Method and system for managing secure geographic boundary resources within a network management framework

• US 20030041167A1
• Filed: 08/15/2001
• Published: 02/27/2003
• Est. Priority Date: 08/15/2001
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ullmann, Lorin Evan, Ullmann, Cristi Nesbitt, French, Steven
• Application Number:
  US09/930,424
• Publication Number:
  US 20030041167A1
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0879 Manual configuration through operator
• CPC Class Codes: H04L 41/0886 Fully automatic configuration
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method, system, apparatus, and computer program product is presented for management of a distributed data processing system on behalf of a plurality of management customers. Endpoint objects, system objects, and network objects are logically organized into a set of scopes that do not logically overlap. An administrative user may dynamically reconfigure logical networks within the distributed data processing system while managing the logical networks for a set of customers. The network management system is able to provide security at logical boundaries between networks. Geographic location identifiers are associated with network resources. Network-related actions can be performed on resources with common geographic boundaries. The network management framework assists administrators in opening or closing access to resources/devices at the boundaries such that portions of a highly distributed data processing system could be quarantined from other portions of the distributed data processing system.

Claims

1. A method for management of a distributed data processing system, the method comprising:

configuring geographic location information for resources within the distributed data processing system;

identifying router systems within the distributed data processing system;

determining a set of router systems that are closest to a geographic boundary; and

generating a geographic router boundary resource for the set of router systems.

2. The method of claim 1 further comprising:

associating two or more geographic router boundary resources to create a secure boundary between two or more geographic regions.

3. The method of claim 1 further comprising:

configuring user security parameters for controlling access to the geographic router boundary resource.

4. The method of claim 1 further comprising:

authorizing user access to the geographic router boundary resource based on a user security parameter corresponding to the geographic location information.

5. The method of claim 1 further comprising:

authorizing user access to resources within a geographic region as indicated by the geographic router boundary resource based on a user security parameter corresponding to the geographic location information.

6. The method of claim 1 further comprising:

quarantining a set of devices within a geographic region as indicated by the geographic router boundary resource.

7. The method of claim 6 further comprising:

unquarantining a set of devices within a geographic region.

8. The method of claim 1 further comprising:

disinfecting a set of devices within a geographic region as indicated by the geographic router boundary resource.

9. The method of claim 1 further comprising:

dynamically discovering endpoints, systems, and networks within the distributed data processing system;

correspondingly representing endpoints, systems, and networks within the distributed data processing system as a set of endpoint objects, system objects, and network objects; and

logically organizing the endpoint objects, system objects, and network objects within a set of scopes, wherein each endpoint object, each system object, and each network object is uniquely assigned to a scope such that scopes do not logically overlap.

10. The method of claim 1 further comprising:

representing the distributed data processing system as a set of scopes, wherein a scope comprises a logical organization of network-related objects;

associating each scope with a management customer, wherein each scope is uniquely assigned to a management customer, wherein each scope is uniquely associated with a set of configuration parameters for managing each scope;

managing the distributed data processing system as a set of logical networks, wherein a logical network comprises a set of scopes, and wherein each logical network is uniquely assigned to a management customer; and

allowing an administrative user to dynamically reconfigure logical networks within the distributed data processing system.

11. An apparatus for management of a distributed data processing system, the apparatus comprising:

means for configuring geographic location information for resources within the distributed data processing system;

means for identifying router systems within the distributed data processing system;

means for determining a set of router systems that are closest to a geographic boundary; and

means for generating a geographic router boundary resource for the set of router systems.

12. The apparatus of claim 11 further comprising:

means for associating two or more geographic router boundary resources to create a secure boundary between two or more geographic regions.

13. The apparatus of claim 11 further comprising:

means for configuring user security parameters for controlling access to the geographic router boundary resource.

14. The apparatus of claim 11 further comprising:

means for authorizing user access to the geographic router boundary resource based on a user security parameter corresponding to the geographic location information.

15. The apparatus of claim 11 further comprising:

means for authorizing user access to resources within a geographic region as indicated by the geographic router boundary resource based on a user security parameter corresponding to the geographic location information.

16. The apparatus of claim 11 further comprising:

means for quarantining a set of devices within a geographic region as indicated by the geographic router boundary resource.

17. The apparatus of claim 16 further comprising:

means for unquarantining a set of devices within a geographic region.

18. The apparatus of claim 11 further comprising:

means for disinfecting a set of devices within a geographic region as indicated by the geographic router boundary resource.

19. The apparatus of claim 11 further comprising:

means for dynamically discovering endpoints, systems, and networks within the distributed data processing system;

means for correspondingly representing endpoints, systems, and networks within the distributed data processing system as a set of endpoint objects, system objects, and network objects; and

means for logically organizing the endpoint objects, system objects, and network objects within a set of scopes, wherein each endpoint object, each system object, and each network object is uniquely assigned to a scope such that scopes do not logically overlap.

20. The apparatus of claim 11 further comprising:

means for representing the distributed data processing system as a set of scopes, wherein a scope comprises a logical organization of network-related objects;

means for associating each scope with a management customer, wherein each scope is uniquely assigned to a management customer, wherein each scope is uniquely associated with a set of configuration parameters for managing each scope;

means for managing the distributed data processing system as a set of logical networks, wherein a logical network comprises a set of scopes, and wherein each logical network is uniquely assigned to a management customer; and

means for allowing an administrative user to dynamically reconfigure logical networks within the distributed data processing system.

21. A computer program product in a computer readable medium for use in managing a distributed data processing system, the computer program product comprising:

instructions for configuring geographic location information for resources within the distributed data processing system;

instructions for identifying router systems within the distributed data processing system;

instructions for determining a set of router systems that are closest to a geographic boundary; and

instructions for generating a geographic router boundary resource for the set of router systems.

22. The computer program product of claim 21 further comprising:

instructions for associating two or more geographic router boundary resources to create a secure boundary between two or more geographic regions.

23. The computer program product of claim 21 further comprising:

instructions for configuring user security parameters for controlling access to the geographic router boundary resource.

24. The computer program product of claim 21 further comprising:

instructions for authorizing user access to the geographic router boundary resource based on a user security parameter corresponding to the geographic location information.

25. The computer program product of claim 21 further comprising:

instructions for authorizing user access to resources within a geographic region as indicated by the geographic router boundary resource based on a user security parameter corresponding to the geographic location information.

26. The computer program product of claim 21 further comprising:

instructions for quarantining a set of devices within a geographic region as indicated by the geographic router boundary resource.

27. The computer program product of claim 26 further comprising:

instructions for unquarantining a set of devices within a geographic region.

28. The computer program product of claim 21 further comprising:

instructions for disinfecting a set of devices within a geographic region as indicated by the geographic router boundary resource.