Modular remote network policy management system

• US 20030037129A1
• Filed: 08/13/2002
• Published: 02/20/2003
• Est. Priority Date: 08/14/2001
• Status: Abandoned Application

• Current Assignee: ENDFORCE, Inc. (Sophos Group Ltd.)
• Original Assignee: SmartPipes, Incorporated (Sophos Group Ltd.)
• Inventors: Bell, Raymond J., Russo, Kevin A., Emerick, William S., Mulh, Kenneth E., Beadles, Mark A.
• Application Number:
  US10/219,142
• Publication Number:
  US 20030037129A1
• Time in Patent Office: Days
• US Class Current: 709/220
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A modular remote network management system which can configure a customer'"'"'s network over the internet. A first module receives customer descriptions of desired customer network policy configurations. Another module automatically translates that description into device-level policy configuration data. Finally, a third module transmits the device-level policy configuration data over the internet to the devices of the customer network.

Claims

1. A method for remotely managing a network, comprising:

receiving a customer description of a desired customer network configuration over the internet;

automatically translating said customer description into device-level configuration data using software running at a service center; and

transmitting said device-level configuration data over the internet to devices of a network of said customer.

2. The method of claim 1 wherein said software running at a service center includes the following modules:

a policy generation layer that operates to generate policy in a non-device specific format; and

a device plug-in layer for converting policy from said policy generation layer into device specific format, and transmitting the converted policy to said devices of said network of said customer.

3. The method of claim 2 wherein said policy generation layer includes separate modules for generating policy for different types of policy, including a first module for virtual private networks (VPN) and a second policy for application management services (AMS) and a third module for security.

4. The method of claim 1 wherein said transmitting comprises using a secure in-band channel over the internet.

5. The method of claim 4 wherein said secure in-band channel is an IPSec tunnel.

6. The method of claim 1 wherein said configuration data comprises network policies.

7. The method of claim 6 wherein said network policies include intranet and extranet virtual private networks (VPNs).

8. The method of claim 1 wherein:

said customer description is translated into a device-neutral file;

said device neutral file is subsequently translated into a device-specific file.

9. The method of claim 8 wherein said device-neutral file is an XML file.

10. A method for configuring a network device, comprising:

establishing a secure communication link to said network device over a public network; and

downloading configuration information to said network device using said secure communication link over said public network.

11. The method of claim 10 wherein said public network is the internet.

12. The method of claim 10 wherein said secure communication link is an IPSec tunnel.

13. The method of claim 10 wherein said configuration information is a network policy.

14. The method of claim 13 wherein said network policy is a virtual private network (VPN) policy.

15. A method for configuring a network device, comprising:

establishing an IPSec tunnel to said network device over the internet; and

downloading virtual private network (VPN) policy configuration information to said network device using said IPSec tunnel over the internet.

16. The method of claim 15 wherein said network device is a router.

17. The method of claim 15 wherein said network device is an operating system.

18. A modular system for providing network management services over the internet, comprising:

a customer interface module for receiving customer inputs of network policy;

a policy generator module for converting said customer inputs into non-device specific format; and

a device plug-in module, for receiving said network policy in said non-device specific format, converting said policy into device specific format, and transmitting said policy to devices in a network of said customer.

19. The system of claim 18 wherein said non-device specific format is XML-based.