Policy division and fusion: examples and a method-or, multiple classifiers considered harmful

Because higher- and lower-level policies do not necessarily correspond one-to-one, a higher-level network policy may have to be translated into two or more lower-level policies, and two or more cooperating higher-level policies may have to be translated into one lower-level policy. The former transformation is called a policy division, and the latter transformation is called a policy fusion. These transformations can be performed mechanically under certain restricted conditions, as described in this paper. In general, however, such transformations are very complicated, and the restrictions cannot be eliminated completely. This is mainly due to the existence of multiple packet classifiers in a set of policies. This paper thus concludes that multiple classifiers should not be introduced, if possible. Policy division and fusion can be avoided in certain cases, but are probably unavoidable in other cases. Given this, these problems should be solved by introducing virtual flow labels to remove harmful classifiers and conducting further studies on policy division and fusion