Policy engine for modular generation of policy for a flat, per-device database

• US 20030154404A1
• Filed: 08/13/2002
• Published: 08/14/2003
• Est. Priority Date: 08/14/2001
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: SmartPipes, Incorporated (Sophos Group Ltd.)
• Inventors: Bell, Raymond J., Russo, Kevin A., Emerick, William S., Mulh, Kenneth E., Beadles, Mark A.
• Granted Patent: US 7,159,125 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A policy engine in a policy-based, outsourced, network management system. In one embodiment, the management system is multi-layered, modular and stores device configuration data in non-device specific format, which are subsequently translated to device-specific format by lower layers of the management system. The non-device specific format is the same (e.g., XML) as that used to create the policies with the user GUI (e.g., browser) and transport them to the service center over the internet. A database stores a policy directory in a hierarchical format that is separate from a policy store (configuration store) for devices in a flat (non-hierarchical or parallel) format. In one embodiment, a policy engine develops policies in a hierarchical format, but then stores the device schema, or objects, in a low-level, flat database. Multiple hierarchical services which impact a single device have the characteristics related to that device knitted together, and then fed back to a policy store database as a flat file for that device, in a non-device specific format. Thus, instead of storing the policies separately, and in hierarchical linked format, the device descriptions are stored with the aspects of all policies that affect that device.

Claims

1. A method for generating network management policies for a network, comprising:

storing a hierarchical policy in a directory database;

transforming said hierarchical policy into a flat file format with device schema for devices comprising said network; and

storing said flat file format device schema in a configuration database.

2. The method of claim 1 further comprising:

concatenating together device implementations of a plurality of policies for said devices.

3. The method of claim 1 wherein said transforming comprises:

dividing a policy into a plurality of policy types; and

providing each of said policy types to a specialized process for one of said policy types, said specialized processes generating a flat file for each device corresponding to said policy.

4. The method of claim 3 wherein said process is a COM server.

5. The method of claim 3 wherein said policy types include a virtual private network (VPN), a network address translation (NAT), a firewall and application management services (AMS).

6. The method of claim 3 wherein said dividing is performed by a policy generator, said policy generator further:

providing a flat file template to said processes for populating with data corresponding to said policy; and

providing to said processes a server address for a server containing said directory.

7. The method of claim 3 wherein said dividing is performed by a policy generator, said policy generator further:

adding device attributes from said directory to said flat file.

8. The method of claim 3 wherein said dividing is performed by a policy generator, said policy generator further:

providing a main thread; and

providing a policy generation thread pool comprised of threads generated by said main thread, each thread in said thread pool being responsible for policy for a particular policy object.

9. A method for generating network management policies for a network, comprising:

storing a hierarchical policy in a directory database;

using a policy generator to transform said hierarchical policy into a flat file format with device schema for devices comprising said network by

dividing a policy into a plurality of policy types, and

providing each of said policy types to a COM server for one of said policy types, said COM server generating a flat file for each device corresponding to said policy, wherein said policy types include a virtual private network (VPM), a network address translation (NAT), a firewall and application management services (AMS);

providing a flat file template to said COM servers for populating with data corresponding to said policy; and

providing to said COM servers a server address for a server containing said directory;

concatenating together device implementations of a plurality of policies for said devices;

adding device attributes from said directory to said flat file; and

storing said flat file format device schema in a configuration database.

10. The method of claim 9 further comprising:

managing passwords and encryption keys in an authorization/key manager separate from said COM servers, and responsive to calls from said COM servers, to provide consistent passwords and encryption keys.

11. The method of claim 9 wherein said flat file format is XML, and said concatenating is performed using an XSL stylesheet.

12. The method of claim 9 wherein said policy generator comprises multiple instantiations on multiple servers.

13. The method of claim 9 further comprising:

providing said schema in XML format;

storing said schema in said configuration database using an ADO object pool in communication with an OLEDB provider.

14. A method for creating a directory of a network, comprising:

providing a directory of device objects describing a plurality of devices in a network;

organizing said directory in hierarchical form; and

providing at least one policy object for application of a policy to a plurality of said devices.

15. The method of claim 14 wherein said policy object is one of a plurality of policy objects including policy objects for security policy, firewall policy, network policy and router configuration.

16. A method for generating network management policies for a network, comprising:

dividing a policy into a plurality of policy types; and

providing each of said policy types to a specialized process for one of said policy types, said specialized processes generating a flat file for each device corresponding to said policy.

17. The method of claim 16 wherein each said specialized process is a COM server.

18. The method of claim 16 wherein said policy types include a virtual private network (VPN), a network address translation (NAT), a firewall and application management services (AMS).

19. The method of claim 16 wherein said dividing is performed by a policy generator, said policy generator further:

providing a flat file template to said processes for populating with data corresponding to said policy; and

providing to said processes a server address for a server containing said directory.

20. The method of claim 16 wherein each of said specialized processes is a COM server, each of said COM servers performing the following:

accessing a directory for information needed to create a policy;

providing both synchronous and asynchronous implementations.

21. A computer readable media having computer readable code embodied therein for providing a directory of network resources comprising:

a plurality of objects describing attributes of said network resources; and

a plurality of objects describing attributes of network policy.

22. The media of claim 21 wherein said attributes of network policy include:

a virtual network policy;

a network address policy;

a firewall policy; and

an application management system policy.

23. The media of claim 21 wherein at least one of said objects sets forth the connections in a network.

24. The media of claim 21 wherein at least one of said objects is an actions object with a list of actions, and the type of action.

25. The media of claim 21 wherein at least one of said objects is an interface object with an indication of type or location, and networking relevant information.

26. A method for generating policy descriptions with a policy service agent responsive to a policy generator comprising:

receiving an XML template, a policy rule description and a directory address from said policy generator;

accessing a directory at said directory address for hierarchical data describing said policy rule;

populating said XML template with data pertaining to said policy rule for a device identified in said XML template;

returning a populated XML template to said policy generator.

27. The method of claim 26 wherein said policy generator is a COM server.

28. The method of claim 26 wherein said policy service agent includes an asynchronous COM interface with said policy generator.