Patent ID: 8407779

Claim:
A method comprising: receiving, by a device, a plurality of rules, associated with a policy, that specify how packets are to be processed by a node, the plurality of rules including: one or more negative rules that identify operations to be performed, by the node, when information, obtained from the packets, does not match information specified by the one or more negative rules, and one or more positive rules that identify other operations to be performed, by the node, when the information, obtained from the packets, matches information specified by the one or more positive rules; determining, by the device, a classification of the plurality of rules; identifying, by the device, the one or more negative rules based on the classification of the plurality of rules; assigning, by the device, a first variable to a first negative term associated with the one or more negative rules; setting, by the device, the first variable equal to a first value that allows a first positive rule to be generated; generating, by the device and based on the first variable being set equal to the first value, a plurality of modified rules based on the one or more negative rules, the plurality of modified rules including the first positive rule, and the first positive rule including a positive version of the first negative term; and installing the plurality of modified rules in the node to allow the node to process the packets by using the plurality of modified rules.