Abstract: The present invention essentially comprises a Packet Receiver and a Stream Manager for a computer network. When a stream of packets passes through the present invention, they are received by the Packet Receiver. The Packet Receiver identifies the session to which the packet stream belongs, and passes the packet to the Stream Manager. The Stream Manager identifies the application generating the packet stream by scanning an Application ID Hash Table, which is a table that contains a mapping of destination ports to corresponding applications. Thereafter, it uses a State Machine Execution Engine to execute application decode instructions on the packet stream. The application decode instructions are stored in a table called Expression Action Table, and are generated based on a decode script created by the user for each application.

Abstract: A system and method for enforcing policies on data packets in a computer network is disclosed. The enforcement of policies is done by prioritizing and regulating the flow of data packets. The regulation of prioritized data packets includes a determination of: service level agreement violations, flow control of data packets of a predefined priority and session resettings. For determination of service level agreements the policy engine carries out a response time calculation and finds if it is in consonance with the response time agreed upon in the service level agreement. Flow control in case of a service level agreement violation is implemented either by reducing the server side window size or by delaying acknowledgement packets sent by the client.

Abstract: The present invention is a system and method for allowing an administrator of a computer network higher up in a hierarchical arrangement to define the scope of policies for the services offered, and users lower in the hierarchical arrangement to customize policies within the scope defined by the administrator. While defining policy rules, administrators classify them as scoping or non-scoping. Users lower in the hierarchical arrangement can then customize scoping rules by defining sub-rules. Policy rules have a condition part and an action part, and the sub-rules can be used to change the scope of the condition and action parts. The present invention adds all the non-scoping policy rules, all the scoping policy rules, and all the sub-rules (with their scope limited by the scoping rules) to a rules database. This rules database is then used by any policy enforcement engine to enforce policy rules.

Abstract: An integrated policy enforcement system for a computer network implements several policies on the network traffic. A rule compiler compiles these policies and converts them into a rule tree-graph, which is then used to provide desired behavior to the network traffic comprising data packets. The rule compiler comprises three sub-modules namely—a rule input module, a rule tree generator module and a rule output module. The rule input module receives the input for the rule compiler and prepares the input for the rule tree generator module. The rule tree generator module generates the rule tree-graph. The rule tree-graph is a data structure comprising tree data structure and graph data structure.

Abstract: A rule engine for a computer network traverses a rule mesh having path nodes and path edges in form of a tree part and a graph part. The rule engine evaluates data packets flowing through a network to determine rules matched for every packet. Subsequent packets having same expression values as an already checked packet are not rechecked against the same nodes in the rule mesh through the use of a session entry. The rule engine performs a search on every path node of rule mesh to determine the next path edge to traverse. A Tree-Id and Rule Confirmation Bitmap that are indicative of path traversed and rules matched by a packet are generated at the end of rule mesh traversal. These are appended in the packet extension for subsequent modules of Policy Agent.

Abstract: A rule engine for a computer network traverses a rule mesh having path nodes and path edges in form of a tree part and a graph part. The rule engine evaluates data packets flowing through a network to determine rules matched for every packet. Subsequent packets having same expression values as an already checked packet are not rechecked against the same nodes in the rule mesh through the use of a session entry. The rule engine performs a search on every path node of rule mesh to determine the next path edge to traverse. A Tree-Id and Rule Confirmation Bitmap that are indicative of path traversed and rules matched by a packet are generated at the end of rule mesh traversal. These are appended in the packet extension for subsequent modules of Policy Agent.

Abstract: A universal application decode engine that can be programmed to decode packet streams and identify the application which is generating the packet streams is disclosed. The universal application decode engine comprises a packet receiver, a state machine execution engine for executing application decode instructions, and a session correlation lookup engine for correlating a new session to an existing session.

Abstract: A system, method and computer program product for ensuring the quality of services being provided by a protected network of computers during an ongoing security breach is provided. The quality of the services is ensured by performing secure Quality of Service actions on data packets on the network. The sQoS actions depend on whether the data packets correspond to an attack on the computer to which they are directed, called the destination computer. If the data packet corresponds to an attack, then the actions also depend on the type of attack. In case there is no attack, the actions depend on the history of attacks by data packets that had originated from the same source computer and were directed towards the same destination computer. Supported actions include HardenFW, ControlBW and ConnectionLimit.

Abstract: A system, method and computer program product for ensuring the quality of services being provided by a protected network of computers during an ongoing security breach is provided. The quality of the services is ensured by performing secure Quality of Service actions on data packets on the network. The sQoS actions depend on whether the data packets correspond to an attack on the computer to which they are directed, called the destination computer. If the data packet corresponds to an attack, then the actions also depend on the type of attack. In case there is no attack, the actions depend on the history of attacks by data packets that had originated from the same source computer and were directed towards the same destination computer. Supported actions include HardenFW, ControlBW and ConnectionLimit.

Abstract: The present invention provides a system, method and computer program product for managing customers in a hierarchical manner. The customer hierarchy comprises a root service provider (RSP), tiered service providers (TSPs) and end customers. The present invention enables the governing of the customers by a large service provider by providing an ability to make smaller service providers as customers and managing their resources. The smaller service provider, in turn, can have its own customers. The smaller service provider governs these customers without interference from the service providers above it in the hierarchy. The customers are governed by policies. A policy is a set of rules laid down by the service provider to control the customers. The present invention also enables the service provider to implement different policies on different customers and change the policy for a customer without affecting other customers.