Patent Document ID: 10057291
Application ID: 14938650

Base Claim:
1. A method, implemented by a computing device, for assessing semantic difference between networking access control lists (ACLs), the method comprising: obtaining a deployed ACL file comprising ACL rules in a device-level representation for a network device; parsing the deployed ACL file to generate a high-level ACL representation of the deployed ACL file in a common ACL data structure format; obtaining a candidate ACL file in the device-level representation for replacing the deployed ACL file on the network device; parsing the candidate ACL file to generate a high-level ACL representation of the candidate ACL file in the common ACL data structure format; comparing the high-level ACL representation of the deployed ACL file and the high-level representation of the candidate ACL file; performing semantic analysis using results of the comparing to determine a semantic difference between the high-level ACL representation of the deployed ACL file and the high-level representation of the candidate ACL file; calculating a risk score based on the semantic difference, wherein the risk score indicates whether the semantic difference represents a safe change if the candidate ACL file is deployed, and wherein the risk score weights changes that delete hosts higher than changes that add hosts; comparing the risk score to a threshold value; and outputting an indication of whether the semantic difference represents a safe change.

---

Claim 5:
5. The method of claim 1 wherein the semantic difference comprises: an indication of changes to source hosts; an indication of changes to destination hosts; an indication of changes to source ports; an indication of changes to destination ports; an indication of changes to an action; or an indication of changes to a network protocol.