Policy Manager Delayed Evaluation for Firewall Criteria
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current rule-based systems in computer security, such as firewalls, are limited by a fixed set of criteria for evaluating access policies, restricting the implementation of new types of criteria and requiring all criteria to be available at the time of policy evaluation, which hinders flexibility and effectiveness.
Innovation Solution
A policy manager with a generic rules extensibility mechanism allows the addition of new criteria opaque to the rules engine, enabling evaluation at different stages and delaying final evaluation until all necessary properties are resolved, thereby supporting dynamic and flexible policy evaluation without requiring changes to the rules engine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a fixed set of criteria is used in rule-based systems, then the system structure remains simple and manageable, but the system cannot implement new types of criteria or evaluate properties that are not available at policy evaluation time
Solution Approach 1:
The system segments the criteria evaluation process into distinct phases: initial policy evaluation using available properties, and delayed evaluation using subsequently available properties. The policy manager separates the rules engine from the criteria resolution mechanism, allowing new criteria types to be added without modifying the core rules engine structure.
Solution Approach 2:
The system transitions from static policy evaluation to dynamic multi-phase evaluation. Policies are initially evaluated with available properties, then re-evaluated when additional properties become available. This dynamic approach allows the system to adapt to new criteria types and property availability without structural changes.
2Reliability
If all criteria must be available at policy evaluation time, then the evaluation process is straightforward and fast, but the system cannot make informed decisions when some properties are not yet available
Solution Approach 1:
The system performs preliminary policy evaluation using available properties before all properties are available. This preliminary evaluation can make decisions for policies that don't require additional properties, while deferring evaluation of policies that need more information. This approach maintains decision accuracy for resolvable policies without unnecessary delays.
Solution Approach 2:
The system performs partial evaluation of policies using available properties rather than waiting for complete information. Policies can be partially evaluated and deferred, allowing the system to make decisions on resolvable policies immediately while delaying only those that require additional properties, thus minimizing overall evaluation time.
3Adaptability or versatility
If new criteria are added to the system, then the system becomes more versatile and adaptive, but the rules engine requires changes to accommodate new criteria types
Solution Approach 1:
The policy manager acts as an intermediary layer between the rules engine and the criteria resolution process. It handles the complexity of new criteria types, property availability management, and delayed evaluation logic, while the rules engine remains unchanged. This mediator approach allows criteria extensibility without modifying the core rules engine.
Solution Approach 2:
The policy manager provides universal functionality that handles multiple criteria types and evaluation scenarios through a unified interface. It manages property availability, coordinates delayed evaluation, and interfaces with the rules engine in a way that works with any criteria type, eliminating the need for rules engine modifications when adding new criteria.
4Reliability
If the system waits for all properties to be available before evaluating policies, then decision accuracy is maximized, but system productivity and response time deteriorate
Solution Approach 1:
The system performs preliminary evaluation of policies using available properties immediately, rather than waiting for all properties. This allows high-throughput processing of policies that can be resolved with current information, while deferred evaluation ensures accuracy for policies needing additional properties. This approach maximizes both productivity and decision accuracy.
Solution Approach 2:
The system performs partial evaluation on a per-policy basis, evaluating policies that have sufficient information immediately while deferring others. This selective partial evaluation maintains high overall throughput by processing resolvable policies without delay, while ensuring accurate decisions for policies requiring additional properties through deferred evaluation.
Data Source
AI summary
The evaluation of a policy can be delayed until all rules criteria needed for evaluation are available. Also, new types of rules criteria can be registered without requiring changes to a rules engine. A policy manager allows rules to be evaluated and decisions made at different stages of the request handling. The policy manager facilitates interaction with the rules engine until all criteria are evaluated. The policy manager also allows modules developed by third parties to provide notification when criteria can be decided and thus complete evaluation.