Dynamically generating a packet inspection policy for a policy enforcement point in a centralized management environment

1. A method of generating a packet inspection policy for a policy enforcement point that enforces the packet inspection policy in a centralized management environment, the method comprising:

updating data of a network topology for the policy enforcement point that enforces the packet inspection policy corresponding to a network infrastructure according to a metadata of the policy enforcement point, the metadata including a capability of the policy enforcement point that enforces the packet inspection policy;

determining whether a specific capability exists within policy enforcement points other than the policy enforcement point that enforces the packet inspection policy, wherein the policy enforcement points are in network segments of the centralized management environment associated with the policy enforcement point that enforces the packet inspection policy;

responsive to a determination that the specific capability fails to exist within the other policy enforcement points, generating the packet inspection policy for the policy enforcement point that enforces the packet inspection policy according to the data of the network topology and the capability of the policy enforcement point that enforces the packet inspection policy, wherein the packet inspection policy include the specific capability; and

deploying the packet inspection policy to the policy enforcement point that enforces the packet inspection policy.

2. The method as claimed in claim 1 , wherein the metadata further comprises a sequence related to other policy enforcement point that enforces the packet inspection policy for determining a position of the policy enforcement point that enforces the packet inspection policy as newly added in the network infrastructure, so as to update the data of the network topology for the policy enforcement point that enforces the packet inspection policy corresponding to the network infrastructure.

3. The method as claimed in claim 1 , wherein the capability of the policy enforcement point that enforces the packet inspection policy comprises a packet inspection capability, a processor capability for the policy enforcement point that enforces the packet inspection policy, and a bandwidth.

4. The method as claimed in claim 3 , wherein the packet inspection capability comprises a security protection technology including data leakage protection, secure sockets layer inspection, firewall, virus detection, malware detection, intrusion detection system (IDS) or intrusion prevention system (IPS).

5. The method as claimed in claim 1 , further comprising:

adjusting the packet inspection policy for the policy enforcement point that enforces the packet inspection policy in the centralized management environment by:

periodically waiting and polling an updated information of a running status for the policy enforcement point that enforces the packet inspection policy;

collecting the updated information of the running status reported from the policy enforcement point that enforces the packet inspection policy, the updated information of the running status comprising a load of a packet inspected by the policy enforcement point that enforces the packet inspection policy;

determining whether the updated information of the running status collected by the policy enforcement point that enforces the packet inspection policy reaches a threshold; and

dynamically adjusting the packet inspection policy for the policy enforcement point that enforces the packet inspection policy according to the metadata and the updated information of the running status for the policy enforcement point that enforces the packet inspection policy.

6. The method as claimed in claim 5 , wherein the running status comprises health information including a status in use of a disk, CPU, or memory of the policy enforcement point that enforces the packet inspection policy.

7. The method as claimed in claim 5 , wherein the packet inspected by the policy enforcement point that enforces the packet inspection policy comprises a security tag provided for a following policy enforcement point that enforces the packet inspection policy receiving the packet to inspect the security tag of the packet in order to accelerate the packet inspection for the following policy enforcement point that enforces the packet inspection policy.

8. The method as claimed in claim 7 , wherein the security tag at least comprises a metadata, a checklist, and a hash value for preventing tampering of the packet.

9. A computer program product comprising a non-transitory computer-readable storage medium having a computer readable program for generating a packet inspection policy for a policy enforcement point that enforces the packet inspection policy in a centralized management environment stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

update data of a network topology for the policy enforcement point that enforces the packet inspection policy corresponding to a network infrastructure according to a metadata of the policy enforcement point that enforces the packet inspection policy, the metadata including a capability of the policy enforcement point that enforces the packet inspection policy;

determine whether a specific capability exists within policy enforcement points other than the policy enforcement point that enforces the packet inspection policy, wherein the policy enforcement points are in network segments of the centralized management environment associated with the policy enforcement point that enforces the packet inspection policy;

responsive to a determination that the specific capability fails to exist within the other policy enforcement points, generate the packet inspection policy for the policy enforcement point that enforces the packet inspection policy according to the data of the network topology and the capability of the policy enforcement point that enforces the packet inspection policy, wherein the packet inspection policy include the specific capability; and

deploy the packet inspection policy to the policy enforcement point that enforces the packet inspection policy.

10. The computer program product as claimed in claim 9 , wherein the metadata further comprises a sequence related to other policy enforcement point that enforces the packet inspection policy for determining a position of the policy enforcement point that enforces the packet inspection policy as newly added in the network infrastructure, so as to update the data of the network topology for the policy enforcement point that enforces the packet inspection policy corresponding to the network infrastructure.

11. The computer program product as claimed in claim 9 , wherein the capability of the policy enforcement point that enforces the packet inspection policy comprises a packet inspection capability, a processor capability for the policy enforcement point that enforces the packet inspection policy and a bandwidth, wherein the packet inspection capability comprises a security protection technology including data leakage protection, secure sockets layer inspection, firewall, virus detection, malware detection, intrusion detection system (IDS) or intrusion prevention system (IPS).

12. The computer program product as claimed in claim 9 , wherein the computer readable program further causes the computing device to:

adjust the packet inspection policy for the policy enforcement point that enforces the packet inspection policy in the centralized management environment by:

periodically waiting and polling an updated information of a running status for the policy enforcement point that enforces the packet inspection policy;

collecting the updated information of the running status reported from the policy enforcement point that enforces the packet inspection policy, the updated information of the running status comprising a load of a packet inspected by the policy enforcement point that enforces the packet inspection policy;

determining whether the updated information of the running status collected by the policy enforcement point that enforces the packet inspection policy, reaches a threshold; and

dynamically adjusting the packet inspection policy for the policy enforcement point that enforces the packet inspection policy according to the metadata and the updated information of the running status for the policy enforcement point that enforces the packet inspection policy.

13. The computer program product as claimed in claim 12 , wherein the running status comprises health information including a status in use of a disk, CPU, or memory of the policy enforcement point that enforces the packet inspection policy.

14. The computer program product as claimed in claim 12 , wherein the packet inspected by the policy enforcement point that enforces the packet inspection policy comprises a security tag provided for a following policy enforcement point that enforces the packet inspection policy receiving the packet to inspect the security tag of the packet in order to accelerate the packet inspection for the following policy enforcement point that enforces the packet inspection policy and wherein the security tag at least comprises a metadata, a checklist, and a hash value for preventing tampering of the packet.

15. An information appliance for generating a packet inspection policy for a policy enforcement point that enforces the packet inspection policy in a centralized management environment, comprising:

a bus;

a memory connected to the bus, wherein the memory comprises a set of instructions; and

a processing unit in connection to the bus, wherein the processing unit executes the set of instructions to:

update data of a network topology for the policy enforcement point that enforces the packet inspection policy corresponding to a network infrastructure according to a metadata of the policy enforcement point that enforces the packet inspection policy, the metadata including a capability of the policy enforcement point that enforces the packet inspection policy;

determine whether a specific capability exists within policy enforcement points other than the policy enforcement point that enforces the packet inspection policy, wherein the policy enforcement points are in network segments of the centralized management environment associated with the policy enforcement point that enforces the packet inspection policy;

responsive to a determination that the specific capability fails to exist within the other policy enforcement points, generate the packet inspection policy for the policy enforcement point that enforces the packet inspection policy according to the data of the network topology and the capability of the policy enforcement point that enforces the packet inspection policy, wherein the packet inspection policy include the specific capability; and

deploy the packet inspection policy to the policy enforcement point that enforces the packet inspection policy.

16. The information appliance as claimed in claim 15 , wherein the metadata further comprises a sequence related to other policy enforcement point that enforces the packet inspection policy for determining a position of the policy enforcement point that enforces the packet inspection policy as newly added in the network infrastructure, so as to update the data of the network topology for the policy enforcement point that enforces the packet inspection policy corresponding to the network infrastructure.

17. The information appliance as claimed in claim 15 , wherein the capability of the policy enforcement point that enforces the packet inspection policy comprises a packet inspection capability, a processor capability for the policy enforcement point that enforces the packet inspection policy and a bandwidth, wherein the packet inspection capability comprises a security protection technology including data leakage protection, secure sockets layer inspection, firewall, virus detection, malware detection, intrusion detection system (IDS) or intrusion prevention system (IPS).

18. The information appliance as claimed in claim 15 , wherein the instructions further cause the processing unit to:

adjust the packet inspection policy for the policy enforcement point that enforces the packet inspection policy in the centralized management environment by:

periodically waiting and polling an updated information of a running status for the policy enforcement point that enforces the packet inspection policy;

collecting the updated information of the running status reported from the policy enforcement point that enforces the packet inspection policy, the updated information of the running status comprising a load of a packet inspected by the policy enforcement point that enforces the packet inspection policy;

determining whether the updated information of the running status collected by the policy enforcement point that enforces the packet inspection policy reaches a threshold; and

dynamically adjusting the packet inspection policy for the policy enforcement point that enforces the packet inspection policy according to the metadata and the updated information of the running status for the policy enforcement point that enforces the packet inspection policy.

19. The information appliance as claimed in claim 18 , wherein the running status comprises health information including a status in use of a disk, CPU, or memory of the policy enforcement point that enforces the packet inspection policy.

20. The information appliance as claimed in claim 18 , wherein the packet inspected by the policy enforcement point that enforces the packet inspection policy comprises a security tag provided for a following policy enforcement point that enforces the packet inspection policy receiving the packet to inspect the security tag of the packet in order to accelerate the packet inspection for the following policy enforcement point that enforces the packet inspection policy and wherein the security tag at least comprises a metadata, a checklist, and a hash value for preventing tampering of the packet.