new filter is executed in an operating system user mode.
13. The method of claim 7 , wherein the step of installing the new filter is executed in an operating system kernel mode.
14. The method of claim 7 , wherein the plurality of network policies include a firewall policy, a security policy, and a quality of service policy.
15. The method of claim 7 , wherein the set of filter conditions is dynamically configurable such that filter conditions are added or deleted according to desired policy.