1. A method for enforcing a security policy at an interface to a network switch of a dynamically programmable computer network, the method comprising, with a computing system coupled to the network:
receiving a packet disposition directive from the network, the packet disposition directive comprising a candidate flow rule that may be implemented by the network switch to control the flow of communications across the network;
determining whether the candidate flow rule conflicts with one or more flow rules in a set of currently active flow rules, wherein the currently active flow rules currently control the flow of communications across the network; and
in response to determining that the candidate flow rule does not conflict with any of the currently active flow rules, adding the candidate flow rule to the set of currently active flow rules.
2. The method of claim 1, comprising comparing the candidate flow rule to each of the flow rules in the set of currently active flow rules before the candidate flow rule is communicated to the network switch.
3. The method of claim 1, wherein the candidate flow rule and each of the currently active flow rules comprises an action that determines how communications to which the rule applies are disposed of by the network switch, and the method comprises, for each of the currently active flow rules: comparing the action specified by the candidate flow rule to the action specified by the currently active flow rule, and if the action specified by the candidate flow rule is the same as the action specified by the currently active flow rule, determining that the candidate flow rule does not conflict with the currently active flow rule.
4. The method of claim 1, comprising determining whether the candidate flow rule comprises a set action, wherein the set action modifies communications to which it applies.
5. The method of claim 4, comprising, in response to determining that the candidate flow rule comprises a set action, expanding the candidate flow rule to include the modifications permitted by the set action.
6. The method of claim 5, wherein each of the currently active flow rules has a priority, and the method comprises comparing the expanded candidate flow rule to the currently active flow rules in order of decreasing priority.
7. The method of claim 6, comprising determining that the candidate flow rule conflicts with the set of currently active flow rules if the expanded candidate flow rule conflicts with any of the currently active flow rules.
8. A security mediation service to enforce a security policy at an interface to a network switch of a dynamically programmable computer network, the security mediation service embodied in a computing system coupled to the network, the security mediation service comprising:
a flow rule state manager to manage data relating to a set of currently active flow rules, wherein the currently active flow rules currently control the flow of communications across the network; and
a conflict analyzer to determine whether a candidate flow rule conflicts with any of the currently active flow rules, and add the candidate flow rule to the set of currently active flow rules if the candidate flow rule does not conflict with any of the currently active flow rules.
9. The security mediation service of claim 8, wherein the candidate flow rule and each of the currently active flow rules comprise an action that determines how a communication is to be disposed of by the network switch if the rule applies to the communication, and wherein the conflict analyzer compares the action specified by the candidate flow rule to the action specified by each of the currently active flow rules.
10. The security mediation service of claim 8, wherein the candidate flow rule and each of the currently active flow rules comprise a plurality of match fields each including a value that determines whether the candidate flow rule applies to a communication, and wherein the conflict analyzer compares the match fields of the candidate flow rule to the corresponding match fields of each of the currently active flow rules.
11. The security mediation service of claim 10, wherein if the candidate flow rule permits another value to be substituted for the value of a match field of the candidate flow rule, the conflict analyzer expands the candidate flow rule to include the value and the other value that may be substituted for the value of the match field, and compares the expanded candidate flow rule to each of the currently active flow rules.
12. The security mediation service of claim 11, wherein, for each of the currently active flow rules, the conflict analyzer expands the currently active flow rule to include any values that may be substituted for the values of the match fields of the currently active flow rule, and compares the expanded candidate flow rule to each of the expanded currently active flow rules.
13. The security mediation service of claim 12, wherein the security mediation service updates the set of currently active flow rules to include the expanded candidate flow rule if the expanded candidate flow rule does not conflict with any of the expanded currently active flow rules.
14. The security mediation service of claim 8, wherein the security mediation service communicates the candidate flow rule to the network switch if the candidate flow rule does not conflict with any of the currently active flow rules.
15. The security mediation service of claim 8, comprising:
a source authenticator to authenticate a source of the candidate flow rule, wherein the source comprises one of a network administrator and a software application; and
a conflict analyzer to determine whether to implement the candidate flow rule at the network switch based on a role associated with the source of the candidate flow rule.
16. A network controller embodied in one or more machine accessible storage media and configured to interface with software applications and with the network switch, the network controller comprising the security mediation service of claim 8.
17. A network virtualization layer embodied in one or more machine accessible storage media and configured to interface with software applications and with the network switch, the network virtualization layer comprising the security mediation service of claim 8.
18. A method for enforcing a security policy at an interface to a network switch of a dynamically programmable computer network, the method comprising, with a computing system coupled to the network:
receiving a candidate flow rule from the network, wherein the candidate flow rule may be implemented by the network switch to control the flow of communications across the network, and the candidate flow rule comprises match criteria having values that determine whether the candidate flow rule applies to a communication;
determining whether the candidate flow rule permits other values to be substituted for any of the values of the match criteria; and
deriving an expanded candidate flow rule from the candidate flow rule, wherein the expanded candidate flow rule includes the values of the match criteria and the other values.
19. The method of claim 18, wherein the match criteria comprises a plurality of match fields, and the expanding comprises, for each of the match fields, deriving an alias set comprising the value of the match field and the other values that may be substituted for the value of the match field.
20. The method of claim 18, comprising:
determining whether the expanded candidate flow rule conflicts with a set of currently active flow rules, wherein the set of currently active flow rules currently controls the flow of communications across the network; and
in response to determining that the expanded candidate flow rule does not conflict with any of the currently active flow rules, adding the expanded candidate flow rule to the set of currently active flow rules.
21. The method of claim 20, wherein each of the currently active flow rules is associated with a role, and the method comprises comparing the candidate flow rule to the set of currently active flow rules in a priority order based on the roles assigned to the currently active flow rules.
22. The method of claim 20, comprising, for each of the match fields, determining whether the alias set intersects with a corresponding match field of each of the currently active flow rules.
23. The method of claim 20, wherein each of the currently active flow rules comprises match criteria having values that determine whether the currently active flow rule applies to a communication, and the method comprises expanding each of the currently active flow rules to include the values of the match criteria and any values that may be substituted for the values of the match criteria.
24. The method of claim 23, comprising comparing the expanded candidate flow rule to each of the expanded currently active flow rules.
25. The method of claim 23, wherein the match criteria of each of the currently active flow rules comprises a plurality of match fields, and the expanding comprises, for each of the match fields of each of the currently active flow rules, deriving an alias set comprising the value of the match field of the currently active flow rule and the other values that may be substituted for the value of the match field of the currently active flow rule.
26. The method of claim 25, wherein the match fields of the candidate flow rules and the match fields of each of the currently active flow rules comprise a source field and a destination field, and the method comprises determining whether the alias set of the source field of the candidate flow rule intersects with the alias set of the source field of any of the currently active flow rules and determining whether the alias set of the destination field of the candidate flow rule intersects with the alias set of the destination field of any of the currently active flow rules.
27. The method of claim 26, comprising updating the alias sets of each of the currently active flow rules if the expanded candidate flow rule is added to the set of currently active flow rules.
28. A method for enforcing a security policy for a dynamically programmable network, the method comprising, on the network:
maintaining a set of currently active packet disposition directives, wherein the set of currently active packet disposition directives changes over time, and the currently active packet disposition directives are implemented at network switches to control one or more of the behavior and the configuration of the network switches at a current point in time;
receiving, from a source of packet disposition directives, a candidate packet disposition directive that is not part of the set of currently active packet disposition directives;
determining whether the candidate packet disposition directive violates the security policy; and
in response to determining that the candidate packet disposition directive does not violate the current security policy, implementing the packet disposition directive at the network switches.
29. The method of claim 28, comprising determining a role associated with the source of the candidate packet disposition directive to determine whether the candidate packet disposition directive violates the security policy, wherein the role comprises one of a network administrator and a software application.
30. The method of claim 28, comprising determining a capability associated with the source of the candidate packet disposition directive to determine whether the candidate packet disposition directive violates the security policy, wherein the capability indicates whether the source can change the behavior andor configuration of the network switches.
31. The method of claim 28, comprising determining whether the candidate packet disposition directive conflicts with any of the currently active packet disposition directives to determine whether the candidate disposition directive violates the security policy.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A device for reduced-pressure refining of a glass melt using a reduced-pressure apparatus in which the glass melt is fed to a refining bank via a riser and is discharged again from the refining bank via a downpipe so that a reduced pressure is generated by a glass flow in the refining bank, wherein said refining bank, said riser, andor said downpipe comprises at least one component, said at least one component is made from a refractory metal or a refractory metal alloy acting as glass-contact material, and said refractory metal or said refractory metal alloy contains at least one of said molybdenum, said tungsten, said tantalum, and said hafnium;
wherein said device comprises a protective gas reservoir and an automatic connection for connecting said protective gas reservoir to supply a protective gas to protect an inner side of said at least one component from oxidation in the event of a pressure rise or in the event of a falling glass melt column.
2. The device as defined in claim 1, wherein said automatic connection comprises an automatically operable valve that automatically opens in response to said pressure rise or in response to said falling glass melt column so that said protective gas is automatically supplied to protect said inner side of said at least one component.
3. The device as defined in claim 1, wherein said at least one component consists of said refractory metal.
4. The device as defined in claim 1, wherein said at least one component comprises said tantalum or said hafnium.
5. The device as claimed in claim 1, wherein a side of said at least one component remote from another side of the at least one component contacted by said glass melt is protected by purging with said protective gas or a forming gas.
6. The device as claimed in claim 1, further comprising glazing a side of said at least one component remote from the glass melt in order to protect said at least one component from oxidation.
7. The device as claimed in claim 1, wherein said at least one component is of a vacuum-tight design.
8. The device as claimed in claim 1, wherein said at least one component is mechanically stable with respect to pressure differences.
9. The device as claimed in claim 1, wherein said at least one component comprises individual pipe sections and said individual pipe sections are connected to one another by a flange connection or a screw connection.
10. The device as claimed in claim 9, wherein said flange connection or said screw connection is made gas-tight by means of cutting edges.
11. The device as claimed in claim 9, wherein said individual pipe sections connected to one another are annealed at high temperatures, so that contact locations between the pipe sections are welded or sintered together.
12. The device as claimed in claim 1, wherein said at least one component is located in a housing.
13. The device as claimed in claim 12, wherein said housing is gas-tight.
14. The device as claimed in claim 12, further comprising means for compensating for thermal expansion of said at least one component with respect to said housing.
15. The device as claimed in claim 14, wherein said means for compensating for thermal expansion comprises a spring-assisted bellows and said housing comprises said spring-assisted bellows.
16. The device as claimed in claim 1, further comprising means for heating said at least one component.
17. The device as claimed in claim 16, wherein said means for heating said at least one component comprises at least one radiation heater.
18. The device as claimed in claim 17, wherein said at least one radiation heater is protected from oxidation by flushing said at least one radiation heater with said protective gas or a forming gas.
19. The device as claimed in claim 17, wherein said at least one radiation heater is protected from oxidation by glazing.
20. The device as claimed in claim 16, wherein said means for heating comprises means for inductive heating said at least one component.
21. The device as claimed in claim 16, wherein said means for heating said at least one component comprises means for passing a high-frequency alternating current through said at least one component.
22. The device as claimed in claim 16, wherein said means for heating said at least one component comprises means for providing a direct flow of current in said glass melt between a central stick electrode and said at least one component, wherein said at least one component acts as counter electrode.
23. A process for reduced-pressure refining of a glass melt in a reduced-pressure apparatus comprising a refining bank for the glass melt, a riser for supplying the glass melt to the refining bank, and a downpipe for discharge of the glass melt from the refining bank, wherein said refining bank, said riser, andor said downpipe comprises at least one component made from at least one refractory metal or a refractory metal alloy acting as glass-contact material, said at least one refractory metal is selected from the group consisting of molybdenum, tungsten, tantalum, and hafnium, and said refractory metal alloy contains at least one of said molybdenum, said tungsten, said tantalum, and said hafnium, so that said at least one component contacts the glass melt; said process comprising the steps of:
a) feeding a glass melt to be refined to the refining bank via the riser;
b) generating a reduced pressure in the refining bank by means of a glass flow in the refining bank; and
c) supplying a protective gas from a protective reservoir via an automatic connection to protect an inner side of the at least one component from oxidation when a pressure rise or a fall of a glass melt column occurs.
24. The process as defined in claim 23, wherein said refining bank includes said at least one component and said automatic connection comprises an automatically opening valve that opens to supply said refining bank with said protective gas in the event of said pressure rise or said fall of the glass melt column.
25. The process as defined in claim 23, wherein said protective gas comprises an inert gas or a reducing gas.
26. The process as defined in claim 23, wherein said at least one component consists of said refractory metal.
27. The process as defined in claim 23, further comprising heating said at least one component during said refining.
28. The process as defined in claim 27, further comprising compensating for thermal expansion of said at least one component during said heating.