Extensible Policy Decision Framework Using Ahead of Time Compilation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network devices face challenges in dynamically incorporating new policy objects and providing visibility into policy enforcement, as routing policies are typically static and hidden from users, limiting flexibility and expressiveness.
Innovation Solution
A policy server with a parser, engine, and dispatcher that constructs a dynamic acyclic graph from human-readable policy objects, generates code, and compiles binaries for asynchronous updates, allowing for extensible policy processing and visibility through a JSON format and Ahead of Time compilation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If routing policies are implemented as static applications or libraries, then policy enforcement is reliable and stable, but flexibility to incorporate new policy objects is poor
Solution Approach 1:
The patent transforms static routing policies into dynamic policies by implementing a policy generation system that can automatically create, modify, and compile policy objects at runtime. The system uses a policy data model with configurable parameters that can be adjusted without requiring complete policy rewriting, enabling flexible adaptation while maintaining structured generation processes.
Solution Approach 2:
The patent implements ahead-of-time (AoT) compilation where policy code is pre-compiled into binaries before deployment. This preliminary action separates the complexity of policy generation from runtime execution, allowing flexible policy object incorporation while maintaining stable and efficient policy enforcement through pre-compiled code.
2Loss of information
If policy objects are hidden from users, then policy enforcement is secure, but user visibility and control are reduced
Solution Approach 1:
The patent introduces a policy data model as an intermediary layer between user-facing configuration and underlying policy enforcement code. This model exposes high-level, human-readable policy parameters that users can configure and monitor, while the AoT compilation process translates these into secure, optimized binaries for enforcement, maintaining both visibility and security.
3Speed
If policy updates are performed synchronously, then policy consistency is maintained, but update speed and responsiveness are reduced
Solution Approach 1:
The patent implements AoT compilation where policy code is pre-compiled into binaries before deployment. This preliminary action separates the compilation step from the update step, allowing rapid policy updates to be deployed without performing lengthy compilation operations during synchronous updates, thereby improving update speed while maintaining consistency through pre-validated binaries.
Data Source
AI summary
A policy server may include a policy parser that is communicably coupled to a configuration database. The policy parser may identify a policy data model in the configuration database associated with a policy. The policy data model may include a policy object expressed in a human-readable format. The policy server may include a policy engine for constructing a dynamic acyclic graph (DAG) representing the policy data model. The policy engine may include a code generation engine for parsing the DAG to generate code in a high-level language. The policy engine may include a compiler for compiling the generated code to generate binaries for implementing the policy. The policy server may include a policy dispatcher for generating a notification to a policy client to dispatch the binaries to at least one subscriber of the policy following the code being compiled. The policy server may asynchronously update the policy for the subscribers.