Patent ID: 9736183
Date: 2017-08-15
CPC Classifications: G06F,H04L

Claim:
1. A method comprising: expressing an access-control policy as a first quantifier-free form (QFF) constraint; identifying a particular constraint for a multi-step operation as a second QFF constraint, the multi-step operation comprising a sequence of operational steps; identifying an operation vector defining an incoming IP packet comprising a destination address; providing a respective copy of the operation vector defining the incoming IP packet comprising the destination address associated with each respective step in the sequence of operational steps in the multi-step operation; determining a third QFF constraint using the first QFF constraint, the second QFF constraint, and the copies of the operation vector defining the incoming IP packet comprising the destination address; solving the third QFF constraint to determine a solution, wherein the solving indicates an extent to which permitting or prohibiting the multi-step operation by the access control policy is consistent with permitting or prohibiting the multi-step operation by the particular constraint, wherein the operational steps of the multi-step operation comprise different access operations at different security levels, and wherein in each step a security level of a target object against which a subject operation is to be performed by a subject object is to be less than two levels greater than a security level of the subject object; and outputting the solution.