Patent ID: 7478422

Claim:
A declarative language system for specifying in an annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said network event is an interaction between an active principal and a passive principal, said declarative language system comprising: a declarative language comprising a plurality of objects, such that each object of said plurality of objects comprises at least one list having a first element; a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language; a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification; means for loading said annotated policy specification into a policy engine; means for said policy engine to receive said network event from an agent; means for said policy engine to evaluate said security policy against said network event and to generate a disposition for said network event; means for said policy engine to communicate agent directives to said agent; and means for said policy engine to output said network event and said disposition to a datastore; wherein said each object is a first-class object; wherein said first-class object comprises any of: a policy; a group; a credential, said credential having a specificity; a condition; a disposition; and a rule, said rule having an outcome; wherein said rule for evaluating said event comprises: a protocol field associated with said event; a plurality of actions associated with said event; an initiator for representing said active principal of said event; a target for representing said passive principal of said event, and means for said outcome to generate a disposition by specifying constraints upon said event, said outcome comprising: at least one of a plurality of conditional statements and a default statement, wherein each of said plurality of conditional statement comprises a keyword and a disposition, and wherein said plurality of conditional statements are evaluated in chronological order; and further comprising; a prerequisite having a plurality of rule's, such that said prerequisite is satisfied when at least one of said plurality of rules is applied to a prior event.