	US 7,509,493 B2
	Method and system for distributing security policies
Shirish Koti, Redmond, Wash. (US); Narasimha Rao S. S. Nagampalli, Kirkland, Wash. (US); Maxim Alexandrovich Ivanov, Redmond, Wash. (US); Sachin C. Sheth, Seattle, Wash. (US); Emanuel Paleologu, Kirkland, Wash. (US); Yun Lin, Bellevue, Wash. (US); and Eric Erwin Youngblut, Seattle, Wash. (US)
Assigned to Microsoft Corporation, Redmond, Wash. (US)
Filed on Nov. 19, 2004, as Appl. No. 10/993,688.
Prior Publication US 2006/0129808 A1, Jun. 15, 2006
Int. Cl. G06F 9/00 (2006.01); H04L 9/00 (2006.01)

U.S. Cl. 713—166 [726/11]

29 Claims

1. A method in a computing device for distributing rules of security policies to enforcement engines executing the computing device for enforcing the security policies, the method comprising:

providing at the computing device enforcement engines that implement different layers of security enforcement;

receiving and storing at the computing device security policies having rules, each rule having a rule type;

under control of a firewall agent executing on the computing device,

retrieving the stored security policies; and

for rules of a retrieved security policy,

identifying an enforcement engine to which a rule applies based on the rule type of the rule; and

providing the rule to the identified enforcement engine; and

under control of the enforcement engines executing on the computing device,

storing the rules provided to the enforcement engine by the firewall agent;

under control of a flow manager executing on the computing device,

receiving a network event;

identifying an enforcement engine that is responsible for enforcing its rules against the network event; and

providing the network event to the identified enforcement engine;

under control of the enforcement engines executing on the computing device,

when a network event is provided to the enforcement engine, enforcing the rules provided to the enforcement engine by the firewall agent against the network event provided by the flow manager,

wherein the firewall agent provides a mechanism for distributing the rules to multiple enforcement engines of the computer device, the flow manager distributes network events to enforcement engines, and each enforcement engine enforces its provided rules against the network events that it is provided.