International Business Machines Corporation

Cisco Technology, Inc.

Gaurang Shah

Maria Elena Smith

Mario Ernesto De Armas

Oswaldo Gago

Thomas Charles Burke

Louis F Menditto

Robert Michael Batz

Tzu-Ming Tsang

Pranav Tiwari

Chris O'Rourke

Barron Cornelius Housel, Iii

Mark Albert

Jan Vilhuber

Srinivasan Muralidharan

Scott W Brim

Mauro Zallocco

Anurag Bhargava

Pranav Kumar Tiwari

Michael Sutton

Richard Gray

Sean W Hull

Ethan M Young

At least one set of enforceable policy provisions is identified within at least one defined service level policy to be enforced during runtime by a policy enforcement point (PEP). Each set of enforceable policy provisions includes a policy subject, a reference to a policy domain, and at least one assertion. Each identified set of enforceable policy provisions is transformed by the PEP into at least one runtime-executable processing rule that each includes at least one PEP processing action that each represents an atomic unit of policy enforcement level behavior executable by the PEP to enforce the respective at least one assertion against runtime objects associated with the policy subject within an area of runtime policy enforcement specified by the policy domain.

Dynamic generation of policy enforcement rules and actions from policy attachment semantics

Source policy identification information of a registry service policy is correlated with configured policy enforcement processing rules and processing actions using a source policy reference key. The source policy identification information includes at least a source policy identifier (ID) of the registry service policy. Per-transaction service policy enforcement information that documents policy enforcement activities performed by a policy enforcement point (PEP) is correlated with the source policy identification information using the source policy reference key. The correlated per-transaction service policy enforcement information of at least one transaction from the per-transaction service data table is provided in response to a query from a policy monitoring point (PMP).

Instrumentation and monitoring of service level agreement (SLA) and service policy enforcement

A peer policy object named with a policy enforcement metric context identifier is created at a first policy enforcement point (PEP) platform of a group of peered PEP platforms. The peer policy object uniquely identifies a registered service policy to be enforced during runtime as a shared runtime policy enforcement activity by the group of peered PEP platforms within a peered policy enforcement deployment. The peer policy object named with the policy enforcement metric context identifier is deployed to at least one other peered PEP platform within the peered policy enforcement deployment to initiate the shared runtime policy enforcement activity by the group of peered PEP platforms. At least one runtime policy enforcement metric associated with runtime enforcement of the registered service policy is shared with the at least one other peered PEP platform during runtime using the policy enforcement metric context identifier.

Applying policy attachment service level management (SLM) semantics within a peered policy enforcement deployment

Source policy identification information of a registry service policy is captured. The source policy identification information includes a source policy identifier (ID), a source policy name, and a source policy uniform resource locator (URL). The captured source policy identification information is correlated with configured policy enforcement processing rules and processing actions using a source policy reference key. Per-transaction service policy enforcement information that documents policy enforcement activities performed by a policy enforcement point (PEP) is captured. The captured per-transaction service policy enforcement information is correlated with the captured source policy identification information using the source policy reference key.

At least one defined service policy to be enforced by a policy enforcement point (PEP) is obtained. The obtained at least one defined service policy is parsed to identify at least one set of enforceable policy provisions and the at least one set of enforceable policy provisions is identified. Each set of enforceable policy provisions includes a policy subject, a policy domain, and at least one assertion as the enforceable policy provisions within the at least one defined service policy. At least one runtime processing rule including at least one processing action usable by the PEP is created to enforce the policy subject, the policy domain, and the at least one assertion of each identified at least one set of enforceable policy provisions.

A method for protecting firewall load balancers from a denial of service attack is provided. Packets are received by the firewall load balancer. Each packet has a source and a destination. The firewall load balancer is equipped with a connection database that can contain entries about the packets. Upon receipt of a packet, the connection database is queried to determine whether or not there is an entry for the received packet. If an entry is found in the database, the packet is forwarded to its destination. Otherwise, if the packet was received from a firewall, then a new connection entry for the packet is built and is saved to the connection database and the packet is forwarded on to its destination. If the packet does not have an entry (match) in the connection database and the packet was not received from a firewall, then the packet is forwarded to a firewall.

Method for protecting a firewall load balancer from a denial of service attack

An information service provider network includes a content gateway to process requests for information from a client terminal. The content gateway includes a router for receiving a request for information from the client terminal. The request includes a domain name and additional content. The router forwards the request according to the domain name to a selected one of a plurality of processors to further process the request. The selected one of the plurality of processors identifies an information source to satisfy the request in response to the additional content of the request.

System and method for processing a request for information in a network

A network () includes a load balancer () that passes traffic between a client () and a gateway (). For initial messages from a client (), the load balancer () selects an appropriate gateway () for message processing. A session is then established between the client () and the appropriate gateway (). The session is indicated by a session identifier. At any point, the client () may choose to suspend the session for later resumption. Upon suspension, the load balancer () keeps track of the session identifier and the appropriate gateway () associated with the session. Upon a resumption request from the client (), the load balancer () determines which of the gateways () is associated with the resumption request according to the session identifier. In this manner, the client may continue a session with the same gateway () for seamless operation.

System and method for maintaining seamless session operation

A load balancer in a wireless access protocol network receives a request from a client terminal. The load balancer selects one of a plurality of gateways to process the request. The load balancer sends a re-direct message to the client terminal that includes information identifying the selected gateway. The client terminal then sends out a subsequent request that includes the information identifying the selected gateway. The subsequent request is transferred to the selected gateway for processing without further intervention by the load balancer.

Apparatus and method for re-directing a client session

An information service provider network includes a content gateway to process requests for information from a client terminal. The content gateway includes a router for receiving a domain name server query from an originator associated with a request for information. The router including a database defining a relationship between domain names and addresses associated with accelerated servicing of requests. The router determines whether the domain name of the domain name server query is indexed in the database. The domain name is qualified in response to the domain name being in the database. If qualified, the router sends an address to the originator of the query corresponding in the database to the domain name. The address is to a processor associated with the router that performs accelerated services on the request.

Growing community of inventors

Cary, NC, United States of America

Gaurang Shah