Patent ID: 7818793

Claim:
A method for generating firewall rules by utilizing a data processing system, said method comprising: specifying a plurality of requirements for a software firewall in a firewall decision diagram; reducing said firewall decision diagram; marking said firewall decision diagram by computing a degree of each terminal node ν as deg(ν)=1; in response to a determination that a first node ν having a plurality of outgoing branches e 0 , . . . , e k−1 that are incoming branches of nodes ν 0 , . . . , ν k−1 , respectively, within said firewall decision diagram, and that an outgoing branch e j among said plurality of outgoing branches includes a quantity (deg(e j )−1)×deg(ν j ) that is larger than or equal to the corresponding quantity of every other outgoing branch among said plurality of outgoing branches of said first node ν: marking branch e j with ALL; and computing the degree of said first node ν utilizing deg(ν)=Σ k−1 i=0 [deg(e i )×deg(ν i )], wherein k represents a number of outgoing branches in said plurality of outgoing branches; and generating a plurality of firewall rules based on said firewall decision diagram on said data processing system.