Patent ID: 8260886

Claim:
A method of compiling command-based policy rules to a flat filter list structure for storage in a Content Addressable Memory (CAM), said policy rules being organized in a tree-structure of classifiers, wherein a processor is configured to perform the steps of: (a) finding all the possible search paths in the tree structure; (b) adding to the flat filter list only the valid search paths according to defined criteria; (c) transforming a policy map (PMAP) into a flat policy map (F PMAP), wherein the PMAP is a sequence of pairs (CMAP i , Z i ), where Z i is the action to be taken for a data packet (P) if it matches the Class map CMAP i with permit (deny), and each CMAP i is an ordered pair of a Class list (CL) and a corresponding match operator Y i that either is set to MATCH ALL (Y all ) or set to MATCH ANY (Y any ), and the F PMAP is a list of ordered pairs (F i , Z i ), wherein the list of ordered pairs (F i , Z i ) is the result of steps (a) and (b); wherein step (c) includes: transforming a Class map (CMAP) into a flat Class map (F_CMAP), wherein the CMAP comprises the Class list (CL), which comprises a sequence of Access Control Lists (ACL i ), wherein each ACL i is a sequence of ordered pairs (F i , X i ), where F i is a filter and X i , is a corresponding matching outcome, wherein X i is either PERMIT or DENY, and the F_CMAP is a second sequence of ordered pairs (F j , X j ), wherein the second sequence of ordered pairs (F j , X j ) is the result of the steps: (d) listing all search paths by a using a filter intersection between two ACLs in accordance with the individual order of the ACLs; (e) adding only the valid search paths according to the match operator, Y, in the CMAP with the same order as in step (d); and (f) repeating steps (d) and (e) until all the ACLs in the CL of the CMAP are joined in to a single ACL.