System and method for modeling a networking device policy
View Patent ↗Implementations of the present disclosure involve a system and/or method for modeling a networking device policy or set of rules and/or transforming a networking device policy model into a set of comprehensible rules for presentation to a manager of the device. In one embodiment, the system and/or method includes converting one or more rules of the firewall device into a string of representative bits, creating a binary decision diagram from the converted rules of the firewall policy, transforming the binary decision diagram into a ternary tree diagram and analyzing the ternary tree diagram to condense the firewall policy into one or more rules comprehensible by a user of the firewall.
1. A method for representing a networking device, the method comprising:
modeling at least one network device policy rule of a network device policy, utilizing at least one processor, as at least one bit string comprising a plurality of bits representing the at least one network device policy rule;
creating a first hierarchical decision diagram comprising a plurality of nodes and a plurality of connections between the plurality of nodes from the at least one bit string wherein each of the plurality of nodes of the first hierarchical decision diagram represents a bit of the plurality of bits of the at least one bit string;
translating the first hierarchical decision diagram into a second hierarchical decision diagram;
obtaining a plurality of numerical intervals defined by the second hierarchical decision diagram, the plurality of numerical intervals corresponding to paths through the second hierarchical decision diagram defining a portion of a solution space of a network device policy by traversing the second hierarchical decision diagram from a first root node of the second hierarchical decision diagram to a plurality of end nodes of the second hierarchical decision diagram, wherein the plurality of numerical intervals each comprise bit string values defining the paths through the second hierarchical decision diagram from the first root node to each of the plurality of end nodes;
converting the plurality of numerical intervals into one or more network device policy rules based at least on a heuristically defined transition point between a first portion of the solution space of the network device policy and a second portion of the solution space of the network device policy, wherein the heuristically defined transition point occurs in the second hierarchical decision diagram between the first root node and the plurality of end nodes of the second hierarchical decision diagram as the second hierarchical decision diagram is traversed, wherein converting the plurality of numerical intervals into one or more network device policy rules comprises converting the plurality of bit string values defined by the second hierarchical decision diagram into a plurality of decimal intervals and combining at least two of the plurality of decimal intervals when the at least two decimal intervals are the same;
providing the one or more network device policy rules as a policy rule set; and
applying the policy rule set to the networking device as a de-correlated device policy.
2. The method of claim 1 wherein the first hierarchical decision diagram is a binary decision diagram representing the network device policy.
3. The method of claim 2 wherein the second hierarchical decision diagram is a ternary tree diagram representing the network device policy.
4. The method of claim 3 wherein the at least one network device policy rule comprises an action portion and a predicate portion and the at least one bit string represents the value of the predicate portion of the at least one network device policy rule.
5. The method of claim 4 wherein the predicate portion of the at least one network device policy rule comprises at least one of a source address, a destination address and a protocol indicator.
6. The method of claim 5 wherein modeling the predicate portion of the at least one network device policy rule into the at least one bit string comprises converting the source address value into a first bit string, converting the destination address into a second bit string and converting the protocol indicator into a third bit string.
7. The method of claim 4 wherein modeling the network device policy comprises creating the binary decision diagram from the at least one bit string representing the value of the predicate portion of the at least one network device policy rule.
8. A system for representing a networking device policy rule set, the system comprising:
a processing device; and
a computer-readable medium with one or more executable instructions stored thereon, wherein the processing device executes the one or more instructions to perform the operations of:
translating at least one network device policy rule of a network device policy of a networking device into at least one bit string, the at least one bit string comprising a plurality of bits representing the at least one network device policy rule;
creating a first hierarchical decision diagram comprising a plurality of nodes and a plurality of connections between the plurality of nodes from the at least one bit string, the first hierarchical decision diagram being a binary decision diagram with each of the plurality of nodes of the first hierarchical decision diagram representing a bit of the plurality of bits of the at least one bit string;
converting the first hierarchical decision diagram into a second hierarchical decision diagram;
obtaining a plurality of numerical intervals defined by the second hierarchical decision diagram by traversing the second hierarchical decision diagram from a first root node of the second hierarchical decision diagram to a plurality of end nodes of the second hierarchical decision diagram, the plurality of numerical intervals corresponding to paths through the second hierarchical decision diagram from the first root node to the at least one end node and comprising bit string values defining the paths through the second hierarchical decision diagram from the first root node to each of the plurality of end nodes;
converting the plurality of numerical intervals into one or more network device policy rules based at least on a heuristically defined transition point between a first portion of the solution space of the network device policy and a second portion of the solution space of the network device policy, wherein the heuristically defined transition point occurs in the second hierarchical decision diagram between the first root node and the plurality of end nodes of the second hierarchical decision diagram as the second hierarchical decision diagram is traversed, wherein converting the plurality of numerical intervals into one or more network device policy rules comprises converting the plurality of bit string values defined by the second hierarchical decision diagram into a plurality of decimal intervals and combining at least two of the plurality of decimal intervals when the at least two decimal intervals are the same;
providing the one or more network device policy rules as a policy rule set, wherein the one or more network policy rules are derived from the one or more numerical intervals; and
applying the policy rule set to the networking device as a de-correlated device policy.
9. The system of claim 8 wherein the second hierarchical decision diagram is a ternary tree diagram representing the network device policy.
10. The system of claim 9 wherein the at least one network device policy rule comprises an action portion and a predicate portion and the at least one bit string represents the value of the predicate portion of the at least one network device policy rule.
11. The system of claim 8 wherein the processing device executing the one or more instructions further performs the operation of:
combining the plurality of numerical intervals to simplify the network device policy rules that are derived from the plurality of numerical intervals.
12. The system of claim 10 wherein the predicate portion of the at least one network device policy rule comprises at least one of a source address, a destination address and a protocol indicator.
13. The system of claim 12 wherein the processing device executing the one or more instructions performs the operation of translating the at least one network device policy rule into at least one bit string by converting the source address value into a first bit string, converting the destination address into a second bit string and converting the protocol indicator into a third bit string.
14. The system of claim 13 wherein the binary decision diagram is a data structure representing at least the first bit string, the second bit string and third bit string.
15. The system of claim 14 wherein the second hierarchical decision diagram is a data structure representing a first solution space of the binary decision diagram, the first solution space being a portion of the entire solution space represented by the binary decision diagram.