Distributed policy store

• US 10,250,446 B2
• Filed: 03/27/2017
• Issued: 04/02/2019
• Est. Priority Date: 03/27/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Prasad, Rohit, Gandham, Shashi, Vu, Hai, Malhotra, Varun, Gupta, Sunil, Singh, Abhishek, Yadav, Navindra, Parandehgheibi, Ali, Prasad, Ravi, Vallem, Praneeth, Lesiak, Paul, Nguyen, Hoang
• Primary Examiner(s): Gilles, Jude Jean
• Application Number:
  US15/470,499
• Publication Number:
  US 20180278481A1
• Time in Patent Office: 736 Days
• Field of Search: 709223
• CPC Class Codes: G06F 16/134 Distributed indices
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

The disclosed technology relates to a distributed policy store. A system is configured to locate, in an index, an entry for a network entity, determine, based on the entry, a file identifier for a file containing a record for the network entity and an offset indicating a location of the record in the file. The system is further configured to locate the file in a distributed file system using the file identifier, locate the record in the file using the offset, and retrieve the record.

Claims

1. A computer-implemented method comprising:

generating a plurality of policies based on a user intent statement;

identifying, among the plurality of policies, a set of policies applicable to a network entity;

storing the set of policies applicable to the network entity in a record for the network entity;

storing the record in a file in a distributed file system, wherein the file is associated with a file identifier and the record is stored at a location indicated by an offset; and

storing the file identifier and the offset in an entry for the network entity, wherein the entry is located in an index database separate from the distributed file system.

2. The computer-implemented method of claim 1, further comprising:

determining a size of the record; and

storing the size of the record in a header of the record.

3. The computer-implemented method of claim 1, wherein the distributed file system is a hadoop distributed file system (HDFS) and wherein a size of the file is smaller than a block size for the HDFS.

4. The computer-implemented method of claim 1, wherein the index database is implemented as a NoSQL database.

5. The computer-implemented method of claim 1, wherein the file identifier is a filename.

6. The computer-implemented method of claim 1, wherein the offset indicates a location in the file where the record begins.

7. The computer-implemented method of claim 1, further comprising:

receiving the user intent statement, the user intent statement including a filter and an action; and

querying, based on the filter, an inventory store to identify the network entity to which the user intent statement applies.

8. A non-transitory computer-readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:

receive instructions to update policies for a network entity;

locate an entry for the network entity in an index database;

determine, based on the entry in the index database, a file identifier for a file containing a record for the network entity and an offset indicating a location of the record in the file, wherein the record includes policies for the network entity;

locate the file in a distributed file system using the file identifier, wherein the distributed file system is separate from the index database;

retrieve the record in the file using the offset; and

updating the policies for the network entity.

9. The non-transitory computer-readable medium of claim 8, wherein retrieving the record using the offset comprises accessing a header of the record to determine a size of the record and retrieving a portion of the file starting from the offset and incorporating the size of the record.

10. The non-transitory computer-readable medium of claim 8, wherein the instructions further cause the computing system to generate a policy update for the network entity based on a user intent statement, and wherein the updating of the policies for the network entity is based on the policy update.

11. The non-transitory computer-readable medium of claim 10, wherein the instructions further cause the computing system to:

generate an updated record for the network entity based on the policy update; and

store the updated record in the file.

12. The non-transitory computer-readable medium of claim 11, wherein the instructions further cause the computing system to determine a size of the updated record and store the size of the record in a header of the record.

13. The non-transitory computer-readable medium of claim 11, wherein the distributed file system is a hadoop distributed file system (HDFS) and wherein a size of the file is smaller than a block size for the HDFS.

14. The non-transitory computer-readable medium of claim 11, wherein the index database is implemented as a NoSQL database.

15. The non-transitory computer-readable medium of claim 11, wherein the file identifier is a filename.

16. A system comprising:

a processor; and

a non-transitory computer-readable medium storing instructions that, when executed by the system, cause the system to;

locate, in an index, an entry for a network entity;

determine, based on the entry, a file identifier for a file containing a record for the network entity, wherein the record includes policies for the network entity;

determine, based on the entry, an offset indicating a location of the record in the file;

locate the file in a distributed file system using the file identifier;

locate the record in the file using the offset; and

retrieve the record.

17. The system of claim 16, wherein the instructions further cause the system to generate an updated record based on a policy update and store the updated record in the file.

18. The system of claim 17, wherein the instructions further cause the system to determine a size of the updated record and store the size of the updated record in a header portion of the updated record.

19. The system of claim 16, wherein the distributed file system is a hadoop distributed file system (HDFS) and wherein a size of the file is smaller than a block size for the HDFS.

20. The system of claim 16, wherein the index is implemented as a NoSQL database.