Patent ID: 6715081
Filing Date: 2004-03-30
Classification: H04L,Y10S

Abstract:
A method of searching a database of security rules for a match between attributes specified in the rules and the corresponding attributes in a packet, comprisingarranging the database into a set of relatively stable static rules and one or more sets of dynamic security rules, wherein a static rule can be a placeholder for a set of dynamic rules, and wherein the rule including placeholders for dynamic sets of rules are arranged in the order of most specific attributes to least specific attributes, partitioning a set of dynamic rules into groups according to attributes such that within each group there is no order dependency of the rules, representing each group of dynamic rules by an order independent search mechanism, searching the static rules of the database for the first static rule having attributes that match the corresponding attributes of the packet, determining if the matching static rule is a placeholder for a set of dynamic rules, if the matching static rule is a placeholder for a set of dynamic rules, searching the groups of dynamic rules associated with the matching static rule using the order independent search mechanism for a match with the packet attributes, and applying security processing to the packet as specified by a matching static or dynamic rule.