Method and apparatus for secure distributed managed network information services with redundancy

• US 20030061346A1
• Filed: 05/16/2002
• Published: 03/27/2003
• Est. Priority Date: 09/26/2001
• Status: Active Grant

• Current Assignee: Jetnet Internetworking Services
• Original Assignee: Ar Card
• Inventors: Ross, Ronald, Kelland, Michael, Pekary, Dave, Vardanyan, Arthur, Sibbitt, Chris
• Granted Patent: US 7,124,183 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/18 Delegation of network management function, e.g. customer network management [CNM]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Provided is a managed network service delivery system and method. The managed network service delivery system includes an IOC (Internetworking Operating Center) and a SCA (SAM (Security Activity Manager) Collector Agent) at at least one of a plurality of customer sites of a customer. The customer sites are connected to the IOC through a VPN (Virtual Private Network) or directly from a respective one of the SCAs to the IOC. The SCAs collect log and statistical information from equipment at a respective one of the customer sites and provide summary information to the IOC. The SCAs also perform queries regarding status of equipment and report to the IOC. The customer accesses reports from a web server at the IOC or through a PSTN (Public Switched Telephone Network) connection at the SCAs. A redundant connection, through the PSTN, between a SCA and the IOC provides a robust system for management, monitoring and security of the customer sites.

Claims

1. A network management system for managing a VPN (Virtual Private Network) provided to a customer having a plurality of customer sites, each one of the customer sites having customer equipment, the network management system comprising:

a network management center connectable to the customer sites through the VPN and adapted to manage the VPN; and

a DCE (Data Collection Element) locatable at at least one of the customer sites and adapted to collect information on the customer equipment, the DCE being adapted to provide at least some of the information to the network management center on an ongoing basis through the VPN;

wherein the DCE is adapted to access an alternative channel independent of the VPN through which to deliver the information to the network management center in the event that data cannot be delivered from the DCE to the network management center through the VPN.

2. A network management system according to claim 1 comprising an IDS (Intrusion Detection System) at one or more of the at least one of the customer sites, the IDS being adapted to provide security information on customer equipment to a respective DCE.

3. A network management system according to claim 1 comprising a DCE at each customer site.

4. A network management system according to claim 1 wherein said DCE is adapted to perform filtering of the information on the customer equipment and to then deliver filtered information to the network management center as summary information.

5. A network management system according to claim 1 wherein at least one of said DCE locatable at at least one of the customer sites comprises at least one security application adapted to monitor equipment at a respective one of the customer sites and provide status information, on the monitored equipment, to a respective DCE.

6. A network management system according to claim 1 wherein the network management center further comprises a remote access channel through which reports can be accessed by customers.

7. A network management system according to claim 1 wherein the network management center comprises a DPE (Data Processing Element) and a database in which data associated with reports on status information associated with the at least some of the information are stored by the DPE on an ongoing basis.

8. A network management system according to claim 7 wherein the network management center further comprises one or more web servers which retrieve the data from the database and makes the reports available to customers.

9. A network management system according to claim 7 wherein the DPE is adapted to receive the status information, to perform reporting of the status information and store said reports in the database and wherein the DPE is adapted to perform any necessary alerting actions based on the status information.

10. A network management system according to claim 7 wherein the DPE has a timer function which enables a timer to be set for a service associated with a customer equipment, the timer being reset each time a response of any type is received from the service and which if the timer reaches a timeout value without any response, generates an alert.

11. A network management system according to claim 7 wherein the DPE comprises a trend analysis function adapted to detect trends in the status information from DCEs of a plurality of customers and to provide security alerts based on the status information.

12. A network management system according to claim 1 wherein at least one of said DCE located at at least one of the customer sites is a restricted access server with limited access and is equipped with no extra external interfaces.

13. A network management system according to claim 1 wherein the alternative channel comprises a dial-up port through which the DCE can initiate a separate connection to the network management center through a PSTN (Public Switched Telephone Network).

14. A network management system according to claim 1 wherein the DCE is adapted to activate the alternative channel in the event that data cannot be delivered from the DCE to the network management center through the VPN.

15. A network management system according to claim 1 wherein the DCE further comprises NTP (Network Time Protocol) functionality employed in conjunction with a NIST (National Institute of Standards and Technology) server to have an accurate consistent understanding of time and to provide time stamped status information to the network management center.

16. A network management system according to claim 1 wherein the DCE further comprises a local database that is dynamically updated with basic local information.

17. A network management system according to claim 16 wherein the basic local information in the local database is made available through a stripped down browser based interface that is capable of returning only a limited amount of information.

18. A network management system according to claim 16 wherein the basic local information is distributed to the local databases of each of the customer'"'"'s other DCEs such that there is a distributed representation of at least the basic local information about the network.

19. A network management system according to claim 16 wherein the DCE being equipped with the local database is adapted to have the capability to deploy certificates for authorized people to access the basic local information.

20. A network management system according to claim 19 wherein access through these certificates is granted in a prioritized manner which can be re-prioritized.

21. A network management system according to claim 16 wherein the local database is updated with the basic local information only upon detection that the network management center or a link to the network management center is not functioning.

22. A network management system according to claim 1 wherein in the event that data cannot be delivered from the DCE to the network management center through either of the VPN and the alternative channel, the DCE will keep data until a connection is established with the network management center at which time the data is sent to the network management center.

23. A network management system according to claim 1 wherein the DCE is further adapted to monitor at least one of real-time network latencies and connectivities between customer sites across the VPN.

24. A network management system according to claim 1 wherein the network management center comprises a network management server adapted to establish connections between the plurality of customer sites and the network management center and adapted to monitor the connections.

25. A network management system according to claim 24 wherein the network management server is further adapted to establish the alternative channel in the event that data cannot be delivered from the DCE to the network management center through the VPN.

26. A network management system according to claim 1 wherein the network management center comprises a network management server adapted to manage a plurality of network security devices at at least one of the customer sites.

27. A network management system according to claim 1 wherein the network management center comprises a DCE adapted to collect status information from equipment at customer sites of the plurality of customer sites which do not have DCEs, the DCE at the network management center being adapted to provide at least some of the status information from the equipment at the customer sites of the plurality of customer sites which do not have DCEs to the network management center on an ongoing basis.

28. A network management system according to claim 1 wherein the VPN is defined by a star topology.

29. A network management system according to claim 1 wherein the VPN is defined by a mesh topology.

30. A method of providing remote network management, the method comprising:

establishing a connection between a network management center and a plurality of customer sites of a customer through a VPN;

collecting information on equipment at at least one of the plurality of customer sites and providing at least some of the information to the network management center on an ongoing basis through the VPN; and

establishing an alternative channel through which to deliver the information to the network management center in the event that data cannot be delivered from a respective one of the at least one of the plurality of customer sites to the network management center through the VPN.

31. A method according to claim 30 comprising:

processing the information received at the network management center to produce reports; and

making the reports available to the customer at the network management center through at least one of a public Internet and a PSTN.

32. A method according to claim 30 comprising managing equipment at the plurality of customer sites from the network management center.

33. A method according to claim 30 comprising:

storing basic local information associated with the information generated by equipment at a respective one of the at least one of the plurality of customer sites in the event that the at least some of the information cannot be delivered to the network management center; and

delivering the basic local information once a connection to the network management center is re-established.

34. A method according to claim 30 comprising:

storing basic local information associated with the information generated by equipment at a respective one of the at least one of the plurality of customer sites; and

making the basic local information available to the customer.

35. A method according to claim 30 comprising:

storing basic local information associated with the information on equipment at a respective one of the at least one of the plurality of customer sites; and

distributing the basic local information between the plurality of customer sites.

36. A method according to claim 30 comprising:

monitoring, from the network management center, the connections between a network management center and the plurality of customer sites; and

establishing an alternative channel, in the event that one of the connections is unavailable, to provide access to equipment at a respective one of the plurality of customer sites.

37. A process for delivering reliable and robust managed security services implementing the method of claim 30.

38. An apparatus for reliable data collection of information on equipment at a customer site within a VPN, the apparatus comprising:

a DCE adapted to receive the information, to filter some of the information, to output the filtered information through a VPN connection of the VPN and in the event that the VPN connection is unavailable, output the filtered information through an alternative connection; and

a local database within the DCE, the local database adapted to store the filtered information as basic local information.

39. An apparatus according to claim 38 wherein the DCE is adapted to retrieve the basic local information stored in the local database.

40. An apparatus according to claim 38 wherein the DCE is further adapted to establish the alternative connection in the event that the VPN connection is unavailable.

41. An apparatus according to claim 38 wherein the DCE is further adapted to further filter the filtered information to provide summary information.

42. An apparatus according to claim 40 wherein the DCE is further adapted to store the summary information as basic local information in the local database in the event that the summary information cannot be output through any one of the VPN connection and the alternative connection.

43. An apparatus according to claim 41 wherein the DCE is adapted to distribute the basic local information to other DCEs and receive other basic local information from the other DCEs.

44. An apparatus according to claim 38 wherein the DCE comprises at least one security application adapted to query network devices and report to a network management center, through any one of the VPN connection and the alternative connection, based on responses to queries.

45. A network management center for managing a VPN, the network management center comprising:

a database;

a DPE adapted to receive status information, process the status information to produce reports, and store data associated with the reports in the database; and

a network management server adapted to establish connections, through the VPN, to a plurality of customer sites, to monitor the connections and to establish an alternative connection each time one of the connections through the VPN is unavailable.

46. A network management center according to claim 45 wherein the data associated with the reports in the database are made accessible to a web server for reports.

47. A network management center according to claim 45 wherein the network management server is further adapted to manage and configure remote network devices at the customer sites.