diff --git a/src/security/conf/rule.hpp b/src/security/conf/rule.hpp
new file mode 100644
index 0000000..560c440
--- /dev/null
+++ b/src/security/conf/rule.hpp
@@ -0,0 +1,106 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil -*- */
+/**
+ * Copyright (C) 2013 Regents of the University of California.
+ * @author: Yingdi Yu <yingdi@cs.ucla.edu>
+ * See COPYING for copyright and distribution information.
+ */
+
+#ifndef NDN_SECURITY_CONF_RULE_HPP
+#define NDN_SECURITY_CONF_RULE_HPP
+
+#include "filter.hpp"
+#include "checker.hpp"
+
+
+namespace ndn {
+namespace security {
+namespace conf {
+
+template<class Packet>
+class Rule
+{
+public:
+  Rule(const std::string& id)
+    : m_id(id)
+  {
+  }
+
+  virtual
+  ~Rule()
+  {
+  }
+
+  const std::string&
+  getId()
+  {
+    return m_id;
+  }
+
+  void
+  addFilter(const shared_ptr<Filter>& filter)
+  {
+    m_filters.push_back(filter);
+  }
+
+  void
+  addChecker(const shared_ptr<Checker>& checker)
+  {
+    m_checkers.push_back(checker);
+  }
+
+  bool
+  match(const Packet& packet)
+  {
+    if (m_filters.empty())
+      return true;
+
+    for (FilterList::iterator it = m_filters.begin();
+         it != m_filters.end(); it++)
+      {
+        if (!(*it)->match(packet))
+          return false;
+      }
+
+    return true;
+  }
+
+  /**
+   * @brief check if packet satisfies certain condition
+   *
+   * @param packet The packet
+   * @param onValidated Callback function which is called when packet is immediately valid
+   * @param onValidationFailed Call function which is called when packet is immediately invalid
+   * @return -1 if packet is immediately invalid (onValidationFailed has been called)
+   *          1 if packet is immediately valid (onValidated has been called)
+   *          0 if further signature verification is needed.
+   */
+  template<class ValidatedCallback, class ValidationFailureCallback>
+  int8_t
+  check(const Packet& packet,
+        const ValidatedCallback& onValidated,
+        const ValidationFailureCallback& onValidationFailed)
+  {
+    for (CheckerList::iterator it = m_checkers.begin();
+         it != m_checkers.end(); it++)
+      {
+        int8_t result = (*it)->check(packet, onValidated, onValidationFailed);
+        if (result >= 0)
+          return result;
+      }
+    return -1;
+  }
+
+private:
+  typedef std::vector<shared_ptr<Filter> > FilterList;
+  typedef std::vector<shared_ptr<Checker> > CheckerList;
+
+  std::string m_id;
+  FilterList m_filters;
+  CheckerList m_checkers;
+};
+
+} // namespace conf
+} // namespace security
+} // namespace ndn
+
+#endif // NDN_SECURITY_CONF_RULE_HPP