Declarative language for specifying a security policy

Abstract

The invention is a declarative language system and comprises a language as a tool for expressing network security policy in a formalized way. It allows the specification of security policy across a wide variety of networking layers and protocols. Using the language, a security administrator assigns a disposition to each and every network event that can occur in a data communications network. The event's disposition determines whether the event is allowed (i.e. conforms to the specified policy) or disallowed and what action, if any, should be taken by a system monitor in response to that event. Possible actions include, for example, logging the information into a database, notifying a human operator, and disrupting the offending network traffic.

Claims

What is claimed is:

1. A declarative language system for specifying in an annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said network event is an interaction between an active principal and a passive principal, said declarative language system comprising:

a declarative language comprising a plurality of objects, such that each object of said plurality of objects comprises at least one list having a first element;

a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language;

a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification;

means for loading said annotated policy specification into a Policy Engine;

means for said Policy Engine to receive said network event from an Agent;

means for said Policy Engine to evaluate said security policy against said network event and to generate a disposition for said network event;

means for said Policy Engine to communicate agent directives to said Agent; and

means for said Policy Engine to output said network event and said disposition to a datastore;

wherein said each object is a first-class object and wherein said first-class object is any of:

a policy;

a group;

a credential, said credential having a specificity;

a condition;

a disposition; and

a rule, said rule having an outcome;

wherein said rule for evaluating said event comprises:

a protocol field associated with said event;

a plurality of actions associated with said event;

an initiator for representing said active principal of said event;

a target for representing said passive principal of said event, and

means for said outcome to generate a disposition by specifying constraints upon said event said outcome comprising at least one of a plurality of conditional statements and a default statement, wherein each of said plurality of conditional statement comprises a keyword and a disposition, and wherein said plurality of conditional statements are evaluated in chronological order; and

wherein said outcome comprises any of an immediate outcome and a final outcome, wherein said immediate outcome is evaluated by said Policy Engine when said rule is selected, and wherein said final outcome is evaluated when said Policy Engine determines said event is final.

2. A declarative language system for specifying in an annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said network event is an interaction between an active principal and a passive principal, said declarative language system comprising:

a declarative language comprising a plurality of objects, such that each object of said plurality of objects comprises at least one list having a first element;

a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language;

a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification;

means for loading said annotated policy specification into a Policy Engine;

means for said Policy Engine to receive said network event from an Agent;

means for said policy Engine to evaluate said security policy against said network event and to generate a disposition for said network event;

means for said Policy Engine to communicate agent directives to said Agent;

means for said Policy Engine to output said network event and said disposition to a datastore; and

an annotated specification language;

wherein said first policy specification further comprises:

a plurality of credentials,

a plurality of conditions,

a plurality of rules;

wherein means for compiling comprises:

means for checking said first policy specification for syntax errors and semantics errors;

means for checking said first policy specification for credential errors;

means for checking said first policy specification for condition errors;

means for checking said first policy specification for completeness and coverage of said plurality of rules;

means for ordering said plurality of credentials by using said annotated specification language, whereby for each of said plurality of credentials a credential rank is determined; and

means for ordering said plurality of rules by using said annotated specification language;

wherein said means for ordering said plurality of credentials further comprises:

means for computing a combined weight for each of said plurality of credentials of each attribute weight, having a plurality of attribute-value assertions of said plurality of credential attributes, wherein each attribute weight comprises:

an attribute rank;

an assertion type rank; and

an attribute assertion count;

means for computing a second combined weight of a subset of said plurality of attribute-value assertions operated on by a logical operator;

means for computing a credential weight penalty for each of said plurality of credentials; and

means for comparing said plurality of credentials;

wherein said attribute assertion count starts at zero and is incremented monotonically for subsequent assertions.

3. A declarative language system for specifying in an annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said declarative language system comprising:

a declarative language comprising a plurality of objects, such that each object of said plurality of objects comprises at least one list having a first element;

a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language;

a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification;

means for loading said annotated policy specification into a Policy Engine;

means for said Policy Engine to receive said network event from an Agent;

means for said Policy Engine to evaluate said security policy against said network event and to generate a disposition for said network event;

means for said Policy Engine to communicate agent directives to said Agent;

means for said Policy Engine to output said network event and said disposition to a data store; and

an annotated specification language;

wherein said first policy specification further comprises:

a plurality of credentials,

a plurality of conditions,

a plurality of rules;

wherein means for compiling comprises:

means for checking said first policy specification for syntax errors and semantics errors;

means for checking said first policy specification for credential errors;

means for checking said first policy specification for condition errors;

means for checking said first policy specification for completeness and coverage of said plurality of rules;

means for ordering said plurality of credentials by using said annotated specification language, whereby for each of said plurality of credentials a credential rank is determined; and

means for ordering said plurality of rules by using said annotated specification language;

wherein said means for ordering said plurality of credentials further comprises:

means for computing a combined weight for each of said plurality of credentials of each attribute weight, having a plurality of attribute-value assertions of said plurality of credential attributes, wherein each attribute weight comprises:

an attribute rank;

an assertion type rank; and

an attribute assertion count;

means for computing a second combined weight of a subset of said plurality of attribute-value assertions operated on by a logical operator;

means for computing a credential weight penalty for each of said plurality of credentials; and

means for comparing said plurality of credentials; and

wherein said assertion count is zero, and said attribute assertion count is omitted from said 3-tuple.

4. A declarative language system for specifying in an annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said network event is an interaction between an active principal and a passive principal, said declarative language system comprising:

a declarative language comprising a plurality of objects, such that each object of said plurality of object comprises at least one list having a first element;

a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language;

a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification;

means for loading said annotated policy specification into a Policy Engine;

means for said Policy Engine to receive said network event from an Agent;

means for said Policy Engine to evaluate said security policy against said network event and to generate a disposition for said network event;

means for said Policy Engine to communicate agent directives to said Agent;

means for said Policy Engine to output said network event and said disposition to a datastore; and

an annotated specification language;

wherein said first policy specification further comprises:

a plurality of credentials,

a plurality of conditions,

a plurality of rules;

wherein means or compiling comprises:

means for checking said first policy specification for syntax errors and semantics errors;

means for checking said first policy specification for credential errors;

means for checking said first policy specification for condition errors;

means for checking said first policy specification for completeness and coverage of said plurality of rules;

means for ordering said plurality of credentials by using said annotated specification language, whereby for each of said plurality of credentials a credential rank is determined; and

means for ordering said plurality of rules by using said annotated specification language;

wherein said means for ordering said plurality credentials further comprises:

means for computing a combined weight for each of said plurality of credentials of each attribute weight, having a Plurality of attribute-value assertions of said plurality of credential attributes, wherein each attribute weight comprises:

an attribute rank;

an assertion type rank; and

an attribute assertion count;

means for computing a second combined weight of a subset of said plurality of attribute-value assertions operated on by a logical operator;

means for computing a credential weight penalty for each of said plurality of credentials; and

means for comparing said plurality of credentials;

wherein said attribute weight is represented by a 3-tuple having a weight keyword in said annotated specification language; and

further comprising means to sort a plurality of 3-tuples, wherein said attribute rank is a primary key, said assertion type rank is a secondary key, and said attribute assertion count is a tertiary key, thereby providing a sorted list.

5. A declarative language system for specifying in an annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said network event is an interaction between an active principal and a passive principal, said declarative language system comprising:

a declarative language comprising a plurality of objects, such that each object of said plurality of objects comprises at least one list having a first element;

a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language;

a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification;

means for loading said annotated policy specification into a Policy Engine;

means for said Policy Engine to receive said network event from an Agent;

means for said Policy Engine to evaluate said security policy against said network event and to generate a disposition for said network event;

means for said Policy Engine to communicate agent directives to said Agent;

means for said Policy Engine to output said network event and said disposition to a datastore; and

an annotated specification language;

wherein said first policy specification further comprises:

a plurality of credentials,

a plurality of conditions,

a plurality of rules;

wherein means far compiling comprises:

means for checking said first policy specification for syntax errors and semantics errors;

means for checking said first policy specification for credential errors;

means for checking said first policy specification for condition errors;

means for checking said first policy specification for completeness and coverage of said plurality at rules;

means for ordering said plurality of credentials by using said annotated specification language, whereby for each of said plurality of credentials a credential rank is determined; and

means for ordering said plurality of rules by using said annotated specification language;

wherein said means for ordering said plurality of credentials further comprises:

means for computing a combined weight for each of plurality of credentials of each attribute weight, having a plurality of attribute-value assertions of said plurality of credential attributes, wherein each attribute weight comprises:

an attribute rank;

an assertion type rank; and

an attribute assertion count;

means for computing a second combined weight of a subset of said plurality of attribute-value assertions operated on by a logical operator;

means for computing a credential weight penalty for each of said plurality of credentials; and

means for comparing said plurality of credentials;

wherein said attribute weight is represented by a 3-tuple having a weight keyword in said annotated specification language; and

wherein means for computing a weight penalty comprises:

a weight-penalty keyword in said annotated specification language having a penalty-count parameter, wherein said penalty-count parameter is an integer representing a total number of occurrences of logical operator or in each credential.

6. A declarative language system for specifying in an annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said network event is an interaction between an active principal and a passive principal, said declarative language system comprising:

a declarative language comprising a plurality of objects, such that each object of said plurality of objects comprises at least one list having a first element;

a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language;

a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification;

means for loading said annotated policy specification into a Policy Engine;

means for said Policy Engine to receive said network event from an Agent;

means for said Policy Engine to evaluate said security policy against said network event and to generate a disposition for said network event;

means for said Policy Engine to communicate agent directives to said Agent;

means for said Policy Engine to output said network event and said disposition to a datastore; and

an annotated specification language;

wherein said first policy specification further comprises:

a plurality of credentials,

a plurality of conditions,

a plurality of rules;

wherein means for compiling comprises:

means for checking said first policy specification for syntax errors and semantics errors;

means for checking said first policy specification for credential errors;

means for checking said first policy specification for condition errors;

means for checking said first policy specification for completeness and coverage of said plurality of rules;

means for ordering said plurality of credentials by using said annotated specification language, whereby for each of plurality of credentials a credential rank is determined; and

means for ordering said plurality of rules by using said annotated specification language;

wherein said means for ordering said plurality of credentials further comprises:

means for computing a combined weight for each of sail plurality of credentials of each attribute weight, having a plurality of attribute-value assertions of said plurality of credential attributes, wherein each attribute weight comprises:

an attribute rank;

an assertion type rank; and

an attribute assertion count;

means for computing a second combined weight of a subset of said plurality of attribute-value assertions operated on by a logical operator;

means for computing a credential weight penalty for each of said plurality of credentials; and

means for comparing said plurality of credentials;

wherein means for comparing said plurality of credentials comprises:

means to determine a highest ranking 3-tuple from said sorted 3-tuples;

means to compare credential weight penalties; and

means to assign said credential rank.

7. A declarative language system for specifying in a annotated policy specification a security policy of a network event, wherein said network event comprises a stack having a plurality of protocol events, wherein each of said plurality of protocol events is associated with a predefined protocol layer, and wherein said network event is an interaction between an active principal and passive principal, said declarative language system comprising:

a declarative language comprising a plurality of objects, such that each object of said plurality of objects comprises at least one list having a first element;

a declarative language editor for providing means for specifying in a first policy specification said security policy using said declarative language;

a declarative language compiler for providing means for compiling said first policy specification and generating said annotated policy specification;

means for loading said annotated policy specification into a Policy Engine;

means for said Policy Engine to receive said network event from an Agent;

means for said Policy Engine to evaluate said security policy against said network event and to generate a disposition for said network event;

means for said Policy Engine to communicate agent directives to said Agent;

means for said Policy Engine to output said network event and said disposition to a datastore; and

an annotated specification language;

wherein said first policy specification further comprises:

a plurality of credentials,

a plurality of conditions, and

a plurality of rules;

wherein means for compiling comprises:

means for checking said first policy specification for syntax errors and semantics errors;

means for checking said first policy specification for credential errors;

means for checking said first policy specification for condition errors;

means for checking said first policy specification for completeness and coverage of said plurality of rules;

means for ordering said plurality of credentials by using said annotated specification language, whereby for each of said plurality of credentials a credential rank is determined; and

means for ordering said plurality of rules by using said annotated specification language;

wherein means for ordering said plurality of rules comprises:

a plurality of predetermined protocols;

a plurality of predetermined protocol-action groups;

means to assign each of said rules to one of said predetermined protocols;

means to assign each of said rules to one of said predetermined protocol-action groups;

means to rank each of said rules in said predetermined protocol-action groups by using said credential ranking value for said target credential of said rule and by using said credential ranking value for said initiator credential of said rule; and

means to sort in increasing order each of said ranked rules in said predetermined protocol-action groups; and

means to force said rule ranking value for any of each of said rules using said annotated specification language, said annotated specification language having a rank-above expression having a rule-name parameter;

wherein means to force said rule ranking value comprises:

generating a new ranking level for said forced ranked rule, whereby each of said rules having a rule ranking level at forced level or higher are incremented.

8. A method for evaluating a policy using a plurality of policy rules, each rule having a ranking and a disposition, to a protocol event reported by an Agent, said protocol event having a protocol, a protocol action, a target credential, and an initiator credential, comprising the steps of:

selecting a first set of rules from said plurality of policy rules, such that each rule is associated with said Agent;

selecting a second set of rules from said first set of rules, such that each rule is associated with said protocol from said event;

selecting a third set of rules from said second set of rules, such that each rule is associated with said protocol action from said event;

searching for a most specific policy rule from said third set, such that said most specific policy rule is satisfied by said protocol event and generating an error disposition when said most specific policy rule is undetermined;

checking said third set of rules for a fourth set of rules having same said ranking as said selected most specific policy rule; and

providing means to select a single applicable rule from said fourth set of rules;

wherein the step of providing means to select a single applicable rule further comprises the steps of:

designating any rule of said fourth set of rules that specifies all of said plurality of protocols as less specific;

designating any rule of said fourth set of rules that specifies all of said plurality of protocol actions as less specific;

designating any rule of said fourth set of rules having prerequisite rules as more specific, wherein a rule having a higher ranking prerequisite is more specific than a rule having a lower ranking prerequisite;

sorting any remaining rules in increasing lexical order by said names and thereafter by said immediate dispositions in decreasing order of precedence; and

selecting said single applicable rule from first rule of said sorted rules.

9. A method for evaluating a policy using a plurality of policy rules, each rule having a ranking and a disposition, to a protocol event reported by an Agent, said protocol event having a protocol, a protocol action, a target credential, and an initiator credential, comprising the steps of:

selecting a first set of rules from plurality of policy rules, such that each rule is associated with said Agent;

selecting a second set of rules from said first set of rules, such that each rule is associated with said protocol from said event;

selecting a third set of rules from said second set of rules, such that each rule is associated with said protocol action from said event;

searching for a most specific policy rule from said third set, such that said most specific policy rule is satisfied by said protocol event and generating an error disposition when said most specific policy rule is undetermined;

checking said third set of rules for a fourth set of rules having same said ranking as said selected most specific policy rule; and

providing means to select a single applicable rule from said fourth set of rules;

wherein the step of providing means to select a single applicable rule further comprises the steps of:

designating any rule of said fourth set of rules that specifies all of said plurality of protocol as less specific;

designating any rule of said fourth set of rules that specifies all of said plurality of protocol actions as less specific;

designating any rule of said fourth set of rules having prerequisite rules as more specific, wherein a rule having a higher ranking prerequisite is more specific than a rule having a lower ranking prerequisite;

sorting any remaining rules in increasing lexical order by said names and thereafter by said immediate dispositions in decreasing order of precedence; and

selecting said single applicable rule from first rule of said sorted rules; and

wherein said immediate dispositions in decreasing order of precedence comprises:

a policy violation;

CONTINUE; and

OK.

Description

BACKGROUND OF THE INVENTION

1. Technical Field

The invention relates to security and network services. More particularly, the invention relates to a declarative language system used in defining policy for an entire network and in providing monitoring and enforcing of computer network security.

2. Description of the Prior Art

Security administrators need tools that help them formulate their site security policy and translate it into monitoring and enforcement mechanisms. They need to be sure that the computer enforced policy--often cobbled together from a plethora of disjoint access control mechanisms--matches their enterprise policy, all too often specified in a loose natural language or a set of unwritten principles. This leads to confusion as to why access is being granted or denied to particular resources and may lead to unintentional breaches of security.

A way to reduce or eliminate the confusion described above is by providing a user-friendly and, yet, rigorous way of specifying security policy, as well as providing tools for monitoring and enforcing the security policy.

Blaze, Feigenbaum, and Lacy (BFL), Decentralized Trust Management, Proc. IEEE Conference on Security and Privacy (1996), used the term trust management to refer to a problem of deciding whether requested actions, supported by credentials, conform to policies. In other words, it deals with the questions of who, how, and what. Who (the principals, for example, people, computers and organizations) can access what (the resources being sought) and how (the actions performed against the target resources).

Mansouri-Samani, et al, GEM: A Generalized Monitoring Language for Distributed Systems, Distributed Systems Engineering, vol.4, no. 2 96-108 (June 1997) discloses a generalized-event monitoring notation that permits user-specified filtering and composition scripts to be dynamically loaded into distributed-event monitoring components. GEM uses "scheduled time events and default or user-defined detection windows" to cope with "variable communication delay problems." The GEM event monitoring system is used "to detect complex event sequences and to convert these into simple events" that trigger management actions. The event monitors have been restricted to performing "very simple activities related to triggering or notifying events."

J. A. Grompone, A Declarative Language for the Configuration of Exchanges, Telecommunications Journal, vol. 56, no.1 (January 1989) discloses the design and implementation of a high-level language, LEP, to define the routing and customizing of rules of a telex exchange. The routing concepts are basic and few in number. Each of the physical communication paths is called a line. The lines are arranged in groups. The purpose of the LEP language is to provide a comprehensive definition of all lines of an exchange, the arrangement of these lines in groups and the physical attributes of the groups. All groups taken together comprise all the lines without any lines missing or being repeated. A group is an ordered set of lines. The LEP term "access" is used to denote whether lines are permitted or forbidden to access other lines or services. Routing, a basic objective of an LEP program, is a way of associating sets of compiled codes with destinations, done through a sequence of elementary declarations. LEP also defines the possible destinations of a call. One of the main design concepts was to use a very simple structure for the declarations for even users unfamiliar with computer programming.

The LEP language cannot thread together multiple protocol layers of a network event. The LEP language lacks the sophistication in terms of richer expressions to allow a set of policy rules affecting different networking protocols to be applied to a complex protocol interaction between two communicating parties, and to security policy for an entire network. The LEP language does not suggest defining allowed traffic patterns and handling those events that deviate from those patterns.

Plasek, et al, Statistical Database Query Using Random Sampling Of Records, U.S. Pat. No. 5,878,426, discloses a method for obtaining decision support query results from a database table having multiple records. An attribute of the database table is sampled, which results in a collection of sampled data. The sampled data represents some percentage of all of the data corresponding to that attribute in the database table. The data associated with the attribute includes multiple data classes, and the sampled data is separated or partitioned into these data classes. A database query is applied to the sampled data rather than to all of the data corresponding to that attribute in the database table.

Plasek, et al, also discloses a method to obtain decision support query results from a database table where all of the data associated with a particular database attribute is grouped into various data classes. Each of the data classes is individually randomly sampled to obtain a corresponding number of class data samples. Each of the class data samples is then queried, which can include executing aggregation functions on each of the class data samples.

Plasek, et al, also discloses a method for providing result approximations in database queries.

Plasek, et al, does not disclose nor suggest providing a method to select a most specific and applicable result or policy rule. Plasek, et al, does not disclose nor suggest providing a method to rank data and does not order data in a database beyond partitioning data into classes and thereafter randomly sampling each data class such that database queries are applied to each of the samples.

Plasek, et al, does not disclose nor suggest providing a ,method to thread protocol layers of a network event together to provide a result to the network event.

Chow, et al, System, Method, and Program for Extending a SQL Compiler for Handling Control Statements Packaged with SQL Query Statements, U.S. Pat. No. 5,875,334 (Feb. 23, 1999) discloses an integrated compiler for compiling SQL3 control statements having procedural, i.e., control, information packaged together with query, i.e., non-procedural, statements. A query extractor contained within the parser extracts the query statement from the control statement leaving a control skeleton. The query statement is processed as usual through a query compiler for generating executable plans with the exception that the name resolution function for resolving variables is modified for looking up local variables. This modification takes into account the mapping of local and host variables to create a unification of local and host variables. The control skeleton is processed through a control analyzer which generates a representation of the control flow and a scope and symbol table. The control analyzer also unifies the local and host variables. A plan synthesizer then takes as input the control flow information, symbol tables, and individual executable plans for the query statements and generates a meta-plan comprising a merger of a top level plan for the control skeleton and sub-plans representing the executable plans of the query statement.

Chow, et al, does not disclose nor suggest a ranking method or an ordering method to handle a set of rules to be applied to a complex protocol interaction between two communicating parties.

Nor does Chow, et al, disclose or suggest a method whereby to thread protocol layers of a network event together to provide a rule applicable to the network event.

V. Paxson, Bro: A System for Detecting Network Intruders in Real-Time, Network Research Group, Lawrence Berkeley National Laboratory, Berkeley, Calif., LBNL-41197 (January 1998) discloses a stand-alone system for detecting network intruders in real-time by passively monitoring a network link over which the intruder's traffic transits. The system comprises a "policy script interpreter" that interprets event handlers written in a specialized language used to express a site's security policy. The specialized language is C-style because it comprises, for example, C-style data types and constants, operators, and block statements and is procedural. Bro comprises first-class values and aggregate types such as record and table, used to specify a security policy.

However, Paxson does not disclose nor suggest providing a sophisticated ranking method to rank policy rules according to the specificity of the initiator and target communicating hosts and to select a most applicable rule in an efficient manner. Paxson does not disclose nor suggest providing a method to thread protocol layers of a network event together to provide a result to the entire network event.

It would be advantageous to reduce or eliminate the confusion described herein above by providing a user-friendly and, yet, rigorous way of specifying security policy, as well as providing tools for monitoring and enforcing the security policy.

It would be advantageous to have a trust manager that takes as its input a security policy defined as a set of policy rules (statements about trust) and a set of credentials (statements about principals), such that it is capable of processing requests for trust decisions, i.e. evaluating compliance with the policy.

It would be advantageous for the trust manager to have a unified view of an interaction between two principals across a stack of protocol layers, each governed by discreet policy rules, and to apply a final trust decision based on which of these policy rules better fits the entire interaction. For example, using HTTPS to access a secure web page involves an interaction between two network addressable machines (at the TCP/IP level), an interaction between a cryptographically authenticated server and, possibly, a cryptographically authenticated client (at the SSL level), and an interaction between a Web browser (possibly with its own authentication credentials) and a web server, resulting in the retrieval of a web page (at the HTTP level).

It would be advantageous to have a policy definition language as well as well-designed algorithms to support monitoring and auditing network activity, in addition to traditional access/deny authorization decisions. For example, a policy rule might instruct a monitoring Agent to log all traffic between two computers or to decrypt a secure channel between two users.

It would be advantageous to provide a system that comprises a passive monitor of network traffic that does not need to be installed on target hosts or integrated into existing applications.

It would be advantageous to provide a system that uses a sophisticated algorithm for determining which policy rules take precedence over others.

It would be advantageous to provide a policy language that allows a set of policy rules affecting different networking protocols to be applied to a complex protocol interaction between two communicating parties. Also, it would be advantageous to use the policy language to express security policy for an entire network.

It would be advantageous to provide a system, unlike current Intrusion Detection Systems (IDS) which only look for signatures of known attacks, focusing on defining allowed traffic patterns and determining how to handle events that deviate from those patterns.

SUMMARY OF THE INVENTION

The invention is a declarative language system and comprises a language as a tool for expressing network security policy in a formalized way. It allows the specification of security policy across a wide variety of networking layers and protocols. Using the language, a security administrator assigns a disposition to each and every network event that can occur in a data communications network. The event's disposition determines whether the event is allowed (i.e. conforms to the specified policy) or disallowed and what action, if any, should be taken by a system monitor in response to that event. Possible actions include, for example, logging the information into a database, notifying a human operator, and disrupting the offending network traffic.

The language is implemented by a Policy Engine, a component also of a Security Policy Monitoring (SPM) system. The SPM system, also referred to herein as the Policy Monitoring System, is ideally suited for network and security assessments where real network traffic is analyzed in order to identify abnormal traffic patterns, system vulnerabilities and incorrect configuration of computer systems on the network.

Unlike other trust management systems, the SPM is designed to be a passive monitor of network traffic. As such, it need not be installed on target hosts or integrated into existing applications.

The invention provides a simple and intuitive model for expressing and applying security policies. The language is much richer in terms of what it can express than languages used in firewalls and routers. It uses a sophisticated, algorithm for determining which policy rules take precedence over others, a process that in other systems is completely manual.

Unlike existing firewalls and routers, the invention allows a set of policy rules affecting different networking protocols to be applied as a whole to a complex protocol interaction between two communicating parties. Furthermore, networking equipment typically handles only policy related to the network traffic that flows through it. Using the invention herein one can express the security policy for an entire network.

Unlike IDS systems, which look for the signatures of known attacks, the SPM is focused on defining allowed traffic patterns and how to handle events that deviate from those patterns.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram showing the relationship of elements of the Policy Monitoring System, according to the invention;

FIG. 2 is a schematic diagram of a protocol event according to the invention;

FIG. 3 is a schematic diagram of a disposition according to the invention;

FIG. 4 is a schematic diagram of communicating parties according to the invention;

FIG. 5a is a schematic diagram of a network event, comprising protocol events at different protocol layers, having an associated network event disposition according to the invention; and

FIG. 5b is an algorithm showing protocol events at different protocol layers resulting in pending rules with or without immediate outcomes and, finally, a final disposition for the network event.

DETAILED DESCRIPTION OF THE INVENTION

Overview

FIG. 1 is a schematic diagram showing the relationship of elements of the Policy Monitoring System 100, according to the preferred embodiment of the invention. To effect a security policy decision, a policy manager module invokes a Policy Engine 101 with both a reference to a pre-defined security policy and a number of inputs it received from an Agent 102. These inputs describe a protocol event such as a TCP connection, an SSL session, or an HTTP GET. The end to end interaction between two communicating entities comprises one or more protocol events and it is termed a network event 103. For example, the retrieval of a web page from a web server by a web browser is a network event that typically consists of an IP protocol event, a TCP protocol event and an HTTP protocol event.

In the preferred embodiment the Policy Engine 101 consults a policy information database, a Policy Store 104 to determine a policy rule that applies to the network event 103. In the preferred embodiment the Policy Engine 101 collects input from the Agent 102 about each protocol event until it has enough information to consult the Policy Store 104. Once an applicable policy rule for the entire network event 103 has been found, the Policy Engine 101 returns a disposition 105 for the event to the policy manager module which in turn forwards it to the Agent 102, to a logging subsystem and, optionally, to an enforcement subsystem.

A definition of a protocol event is provided to facilitate understanding of the invention. A protocol event 120 as shown in FIG. 2 comprises the following elements:

1) The Principals. Every policy decision involves two principals: an initiator 121 (an active principal) and a target 122 (a passive principal). Principals are identified by a set of one or more credentials, depending on how much information is known about them and what protocol service they are using. There are three types of credentials:

a) Host credentials. These are the physical network address, i.e. a MAC address, and the network attachment point, e.g. an IP address and port number.

b) User credentials. These may be weak credentials, e.g. a user name and password, or strong credentials, e.g. an X.509 certificate.

c) Object credentials. These identify a resource or an application, e.g. a URL or a pathname.

2) The Protocol. The protocol service 123 associated with this protocol event 120.

3) The Security Quality of Service Parameters. Some protocols include security QOS parameters 124 and these may be subject to local security policy constraints. For example, in the SSL protocol the ciphersuite negotiated between the SSL client and the SSL server is a security QOS parameter.

4) The Action. Every interaction between an initiator and a target over a given protocol service involves a specific action 125. Clearly, not all actions are of interest to the policy manager module. For example, in the SSL protocol only actions pertaining to the establishment or termination of an SSL session, most notably, the negotiation of security parameters for the session are of interest. In the LDAP protocol, on the other hand, a security policy administrator may wish to express policy statements about different LDAP data manipulation operations, such as, the SEARCH and MODIFY operations.

In one embodiment of the invention, while processing a network event 103, and before issuing a final ruling, the Policy Engine 101 may instruct the Agent 102 to carry out specific actions against the network event 103. For example, the Agent 102 may be asked to decrypt subsequent SSL traffic or it may be asked to impose a specific ciphersuite on the target system. These instructions constitute an intermediate output of the Policy Engine 101 and are issued in the form of agent directives, defined herein below.

Once the Policy Engine 101 arrives at a final policy decision, it produces a disposition 105 for the event 103. The disposition 105 as shown in FIG. 3 comprises the following elements:

1) Disposition Code. The disposition code 131 denotes whether or not the event 103 complies with the security policy and, if not, identifies the specific policy violation. A list of possible codes in a preferred embodiment is given in Table A herein below. This field is mandatory.

2) Logging Directives. The logging directives field 132 includes a severity code, denoting the severity of the policy violation. A list of possible severity values in a preferred embodiment is given herein below in Table B. The severity code may be used by a logging subsystem to filter the event 103 and its disposition 105 or to control a notification action, e.g. page a network operator. In another embodiment the logging directives 132 may also include an optional human readable description summarizing the specific policy that determined the final disposition 105 e.g. "blue users cannot access the red server". The logging directives field 132 is mandatory if the disposition code 131 indicates a policy violation.

3) Agent Directives. Agent directives 102 are any instructions that need to be communicated to the Agent 102 and in another embodiment to more than one Agent. For example, the Agent 133 may be instructed to log all traffic associated with the event 103 or to disrupt communications between the initiator 121 and the target 122. In some embodiments, an Agent 102 only supports monitoring functions, or only enforcement functions, or be limited in its support of other types of functions. In, a preferred embodiment, a policy manager is responsible for distributing a set of directives to appropriate Agents.

4) Event Constraints. Event constraints 134 are any constraints to be applied to the event 103. For example, in one embodiment these constraints are protocol-specific constraints such as the maximum lifetime of a TCP connection or the maximum lifetime of an SSL session. In another embodiment, these constraints are communicated to the Agent reporting the event or simply to a policy manager.

                             TABLE A
                         Built-in Objects
    The following is a set of built-in language objects known to both the
    policy compiler and the policy engine.
    First the built-in groups. It should be noted that, unlike user-defined
    groups, built-in groups cannot be extended in a policy specification.
    // List of supported protocols
    ( group all-protocols  protocol_t
        ( union IP UDP ICMP TCP SSL HTTP )
        // NOTE: new protocols can be added as needed
    )
    // List of supported hash algorithms
    ( group hash-algorithms  hash_alg_t
        ( union MD5 SHA1 )
    )
    // List of supported agent directives
    ( group agent-directives  agent_directive_t
        ( union DECRYPT DISRUPT LOG_TRAFFIC )
    )
    // List of supported logging severity codes
    ( group severity-codes  severity_t
        ( union CRITICAL HIGH MEDIUM WARNING MONITOR
        INFORMATION )
    )
    // List of supported disposition codes
    ( group disposition-codes  code_t
        ( union OK CONTINUE ACCESS_DENIED
        AUTHENTICATION_VIOLATION
            SECURITY_ATTACK SECURITY_QOS POLICY.sub.--
            ERROR )
    )
    // Certificate status values for valid certificates
    ( group valid-certs cert_status_t
        ( union  VALID )
    )
    // Certificate status values for certificates rendered invalid
    ( group invalid-certs cert_status_t
        ( union EXPIRED NOT_YET_VALID REVOKED SUSPENDED )
    )
    // Certificate status values for rejected certificates
    ( group rejected-certs cert_status_t
        ( union  MALFORMED UNSUPPORTED_CRITICAL.sub.--
        EXTENSION )
    )
    // Certificate status values for all bad certificates
    ( group bad-certs cert_status_t
        ( union  rejected-certs invalid-certs
    )
    // List of all possible certificate status values
    ( group cert-status-values  cert_status_t
        ( union  valid-certs invalid-certs rejected-certs )
    )
    // List of all possible authentication status values
    ( group auth-status-values  auth_status_t
        ( union SUCCEEDED REJECTED ABORTED )
    )
    // List of all SSL ciphersuites
    ( group ssl-ciphersuites ciphersuite_t
        ( union SSL_RSA_WITH_NULL_MD5
                SSL_RSA_WITH_NULL_SHA
                SSL_RSA_EXPORT_WITH_RC4_40_MD5
                SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
                SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
                SSL_RSA_WITH_RC4_128_MD5
                SSL_RSA_WITH_RC4_128_SHA
                SSL_RSA_WITH_IDEA_CBC_SHA
                SSL_RSA_WITH_DES_CBC_SHA
                SSL_RSA_WITH_3DES_EDE_CBC_SHA
                SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA
                SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA
                SSL_DH_RSA_WITH_DES_CBC_SHA
                SSL_DH_DSS_WITH_DES_CBC_SHA
                SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
                SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
                SSL_DH_ANON_EXPORT_WITH_RC4_40_MD5
                SSL_DH_ANON_WITH_RC4 _128_MD5
                SSL_DH_ANON_EXPORT_WITH_DES40.sub.--
                CBC_SHA
                SSL_DH_ANON_WITH_DES_CBC_SHA
                SSL_DH_ANON_WITH_3DES_EDE_CBC_SHA
                SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
                SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
                SSL_DHE_RSA_EXPORT_WITH_DES40.sub.--
                CBC_SHA
                SSL_DHE_DSS_EXPORT_WITH_DES40.sub.--
                CBC_SHA
                SSL_DHE_RSA_WITH_DES_CBC_SHA
                SSL_DHE_DSS_WITH_DES_CBC_SHA
                SSL_FORTEZZA_KEA_WITH_NULL_SHA
                SSL_FORTEZZA_KEA_WITH_FORTEZZA.sub.--
                CBC_SHA
                SSL_FORTEZZA_KEA_WITH_RC4_128_SHA
                SSL_V2_RC4_128_WITH_MD5
                SSL_V2_RC4_128_EXPORT40_WITH_MD5
                SSL_V2_RC2_CBC_128_CBC_WITH_MD5
                SSL_V2_RC2_CBC_128_CBC_EXPORT40.sub.--
                WITH_MD5
                SSL_V2_IDEA_128_CBC_WITH_MD5
                SSL_V2_DES_64_CBC_WITH_MD5
                SSL_V2_DES_192_EDE3_CBC_WITH_MD5
        )
    )
    // List of supported action codes for TCP
    ( group tcp-action-codes  action_t
        ( union  CONNECT
                    MISSED_CONNECT
                    TIMEOUT
                    ABORT
                    CLOSE )
    )
    // List of supported action codes for UDP
    ( group udp-action-codes  action_t
        ASSOCIATION
    )
    // List of supported action codes for IP
    ( group ip-action-codes  action_t
        ASSOCIATION
    )
    // List of supported action codes for ICMP
    ( group icmp-action-codes  action_t
        ( union ASSOCIATION
                BAD_CODE
                FRAGMENTATION_NEEDED
                HOST_UNREACHABLE
                NETWORK_UNREACHABLE
                PORT_UNREACHABLE
                PROTOCOL_UNREACHABLE
                SOURCE_ROUTE_FAILED
                ECHO
                ECHO_REPLY
                INFORMATION_REQUEST
                INFORMATION_REPLY
                PARAMETER_PROBLEM
                REDIRECT_HOST
                REDIRECT_TYPE_OF_SERVICE_AND_HOST
                REDIRECT_NETWORK
                REDIRECT_TYPE_OF_SERVICE_AND_NETWORK
                SOURCE_QUENCH
                TIME_TO_LIVE_EXCEEDED
                REASSEMBLY_TIME_EXCEEDED
                TIMESTAMP
                TIMESTAMP_REPLY )
    )
    // List of supported action codes for SSL
    ( group ssl-action-codes  action_t
        ( union HANDSHAKE
                MISSED_HANDSHAKE
                SESSION_CLOSED
                SESSION_ABORTED
    )
    // List of supported action codes for HTTP
    ( group http-action-codes  action_t
        ( union GET
                HEAD
                POST
                PUT
                DELETE
                OPTIONS
                TRACE
                CONNECT
                MISSED_REQUEST
                RESPONSE )
    )
    // List of all supported action codes
    ( group all-action-codes  action_t
        ( union udp-action-codes
                ip-action-codes
                icmp-action-codes
                tcp-action-codes
                ssl-action-codes
                http-action-codes )
    )

    disposition ok
        ( code OK )
    )
    ( disposition continue
        ( code CONTINUE )
    )
    ( disposition policy-error
        ( description "Policy error caused by uncaught event" )
        ( code POLICY_ERROR )
        ( log-directive
            CRITICAL
            "Uncaught event" )
    )
    ( rule default-rule
        ( description "Catch-all rule for all protocols" )
        ( protocol present )
        ( action present )
        ( initiator ignore )
        ( target ignore )
        ( outcome
            ( final
                ( default policy-error )
            )
        )
    )

                TABLE B
                An example of an advanced representation:
                 ( certificate ( issuer alice ) ( subject bob ) )
                An example of a canonical representation:
                 (11:certificate(6:issuer5:alice) (7:subject3:bob))

    TABLE C
    This table contains a Backus-Naur Form (BNF) description of the
    grammar for the policy specification language, including an annotation
    section. All valid policies derive from the <policy> production.
    This grammar applies to the policy specification after all comments are
    removed and all macros are expanded. Comments begin with
     .quadrature.//.quadrature.
    and extend to the end-of-line. Macros are defined using the C
    macro syntax.
    Incomplete parts of the grammar are noted in italics.
    Terminals are shown in bold.
    //
    // Basic language stuff
    //
    // Terminals requiring further syntax specification
        <integer> ::= TBD      // [0-9]*
         <symbol> ::= TBD      // alphanumeric and `-`,
                                     // `_`, starts with letter
         <string> ::= <concat> .vertline. TBD // any ASCII
     character
                                     // enclosed in double-quotes
            <mac-addr> ::= TBD // 6 hex byte values
                                     // separated by `-`
             <ip-addr> ::= TBD // IPv4 dotted decimal
                                     // notation
             <ip-mask> ::= TBD // address prefix per
                                     // RFC-2280
          <hex-string> ::= TBD // n hex byte values
                                     // separated by `:`
        <version-string> ::= TBD // a string of the form
                                     // <major>.<minor>
    // Some productions used only for clarity
                <name> ::= <symbol>
                <type> ::= <symbol>
            <attr-name> ::= <symbol>
    // The basic types in the language
          <atom> ::= <symbol> .vertline. <integer> .vertline.
     <string> .vertline.
                           <ip-addr> .vertline. <mac-addr>
     .vertline.
                           <version> .vertline. <hash-atom>
     .vertline. <bool>
    //
    // Productions for the policy specification section
    //
    // These are values that describe the values of things with values
    <meta-value> ::= present .vertline. absent .vertline. ignore
    // Productions used in a few places
     <assertion> ::= ( assertion <bool-expr> )
    // Version conversion function
       <version> ::= ( version <version-string> )
    // Attributes, used as arguments in predicates and other operations
    <attr-part-list> ::= <atom> .vertline.
                           <attr-part-list> <atom>
       <attr-op> ::= ( <attr-name> <attr-part-list> )
     <attribute> ::= <attr-name> .vertline. <attr-op>
    // Hashes
    <hash-alg-name>::= [Some set of terminals of type hash.sub.--
     alg.sub.-- t]
       <hash-op> ::= ( hash <hash-alg-name> <attribute> )
     <hash-atom> ::= <hex-string>
          <hash> ::= <hash-atom> .vertline. <hash-op>
    // Operations that operate on attributes and return a
    // basic type (atom)
      <atom-ops> ::= <hash-op>
    // Predicates - used in building boolean expressions
    <generic-compare-op> ::= eq
    <num-compare-op> ::= gt .vertline. lt .vertline. ge .vertline. le
    <rng-compare-op> ::= range
    <string-compare-op> ::= prefix .vertline. substring
    <member-compare-op> ::= member
    <ipmask-compare-op> ::= ip-mask
    <iprng-compare-op> ::= ip-range
    <cred-match-op> ::= root .vertline. has
    <presence-op> ::= present .vertline. absent
    // Generic argument
           <arg> ::= <attribute> .vertline. <atom> .vertline.
     <atom-ops>
    <generic-cmp-arg> ::= <arg>
    <generic-compare> ::= ( <generic-compare-op>
                            <generic-cmp-arg> <generic-cmp-arg> )
    <num-cmp-arg> ::= <attribute> .vertline. <integer>
     .vertline. <version>
    <num-compare> ::= ( <num-compare-op>
                             <num-cmp-arg> <num-cmp-arg> )
     .vertline.
                            ( <rng-compare-op>
                            <num-cmp-arg>
                           <num-cmp-arg> <num-cmp-arg> )
    <string-cmp-arg> ::= <attribute> .vertline. <string>
    <string-compare> ::= ( <string-compare-op>
                             <string-cmp-arg> <string-cmp-arg> )
    <member-cmp-arg> ::= <arg>
    <member-part-list> ::= <member-cmp-arg> <union>
     .vertline.
                           <member-cmp-arg> <member-cmp-arg> )
    <member-compare> ::= ( <member-compare-op>
                           <member-part-list> )
    <ipmask-compare> ::= ( <ipmask-compare-op>
                             <attribute> <ip-mask> )
    <iprng-cmp-arg> ::= <attribute> .vertline. <ip-addr>
    <iprng-compare> ::= ( <iprng-compare-op>
                             <iprng-cmp-arg>
                             <iprng-cmp-arg> <iprng-cmp-arg> )
    <cred-match> ::= ( <cred-match-op> <attribute>
                           <cred-name> )
      <presence> ::= ( <presence-op> <attribute> )
     <predicate> ::= <generic-compare> .vertline.
     <num-compare> .vertline.
                           <string-compare> .vertline.
     <member-compare> .vertline.
                           <ipmask-compare> .vertline.
     <iprng-compare> .vertline.
                           <cred-match> .vertline. <presence>
    // Boolean expressions
    <bool-list-op> ::= and .vertline. or
    <bool-monadic-op> ::= not
          <bool> ::= TRUE .vertline. FALSE
     <bool-list> ::= <bool-expr> .vertline. <bool-list>
     <bool-expr>
     <bool-expr> ::= <name> .vertline. <bool> .vertline.
     <predicate> .vertline.
                           ( <bool-monadic-op> .vertline.
     <bool-expr> ) .vertline.
                           ( <bool-list-op> <bool-list> )
    // Descriptions are comments that are carried along with the constructs
    <string-list> ::= <string> .vertline. <string-list>
     <string>
    <description> ::= ( description <string-list> )
    // When we need to break up a string across lines, we use concat to
    // put it back together (just like descriptions)
        <concat> ::= ( concat <string-list> )
    // Unions are unnamed collections of one or more symbols
    // (with matching types)
    <union-symbol> ::= <atom> .vertline. <group-name>
    <union-list> ::= <union-symbol>      .vertline.
                           <union-list> <union-symbol>  .vertline.
                           ( union <union-list> )   .vertline.
                           <union-list> ( union <union-list> )
         <union> ::= ( union <union-list> ) .vertline.
     <union-symbol>
    // Groups are named and typed unions (all symbols must have one type)
    <group-part-list> ::= <union> .vertline. <description>
     <union> .vertline.
                           <union> <description>
    <group-name> ::= <name>
         <group> ::= ( group <group-name> <type>
                           <group-part-list> )
    // Credentials
     <cred-part> ::= <description> .vertline. <assertion>
    <cred-part-list> ::= <cred-part> .vertline.
     <cred-part-list> <cred-part>
     <cred-name> ::= <name>
    <credential> ::= ( credential <cred-name>
                            <cred-part-list> )
    // Dispositions
    <agent-directives> ::= [Some set of terminals of type
                           agent-directive.sub.-- t]
    <agent-directive-list> ::= <agent-directives> .vertline.
                           <agent-directive-list>
     <agent-directives>
    <agent-directive> ::= ( agent-directive <agent-directive-list>
     )
          // preliminary list of severity codes; more TBD
    <log-severity> ::= [Some set of terminals of type severity.sub.-- t]
    <log-directive> ::= ( log-directive <log-severity>
     <string> ) .vertline.
                           ( log-directive <log-severity> )
         // preliminary list of disposition codes; more TBD
    <disposition-code> ::= [Some set of terminals of type code.sub.-- t]
     <disp-code> ::= ( code <disposition-code> )
     <disp-part> ::= <description> .vertline.
     <disp-code>.vertline.
                           <log-directive> .vertline.
     <agent-directive>
    <disp-part-list> ::= <disp-part> .vertline.
     <disp-part-list> <disp-part>
    <disposition-name>::= <name>
    <disposition> ::= ( disposition <disposition-name>
                           <disp-part-list> )
    // Conditions
    <condition-part-list> ::= <description> <assertion>
     .vertline.
                           <assertion> <description> .vertline.
                           <assertion>
    <condition-name>::= <name>
     <condition> ::= ( condition <condition-name>
                           <condition-part-list> )
    // Outcomes are bindings of conditions to dispositions used in rules
    <outcome-default> ::= ( default <disposition-name> )
         <guard> ::= if .vertline. ifnot
    <outcome-clause> ::= ( <guard> <condition-name>
                             <disposition-name> )
    <outcome-list> ::= <outcome-default> .vertline.
                           <outcome-clause> <outcome-list>
     <immediate> ::= ( immediate <outcome-list> )
         <final> ::= ( final <outcome-list> )
    <outcome-types> ::= <immediate> .vertline.
     <final>.vertline.
                           <immediate> <final> .vertline.
                           <final> <immediate>
       <outcome> ::= ( outcome <outcome-types> )
    // Rules
      <protocol> ::= ( protocol <union> ) .vertline.
                           ( protocol <meta-value> )
        <action> ::= ( action <union> ) .vertline.
                           ( action <meta-value> )
     <initiator> ::= ( initiator <cred-name> ) .vertline.
                           ( initiator <meta-value> )
        <target> ::= ( target <cred-name> ) .vertline.
                           ( target <meta-value> )
         <agent> ::= ( agent <cred-name> )
     <rule-name> ::= <name>
     <rule-list> ::= <rule-name> .vertline. <rule-list>
     <rule-name>
    <prerequisite> ::= ( prerequisite <rule-list> )
    <rank-above> ::= ( rank-above <rule-name> )
     <rule-part> ::= <description> .vertline. <protocol>
     .vertline. <action> .vertline.



                           <initiator> .vertline. <target>
     .vertline. <outcome> .vertline.
                           <prerequisite> .vertline. <rank-above>
     .vertline. <agent>
    <rule-part-list> ::= <rule-part> .vertline.
     <rule-part-list> <rule-part>
          <rule> ::= ( rule <rule-name>
                            <rule-part-list> )
    // Policy is the top-level construct of the policy
    // specification section
    <policy-part> ::= <description> .vertline. <group>
     .vertline. <credential> .vertline.
                           <condition> .vertline. <disposition>
     .vertline. <rule>
    <policy-part-list> ::= <policy-part> .vertline.
                           <policy-part-list> <policy-part>
    <policy-name> ::= <name>
    <language-version> ::= <version-string>
        <policy> ::= ( policy <policy-name>
     <language-version>
                           <policy-part-list> )
    //
    // Productions for the annotation section
    //
    <assertion-type> ::= <meta-value> .vertline. single-value
     .vertline. multi-value
        <weight> ::= ( weight <symbol> <assertion-type> )
    <weight-penalty> ::= ( weight-penalty <integer> )
    <rank-cred-part> ::= <weight> .vertline. <weight-penalty>
    <rank-cred-part-list> ::= <rank-cred-part> .vertline.
                            <rank-cred-part-list> <rank-cred-part>
    <ranked-credential> ::= ( ranked-credential <cred-name>
                           <rank-cred-part-list>
    // Annotation is the top-level construct of the annotation section
    <annotation-part-list> ::= <ranked-credential> .vertline.
                           <annotation-part-list>
     <ranked-credential>
    <annotation> ::= ( annotation <policy-name>
                           <language-version>
                           <annotation-part-list> )

                             TABLE D
                              Types
    The subtables in this section describe, in a pseudo-formal manner, the
    type information in the language that is enforced by the parser.
    The types used should be self-evident.
    First some notation used throughout the tables:
    ( list-of type ) - ( foo ( list-of T ) ) .fwdarw. ( foo A B C ) where A, B,
    and C are of the type T; the list must have at least one element.
    ( multi-of type ) - ( foo ( multi-of T ) ) .fwdarw. ( foo ( union A B C ) )
    where A, B, and C are of the type T or .fwdarw. ( foo ABC ) where ABC is
     the
    name of a group of type T.
    ( mix-of type1 type2 type3 ) - ( foo ( mix-of R S T ) ) .fwdarw. ( foo A B
    C D ) where A, B, C, and D are randomly of types R, S, and T.
    match - a type that is required to be the same as all other
    occurrences of match in the expression -
    ( foo match match ) requires that the two arguments of foo be of the
    same type (e.g., int_t, string_t).

                      Applicable  Argument
    Attribute Name    Protocols     Types   Result Type
    agent-attribute   all-protocols    --     (multi-of agent_attr_t)
    auth-status       SSL            --     auth_status_t
    cert-status       SSL            --     cert_status_t
    der-cert          SSL            --     octet_string_t
    encipher-keysize  SSL            --     int_t
    http-cookie       HTTP        string_t  (multi-of string_t)
    http-password     HTTP           --     string_t
    http-req-hdr      HTTP        string_t  string_t
    http-resp-hdr     HTTP        string_t  string_t
    http-set-cookie   HTTP        string_t  (multi-of string_t)
    http-status-code  HTTP           --     int_t
    http-username     HTTP           --     string_t
    icmp-gateway-     ICMP           --     ip_addr_t
    address
    icmp-nested-address ICMP           --     ip_addr_t
    icmp-nested-port  ICMP           --     int_t
    initiator-access-rate all-protocols    --     int_t
    initiator-auth-   SSL            --     int_t
    keysize
    initiator-violation- all-protocols    --     int_t
    rate
    ip-address        IP UDP TCP     --     ip_addr_t
                      ICMP
    ip-port           IP UDP TCP     --     int_t
                      ICMP
    ke-keysize        SSL            --     int_t
    mac-address       IP UDP TCP     --     mac_addr_t
                      ICMP
    protocol-version  all-protocols    --     version_t
    ssl-ciphersuite   SSL            --     ciphersuite_t
    target-access-rate all-protocols    --     int_t
    target-auth-keysize SSL            --     int_t
    target-violation-rate all-protocols    --     int_t
    url               HTTP           --     string_t
    x509-cert-path    SSL            --     cert_path_t
    x509-issuer       SSL            --     string_t
    x509-subject      SSL            --     string_t

        Operation       Result Type       Argument Types
        absent          bool_t            string_t
        and             bool_t            (list-of bool_t)
        default         disposition_t     disposition_t
        eq              bool_t            match match
        has             bool_t            cert_path_t cred_t
        hash            base64_t          hash_alg_t octet_string_t
        ge.sup.1        bool_t            match match
        gt.sup.1        bool_t            match match
        if              disposition_t     condition_t disposition_t
        ifnot           disposition_t     condition_t disposition_t
        ip-mask         bool_t            ip_addr_t ip_mask_t
    .sup.1 Operator only supports types int_t and version_t as arguments.
        ip-range        bool_t            ip_addr_t ip_addr_t
                                          ip_addr_t
        le.sup.1        bool_t            match match
        lt.sup.1        bool_t            match match
        member          bool_t            match (multi-of match)
        not             bool_t            bool_t
        or              bool_t            ( list-of bool_t )
        prefix          bool_t            string_t string_t
        present         bool_t            string_t
        range.sup.1     bool_t            match match match
        root            bool_t            cert_path_t cred_t
        substring       bool_t            string_t string_t
        version         version_t         string_t

    Object Name Object Type   .quadrature.Argument.quadrature. Types
    action      act_t         ( multi-of action_t )
    agent       agt_t         credential_t
    agent-      agtdir_t      ( multi-of agent_directive_t )
    directive
    assertion   assert_t      bool_t
    code        code_def_t    code_t
    condition   cond_t        condition_t ( mix-of desc_t
                              bool_t )
    credential  cred_t        credential_t ( mix-of assert_t desc_t
                              prot_t )
    description desc_t        ( list-of string_t )
    disposition disp_t        disposition_t ( mix-of desc_t
                              code_def_t
                              log_t agtdir_t )
    final       dispo_t       (list-of guard_t)
    group       group_t       match type_t ( multi-of match )
    immediate   dispo_t       (list-of guard_t)
    initiator   init_t        credential_t
    log-directive log_t         severity_t string_t
    outcome     out_t         ( list-of dispo_t )
    policy      policy_def_t  policy_t string_t ( mix-of desc_t
                              group_t cred_t
                              cond_t disp_t rule_t def_t )
    prerequisite pre_t         ( list-of rule_t )
    protocol    prot_t        ( multi-of protocol_t )
    rank-above  rank_t        rule_t
    rule        rule_def_t    rule_t ( mix-of desc_t agt_t prot_t act_t
                              init_t targ_t out_t pre_t rank_t )
    target      targ_t        credential_t
    union       ( multi-of    ( list-of match )
                match )

    ( policy Sample_Policy_1  "1.0"  // policy <name> <version>
        ( description "This is a policy specification description"
                "that is continued on a second line" )
        . . .
    )

        ( group SomeColors color_t    // group <name> <type>
            ( description "Some colors I like" )
            ( union RED GREEN YELLOW )
        )

              ( group RedByAnyOtherName color_t
                  ( description "Red in different languages" )
                  ( union RED ROSSO ROUGE VERMELHO )
              )

    ( group AfewOfMyFavoriteThings thing_t
      ( union RED PASTA WINE ) // ERROR! RED previously defined as
    )                          // having type color_t

            ( group MoreColors color_t
                ( union
                    SomeColors
                    RedByAnyOtherName   // overlapping ok
                    PURPLE BEIGE BURGUNDY
                )
            )

    ( group MyComputers ip_addr_t
        ( union
              207.5.63.23              // desktop at work
              207.5.63.42              // laptop
              128.7.16.64              // home computer
        )
    )

        ( credential Credentials_Example_1    // credential <name>
            ( assertion
              ( and
                ( eq ip-address 207.5.63.8 )
                ( or
                  ( eq ip-part 80 )
                  ( gt ip-port 443 )
                )
              )
            )
        )

    TABLE E
    Attribute     Applicable                    Compare
    Name          Protocols   Description       Operations
    agent-attribute all-        The attributes of the member
                  protocols.sup.2  reporting Agent, as
                              a union of symbolic
                              names
    cert-status   SSL         The validity status eq, member
                              of a certificate
    der-cert      SSL         A DER encoded     hash
                              certificate
    http-password HTTP        The password used eq, member,
                              in basic          substring, prefix
                              authentication
    http-username HTTP        The user name used eq, member,
                              in basic          substring, prefix
                              authentication
    ip-address    IP UDP      An IP address     eq, member, ip-
                  TCP ICMP                      mask, ip-range
    ip-port       IP UDP      An IP port        eq, member, gt, ge,
                  TCP ICMP                      lt, le, range
    mac-address   IP UDP      A MAC address     eq, member
                  TCP ICMP
    url           HTTP        A URL             eq, member,
                                                substring, prefix
    x509-cert-path SSL         An X.509 certificate root, has
                              chain
    x509-issuer   SSL         An X.509 certificate eq, member,
                              issuer            substring, prefix
    x509-subject  SSL         An X.509 certificate eq, member,
                              subject           substring, prefix
    .sup.2 Can be used to identify the reporting Agent in any policy rule must
     but must not be mixed with other credential attributes.

    TABLE F
    Oper-
    ation   Description
    absent  Whether (true) the attribute denoted by the operand does not
            have a value in the protocol event
    and     Logical AND of a list of boolean expressions, its operands
    eq      Whether(true) two operands have the same value
    ge      Whether (true) the first operand.quadrature.s value is greater
     than, or
            equal to, the second.quadrature.s
    gt      Whether (true) the first operand.quadrature.s value is greater than
            the second.quadrature.s
    has     Whether (true) the certificate chain defined by the first
            operand.quadrature.s value contains a certificate that satisfies
            the second operand (a credential name)
    hash    Computes a digest of the second operand.quadrature.s value using
            the hashing function defined by the first operand; returns
            the hash as a hexadecimal string
    ip-mask Whether (true) the first operand.quadrature.s value is included in
     the set
            of IP addresses defined by the second operand, an IP address
            prefix [RFC2280]; an address prefix is represented as an IPv4
            address (dotted-decimal format with four integers) followed
            by the character slash .quadrature./.quadrature. followed by an
     integer in the range
            from 0 to 32. The latter denotes the number of high-order
            bits from the preceding address that constitute a subnetwork
            address. If the subnetwork address bits match exactly the
            corresponding bits in the first operand.quadrature.s value, the
     operation
            returns true.
            The following are valid address prefixes:
            128.9.128.5132, 128.9.0.0116, 0.0.0.0/0; the
            following address prefixes are invalid: 0/0, 128.9/16 since 0
            or 128.9 are not dotted-decimal strings containing four integers.
    ip-range Whether (true) the first operand.quadrature.s value is included in
     the set of
            IPv4 addresses defined by an IP address range whose lower
            bound is the operand with the lower value and whose upper
            bound is the operand with the higher value; the three operand
            values are taken as 32-bit unsigned integers and, if the first
            operand value falls within the inclusive numerical range defined
            by the two other operand values, the operation returns true
    le      Whether (true) the first operand.quadrature.s value is less than,
     or
            equal to, the second.quadrature.s
    lt      Whether (true) the first operand.quadrature.s value is
            less than the second.quadrature.s
    member  Whether (true) the first operand.quadrature.s value is a member of
     the
            set defined by the second operand (a union)
    not     Logical negation of its operand.quadrature.s value
    or      Logical OR of a list of boolean expressions, its operands
    prefix  Whether (true) the string that constitutes the first
     operand.quadrature.s
            value includes, starting at the first character, the string
            defined by the second operand
    present Whether (true) the attribute denoted by the operand has a value
            in the protocol event
    range   Whether (true) the first operand.quadrature.s value is within the
     inclusive
            numerical range defined by the values of the second a third
            operands; the range comprises the set of values between the
            lower operand value and the higher
    root    Whether (true) the certificate chain defined by the first
            operand.quadrature.s value has, as its root, a certificate that
            satisfies the second operand (a credential name)
    sub-    Whether (true) the string that constitutes the first
     operand.quadrature.s
    string  value includes the string defined by the second operand

              ( credential Credentials_Example_2
               ( assertion
                ( or
                 Credentials_Example_1
                  and
                   ( ip-mask ip-address 207.5.0.0/16 )
                   ( range ip-port 25 443 )
                  )
                 )
                )
              )

        ( credential Credentials_Example_3
         ( assertion
          ( and
           // http-username must exist, but don't care about its value
           ( present http-username )
           // the absence of an assertion about http-password indicates
           // that its presence or absence is irrelevant
          )
         )
        )
        ( credential Credentials_Example_4
         ( assertion
          ( and
           // an X.509 certificate must not have been presented
           ( absent der-cert )
          )
         )
        )

    TABLE G
    Attribute     Applicable                         Compare
    Name          Protocols     Description          Operations
    auth-status   SSL           The status of an authen- eq, member
                                ticated session at the end
                                of the authentication
                                handshake
    encipher-     SSL           The size of the key used eq, member,
    keysize                     for data encipherment gt, ge, lt, le,
                                (e.g., size of an    range
                                IDEA key)
    http-cookie   HTTP          Takes as an argument member
                                the name of a cookie
                                in the request header
                                and returns its value(s)
                                as a union of strings
    http-req-hdr  HTTP          Takes as an argument eq, member,
                                the name of a client substring,
                                request header and   prefix
                                returns its value
    http-resp-hdr HTTP          Takes as an argument the eq, member,
                                name of a server     substring,
                                response header and  prefix
                                returns its value
    http-set-cookie HTTP          Takes as an argument the member
                                name of a cookie in the
                                response header and
                                returns its value(s)
                                as a union of strings
    http-status-code HTTP          The status code returned eq, member,
                                on HTTP responses    gt, ge, lt, le,
                                (aka response code)  range
    icmp-gateway- ICMP          The IP address of the eq, member,
    address                     gateway host on a    ip-mask, ip-
                                redirect message     range
    icmp-nested-  ICMP          The IP address carried eq, member,
    address                     in a .quadrature.destination ip-mask,
                                unreachable.quadrature. message ip-range
    icmp-nested-  ICMP          The port number carried eq, member,
    port                        in a .quadrature.destination gt, ge, lt, le,
                                unreachable.quadrature. message range
    initiator-    all-protocols The rate at which the eq, member,
    access-rate                 current active principal gt, ge, lt, le,
                                has been the initiator of range
                                communications, over a
                                predefined (configurable)
                                period of time
    initiator-auth- SSL           The size of the key used eq, member,
    keysize                     for initiator authentica- gt, ge, lt, le,
                                tion and/or digital  range
                                signatures (e.g., size
                                of public key modulus)
    initiator-    all-protocols The rate at which the eq, member,
    violation-rate               current active principal gt, ge, lt, le,
                                has been the initiator range
                                of security policy
                                violations, over a
                                predefined (configurable)
                                period of time
    ke-keysize    SSL           The size of the key-enci- eq, member,
                                pherment key (e.g., size gt, ge, lt, le,
                                of public key modulus) range
    protocol-     all-protocols The version of the   eq, member,
    version                     protocol             gt, ge, lt, le,
                                                     range
    ssl-ciphersuite SSL           The negotiated       eq, member
                                ciphersuite
    target-access- all-protocols The rate at which the eq, member,
    rate                        current passive principal gt, ge, lt, le,
                                has been the target of range
                                communications, over a
                                predefined (configurable)
                                period of time
    target-auth-  SSL           The size of the key used eq, member,
    keysize                     for target authentication gt, ge, lt, le,
                                and/or digital signatures range
                                (e.g., size of public
                                key modulus)
    target-       all-protocols The rate at which the eq, member,
    violation-                  current passive principal gt, ge, lt, le,
    rate                        has been the target of range
                                security policy viola-
                                tions, over a predefined
                                (configurable) period
                                of time

    ( group Strong_RSA_Ciphersuites ciphersuite_t
        ( description "Strong ciphers with RSA key exchange" )
        ( union SSL_RSA_WITH_RC4_128_MD5
                SSL_RSA_WITH_RC4_128_SHA
                SSL_RSA_WITH_IDEA_CBC_SHA
                SSL_RSA_WITH_3DES_EDE_CBC_SHA
                SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA
                SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
        (
    (
    ( condition SslV3StrongCiphers   // condition <name>
     ( assertion
      ( and
       ( ge protocol-version ( version "3.0" ) )
       ( member ssl-ciphersuite Strong_RSA_Ciphersuites )
       ( ge ke-keysize 768 )
       ( ge target-auth-keysize 1024 )
      )
     )
    )
    ( condition HackerTripwire
     ( assertion
      ( ge initiator-violation-rate 10
     )
    )
    ( condition ProtectSSL
     ( assertion
      ( and SslV3StrongCiphers HackerTripwire )
     )

    TABLE H
    Disposition Code  Description
    OK                The network event conforms to the security policy
    CONTINUE          Additional information is needed before determining
                      whether or not the network event conforms to the
                      security policy
    ACCESS.sub.--     Access to the target resource is denied
    DENIED            by the security policy
    AUTHEN-           Authentication between the communication parties
    TICATION.sub.--   does not conform to the requirements set out by the
    VIOLATION         security policy
    SECURITY.sub.--   A security attack has been detected
    ATTACK
    SECURITY_QOS      The security quality of service parameters associated
                      with a protocol event do not meet the requirements
                      set out by the security policy
    POLICY.sub.--     An error has been detected in
    ERROR             the security policy specification

    TABLE I
    Severity Code   Description
    CRITICAL        Critical security violation, e.g., the network is under-
                    going an active security attack
    HIGH            High-severity security violation, e.g., attempt to
                    access sensitive data
    MEDIUM          Medium-severity security violation, e.g., attempt to
                    access a protected (but not highly sensitive) resource
    WARNING         Low-severity security violation, e.g., an incorrect
                    password was entered
    MONITOR         A security violation was not detected but an unusual
                    or potentially suspect network event has occurred,
                    e.g., TELNET access to a public web server
    INFORMATION     A perfectly valid network event
                    is being reported for
                    informational purposes only

    TABLE J
    Agent
    Directive     Description
    DECRYPT       The Agent is instructed to decrypt all traffic at the
                  current protocol layer
    DISRUPT       The Agent is instructed to terminate and/or disrupt all
                  subsequent traffic associated with this network event
    LOG.sub.--    The Agent is instructed to log all traffic at the current
    TRAFFIC       protocol layer

        // Network event ok but should be logged
        disposition Ok_Monitor       // disposition <name>
         ( code OK )                 // disposition code
         ( log-directive             // logging directive
          MONITOR                    // severity code
          "Monitored activity" )     // logging string
        )

        // Decrypt SSL session data and continue processing network event
        ( disposition Continue_Decrypt
         ( code CONTINUE )
         ( agent-directive DECRYPT )
        )

                  // access to target resource is denied
                  ( disposition Access_Denied
                   ( code ACCESS_DENIED
                   ( log-directive
                    HIGH
                    "Access denied" )
                  )

    ( rule Tcp_Ext2Int                  // rule <name>
        ( description "Communications from external hosts" )
        ( agent Foo_Subnet_Monitor )     // the reporting agent
        ( protocol TCP )                 // the protocol
        ( action CONNECT )               // the protocol action
        ( initiator External_Hosts )     // the active principal
        ( target Internal_Hosts )        // the passive principal
        ( outcome
            ( immediate                  // the immediate outcome
             // if/if not <condition> <disposition>
             ( if Catch_Suspect Security_Attack_Possible )
             ( if Catch_Attacker Security_Attack_Progress
             ( default continue )        // using built-in disposition
            )
            ( final                      // the final outcome
             ( default Ok_Monitor )
            )
        )
    )

    ( credential Host_A
     ( assertion
      ( and
       ( eq ip-address 207.5.63.8 )
       ( eq ip-port 80 )
      )
     )
    )
    ( rule Access_Host_A
     ( protocol TCP )
     ( action CONNECT )
     ( initiator ignore )
     ( target Host_A )
     ( outcome
      ( final
       ( default Access_Denied ) // Access_Denied defined above
      )
     )
    )

        ( rule Http_To_Host_A
            ( protocol HTTP )
            ( action ignore )
            ( initiator ignore )
            ( target ignore )
            ( prerequisite Access_Host_A ) // reference to rule above
            ( outcome
             (immediate
              ( default ok )             // using built-in disposition
             )
            )
        )

    ( credential Some_Url
        ( assertion
            ( prefix url "//myserver.com/Documents" )
        )
    )
    ( rule Host_A_Anon_Access
        ( protocol HTTP )
        ( action ( union GET POST ) )
        ( initiator absent )
        ( target Some_Url )
        ( prerequisite Access_Host_A ) // from example above
        ( outcome
         ( final
          ( default Access_Denied ) // Access_Denied defined above
         )
        )
    )
    ( condition Require_Auth
        ( description "Check if server returned the Unauthorized response "
                  "code"
        ( assertion
         ( eq http-status-code 401 )
        )
    )
    ( rule Check_Access_Denial
        ( protocol HTTP )
        ( action RESPONSE )
        ( initiator ignore )
        ( target ignore )
        ( prerequisite Host_A_Anon_Access )
        ( outcome
         ( immediate
          ( ifnot Require_Auth Access_Denied )
          ( default ok ) // using built-in disposition
         )
        )
    )