Subject: PCIMe: GroupNumber deprecation

From: "Mircea Pana" <[email-masked]>
Date: Wed, 13 Jun 2001 15:16:30 -0400

In PCIMe:

Is the GroupNumber property in the CompoundedPolicyCondition really
necessary? IMO this grouping mechanism unnecessarily overloads the
CompoundPolicyCondition semantics. Therefore, I'd like to suggest its
deprecation.

Without GroupNumber, the CompoundPolicyCondition would represent a
single level (instead of the current two level) aggregation of
PolicyConditions. Through CompoundPolicyConditions aggregated by other
CompoundPolicyConditions one could still build arbitrary complex policy
conditions.

For example, given a condition like this:
FlowDirection=IN AND (Source=10.2.0.0/16 OR Source=10.5.0.0/16)

A. With GroupNumber this can be represented as follows:

CompoundC_0 (type=CNF)
 |
 +-(group#=1)-> SimpleC_1 (FlowDirection=IN)
 |
 +-(group#=2)-> SimpleC_2 (Source=10.2.0.0/16)
 |
 +-(group#=2)-> SimpleC_3 (Source=10.5.0.0/16)

B. Without grouping, the condition may look like:

CompoundC_0 (type=AND)
 |
 +-> SimpleC_1 (FlowDirection=IN)
 |
 +-> CompoundC_01 (type=OR)
      |
      +-> SimpleC_2 (Source=10.2.0.0/16)
      |
      +-> SimpleC_3 (Source=10.5.0.0/16)

Option B seems more intuitive since the aggregation tree and the
evaluation tree map better to each other.

Regards,
Mircea Pana.