Patent ID: 8539547

Claim:
A method comprising; in a packet processing device of a network, receiving a policy with policy selectors and a priority: upon determining that a subnet mask in a policy selector is not contained in a subnet element (SE) node within a list of SE nodes, creating a Subnet Element (SE) node that stores the subnet mask and a reference to another SE node and adding the SE node created to the list of SE nodes; upon determining that the priority of the policy is greater than a priority value recorded in a SE node storing the subnet mask, recording the priority of the policy in the SE node storing the subnet mask; upon determining that an internet protocol (IP) address in the policy selector is not stored in any IP address tree (IT) node associated with the SE node storing the subnet mask, creating an IP address Tree (IT) node that stores the IP address and a reference to another IT node and storing the memory address of the IT node created in the SE node storing the subnet mask or in another IT node associated with the SE node storing the subnet mask; upon determining that a value of an attribute in the policy selector is nonzero and is not stored in any Attribute Tree (AT) node associated with an IT node storing the IP address in the policy selector, creating an Attribute Tree (AT) node that stores the nonzero value of the attribute in the policy selector and a reference to another AT node then storing the memory address of the AT node created in the IT node storing the IP address, or in an AT node associated with the IT node storing the IP address; and upon determining that the value of the attribute in the policy selector is zero, indicating “don't care” about the attribute in the policy selector when searching for a matching policy, and that the attribute in the policy selector is the last one to be processed of a set of attributes in the policy selector, all equal to zero, creating a priority node that stores the memory address of the policy and the priority of the policy, and storing the memory address of the priority node in the IT node storing the IP address, or in an AT node associated with the IT node storing the IP address.