Redundancy detection and resolution and partial order dependency quantification in access control lists
View Patent ↗Aspects of the invention pertain to analyzing and modifying access control lists that are used in computer networks. Access control lists may have many individual entries that indicate whether information can be passed between certain devices in a computer network. The access control lists may include redundant or conflicting entries. An aspect of the invention converts an order-dependent control list into an order-free equivalent. Redundant entries are identified and removed without adversely affecting the access control list. Redundancy may be identified by evaluating the volume contraction ratio, which is the ratio of the volume of spin-off entries to specific original entry in the access control list. This ratio reflects the extent of order-dependent impact on that entry in a given access control list.
1. A method of handling redundant entries in an access control list usable in a computer network, the method comprising:
obtaining an access control list and storing it in memory, the access control list including a plurality of entries;
converting the plurality of entries from an order-dependent format into one or more order-free equivalents;
storing the order-free equivalents in the memory;
performing redundancy detection on the order-free equivalents to identify any redundant entries in the access control list;
removing the redundant entries to create a modified access control list for use by a firewall of the computer network; and
quantifying an extent of partial order dependence of each entry in the access control list, wherein performing the redundancy detection includes:
determining a volume of a given one of the plurality of entries in the access control list;
identifying a spinoff corresponding to the given entry;
determining a volume of a selected order-free equivalent corresponding to the spinoff; and
updating the volume of the corresponding given entry in the access control list using the volume of the selected order-free equivalent.
2. The method of claim 1 , wherein performing the redundancy detection includes determining a degree of alteration for each access control list entry.
3. The method of claim 2 , wherein determining the degree of alteration includes determining whether the spinoff is equal to zero, and if so, identifying the given entry as redundant.
4. The method of claim 2 , wherein if the spinoff is not equal to zero, then updating the volume of the selected order-free equivalent corresponding to the spinoff.
5. The method of claim 1 , wherein performing redundancy detection includes determining a scope contraction ratio for each access control list entry.
6. The method of claim 1 , further comprising the firewall executing the modified access control list to permit or deny access to network resources in accordance with the entries of the modified access control list.
7. A method of handling redundant entries in an access control list usable in a computer network, the method comprising:
obtaining an access control list and storing it in memory, the access control list including a plurality of entries;
converting the plurality of entries from an order-dependent format into one or more order-free equivalents;
storing the order-free equivalents in the memory;
performing redundancy detection on the order-free equivalents to identify any redundant entries in the access control list;
removing the redundant entries to create a modified access control list for use by a firewall of the computer network; and
quantifying an extent of partial order dependence of each entry in the access control list, wherein performing redundancy detection on the order-free equivalents to identify any redundant entries comprises:
determining whether a selected entry produces any spinoff entries after translation to a corresponding order-free equivalent; and
if no spinoff entries are produced, removing the selected entry from the access control list to form the modified access control list.
8. A computer-readable storage device having instructions stored thereon, the instructions, when executed by a processor, cause the processor to perform a method of handling redundant entries in an access control list usable in a computer network, the method comprising:
obtaining an access control list and storing it in memory, the access control list including a plurality of entries;
converting the plurality of entries from an order-dependent format into one or more order-free equivalents;
storing the order-free equivalents in the memory;
performing redundancy detection on the order-free equivalents to identify any redundant entries in the access control list;
removing the redundant entries to create a modified access control list for use by a firewall of the computer network; and
quantifying an extent of partial order dependence of each entry in the access control list, wherein performing the redundancy detection includes:
determining a volume of a given one of the plurality of entries in the access control list;
identifying a spinoff corresponding to the given entry;
determining a volume of a selected order-free equivalent corresponding to the spinoff; and
updating the volume of the corresponding given entry in the access control list using the volume of the selected order-free equivalent.
9. The computer-readable storage device of claim 8 , wherein the converting comprises modifying the scope of an entry in the plurality of entries if the entry overlaps with another entry.
10. An apparatus for handling redundant entries in an access control list usable in a computer network, the apparatus comprising:
memory for storing information regarding an access control list, the access control list including a plurality of entries; and
processor means for converting the plurality of entries from an order-dependent format into one or more order-free equivalents, storing the order-free equivalents in the memory, performing redundancy detection on the order-free equivalents to identify any redundant entries in the access control list, removing the redundant entries to create a modified access control list for use by a firewall of the computer network, and quantifying an extent of partial order dependence of each entry in the access control list, wherein the processor means performs the redundancy detection by further determining a scope contraction ratio for each access control list entry.
11. The apparatus of claim 10 , wherein the processor means performs the redundancy detection by determining a volume of a given one of the plurality of entries in the access control list, identifying a spinoff corresponding to the given entry, determining a volume of a selected order-free equivalent corresponding to the spinoff, and updating the volume of the corresponding given entry in the access control list using the volume of the selected order-free equivalent.
12. The apparatus of claim 11 , wherein the processor means performs the redundancy detection by further determining a degree of alteration for each access control list entry.
13. The apparatus of claim 12 , wherein the processor means determines the degree of alteration by determining whether the spinoff is equal to zero, and if so, identifying the given entry as redundant.
14. The apparatus of claim 12 , wherein if the spinoff is not equal to zero, then the processing means updates the volume of the selected order-free equivalent corresponding to the spinoff.
15. The apparatus of claim 10 , wherein the processor means performs the redundancy detection on the order-free equivalents to identify any redundant entries by:
determining whether a selected entry produces any spinoff entries after translation to a corresponding order-free equivalent; and
if no spinoff entries are produced, removing the selected entry from the access control list to form the modified access control list.