Method and apparatus for creating a network topograph that includes all select objects that are in a network

• US 20060156280A1
• Filed: 02/14/2006
• Published: 07/13/2006
• Est. Priority Date: 07/15/2002
• Status: Active Grant

• Current Assignee: Branimir Liker, Imin Lee, Partha Bhattacharya, Shigang Chen
• Original Assignee: Branimir Liker, Imin Lee, Partha Bhattacharya, Shigang Chen
• Inventors: Bhattacharya, Partha, Chen, Shigang, Lee, Imin, Liker, Branimir
• Granted Patent: US 8,001,475 B2
• Time in Patent Office: Days
• US Class Current: 717/105
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies

Abstract

A method is disclosed for creating a network topograph that includes all select objects that are in a network. A set of one or more non-select objects in the network is determined. A network topograph is created. Each select object in the network is included in the network topograph. Elements of the set are collectively represented as a single non-select object.

Claims

1. An apparatus for creating a network topograph that includes all select objects that are in a network, the apparatus comprising:

one or more processors; and

one or more stored sequences of instructions, which, when executed by the one or more processors, cause the one or more processors to carry out steps of;

determining a first set of one or more non-select objects in the network;

creating a network topograph that includes each select object in the network, wherein elements of the first set are collectively represented as a single non-select object;

displaying the network topograph in a graphical user interface of a network management application;

receiving input from a user, wherein the input specifies a first non-select object in the network topograph; and

displaying information about the first non-select object, wherein the information was not displayed prior to the input being received.

2. An apparatus as recited in claim 1, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of creating the network topograph comprises stored sequences of instructions which cause the one or more processors to carry out a step of representing, in the network topograph, a link in the network only if the link is a direct link between a select object and another object in the network.

3. An apparatus as recited in claim 1, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of determining the first set of one or more non-select objects in the network comprise stored sequences of instructions which cause the one or more processors to carry out a step of determining the one or more non-select objects based on a location of those one or more non-select objects relative to a select object.

4. An apparatus as recited in claim 1, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of displaying information about the first non-select object comprise stored sequences of instructions which cause the one or more processors to carry out a step of displaying one or more elements of a set of objects that are collectively represented by the first non-select object.

5. An apparatus as recited in claim 1, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of determining the first set comprise stored sequences of instructions which cause the one or more processors to carry out steps of:

identifying a plurality of select objects that collectively define a security domain that comprises one or more other objects; and

placing all the other objects, which are in the security domain, in the first set.

6. An apparatus as recited in claim 1, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of determining the first set comprise stored sequences of instructions which cause the one or more processors to carry out recursive steps of:

including a first non-select object in the first set; and

for each element in a set that includes all non-select objects that (a) directly link to the first non-select object and that (b) are not included in the first set, performing the recursive steps with that element being the first non-select object.

7. An apparatus for creating a network topograph that includes all key firewall objects that are in a network, the apparatus comprising:

one or more processors; and

one or more stored sequences of instructions, which, when executed by the one or more processors, cause the one or more processors to carry out steps of;

determining a perimeter that includes one or more objects that are not key firewall objects, wherein the objects are in the network, wherein the perimeter includes a first object that is accessible from a second object that is not a key firewall object, wherein the second object is not within the perimeter, wherein the first object is accessible from the second object only through a first key firewall object;

creating a network topograph, wherein each key firewall object in the network is included in the network topograph, wherein objects within the perimeter are collectively represented as a single perimeter node;

displaying the network topograph in a graphical user interface of a network management application;

receiving input from a user, wherein the input specifies a first perimeter node in the network topograph; and

displaying information about the first perimeter node, wherein the information was not displayed prior to the input being received.

8. An apparatus as recited in claim 7, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of creating the network topograph comprise stored sequences of instructions which cause the one or more processors to carry out a step of representing, in the network topograph, a link in the network only if the link is a direct link between a key firewall object and another object in the network.

9. An apparatus as recited in claim 7, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of determining the perimeter comprise stored sequences of instructions which cause the one or more processors to carry out a step of determining, based on a location, relative to a key firewall object, objects potentially within the perimeter.

10. An apparatus as recited in claim 7, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of displaying information about the first perimeter node comprise the stored sequences of instructions which cause the one or more processors to carry out a step of displaying one or more objects within a perimeter that is represented by the perimeter node.

11. An apparatus as recited in claim 7, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of determining the perimeter comprise stored sequences of instructions which cause the one or more processors to carry out steps of:

identifying a plurality of key firewall objects that collectively define a security domain that comprises one or more other objects; and

placing all the other objects, which are in the security domain, in the perimeter.

12. An apparatus as recited in claim 7, wherein the stored sequences of instructions which cause the one or more processors to carry out the step of determining the perimeter comprise stored sequences of instructions which cause the one or more processors to carry out recursive steps of:

including the first object in the perimeter; and

for each element in a set that includes all objects that (a) directly link to the first object, that (b) are not included in the perimeter, and that (c) are not key firewall objects, performing the recursive steps with that element being the first object.

13. An apparatus for creating a network topograph that includes all select objects that are in a network, the apparatus comprising:

means for determining a first set of one or more non-select objects in the network;

means for creating a network topograph that includes each select object in the network, wherein elements of the first set are collectively represented as a single non-select object;

means for displaying the network topograph in a graphical user interface of a network management application;

means for receiving input from a user, wherein the input specifies a first non-select object in the network topograph; and

means for displaying information about the first non-select object, wherein the information was not displayed prior to the input being received.

14. An apparatus as recited in claim 13, wherein the means for creating the network topograph comprise means for representing, in the network topograph, a link in the network only if the link is a direct link between a select object and another object in the network.

15. An apparatus as recited in claim 13, wherein the means for determining the first set of one or more non-select objects in the network comprise means for determining the one or more non-select objects based on a location of those one or more non-select objects relative to a select object.

16. An apparatus as recited in claim 13, wherein the means for displaying information about the first non-select object comprise means for displaying one or more elements of a set of objects that are collectively represented by the first non-select object.

17. An apparatus as recited in claim 13, wherein the means for determining the first set comprise:

means for identifying a plurality of select objects that collectively define a security domain that comprises one or more other objects; and

means for placing all the other objects, which are in the security domain, in the first set.

18. An apparatus as recited in claim 13, wherein the means for determining the first set comprise means for carrying out recursive steps of:

including a first non-select object in the first set; and

for each element in a set that includes all non-select objects that (a) directly link to the first non-select object and that (b) are not included in the first set, performing the recursive steps with that element being the first non-select object.

19. An apparatus for creating a network topograph that includes all key firewall objects that are in a network, the apparatus comprising:

means for determining a perimeter that includes one or more objects that are not key firewall objects, wherein the objects are in the network, wherein the perimeter includes a first object that is accessible from a second object that is not a key firewall object, wherein the second object is not within the perimeter, wherein the first object is accessible from the second object only through a first key firewall object;

means for creating a network topograph, wherein each key firewall object in the network is included in the network topograph, wherein objects within the perimeter are collectively represented as a single perimeter node;

means for displaying the network topograph in a graphical user interface of a network management application;

means for receiving input from a user, wherein the input specifies a first perimeter node in the network topograph; and

means for displaying information about the first perimeter node, wherein the information was not displayed prior to the input being received.

20. An apparatus as recited in claim 19, wherein the means for creating the network topograph comprise means for representing, in the network topograph, a link in the network only if the link is a direct link between a key firewall object and another object in the network.

21. An apparatus as recited in claim 19, wherein the means for determining the perimeter comprise means for determining, based on a location, relative to a key firewall object, objects potentially within the perimeter.

22. An apparatus as recited in claim 19, wherein the means for displaying information about the first perimeter node comprise means for displaying one or more objects within a perimeter that is represented by the perimeter node.

23. An apparatus as recited in claim 19, wherein the means for determining the perimeter comprise:

means for identifying a plurality of key firewall objects that collectively define a security domain that comprises one or more other objects; and

means for placing all the other objects, which are in the security domain, in the perimeter.

24. An apparatus as recited in claim 19, wherein the means for determining the perimeter means for carrying out recursive steps of:

including the first object in the perimeter; and

for each element in a set that includes all objects that (a) directly link to the first object, that (b) are not included in the perimeter, and that (c) are not key firewall objects, performing the recursive steps with that element being the first object.

25. A computer-readable medium carrying one or more sequences of instructions for creating a network topograph that includes all select objects that are in a network, which instructions, when executed by one or more processors, cause the one or more processors to carry out steps of:

determining a first set of one or more non-select objects in the network;

creating a network topograph that includes each select object in the network, wherein elements of the first set are collectively represented as a single non-select object;

displaying the network topograph in a graphical user interface of a network management application;

receiving input from a user, wherein the input specifies a first non-select object in the network topograph; and

displaying information about the first non-select object, wherein the information was not displayed prior to the input being received.

26. A computer-readable medium as recited in claim 25, wherein the step of creating the network topograph comprises a step of representing, in the network topograph, a link in the network only if the link is a direct link between a select object and another object in the network.

27. A computer-readable medium as recited in claim 25, wherein the step of determining the first set of one or more non-select objects in the network comprises a step of determining the one or more non-select objects based on a location of those one or more non-select objects relative to a select object.

28. A computer-readable medium as recited in claim 25, wherein the step of displaying information about the first non-select object comprises a step of displaying one or more elements of a set of objects that are collectively represented by the first non-select object.

29. A computer-readable medium as recited in claim 25, wherein the step of determining the first set comprises steps of:

identifying a plurality of select objects that collectively define a security domain that comprises one or more other objects; and

placing all the other objects, which are in the security domain, in the first set.

30. A computer-readable medium as recited in claim 25, wherein the step of determining the first set comprises recursive steps of:

including a first non-select object in the first set; and

for each element in a set that includes all non-select objects that (a) directly link to the first non-select object and that (b) are not included in the first set, performing the recursive steps with that element being the first non-select object.

31. A computer-readable medium carrying one or more sequences of instructions for creating a network topograph that includes all key firewall objects that are in a network, which instructions, when executed by one or more processors, cause the one or more processors to carry out steps of:

determining a perimeter that includes one or more objects that are not key firewall objects, wherein the objects are in the network, wherein the perimeter includes a first object that is accessible from a second object that is not a key firewall object, wherein the second object is not within the perimeter, wherein the first object is accessible from the second object only through a first key firewall object;

creating a network topograph, wherein each key firewall object in the network is included in the network topograph, wherein objects within the perimeter are collectively represented as a single perimeter node;

displaying the network topograph in a graphical user interface of a network management application;

receiving input from a user, wherein the input specifies a first perimeter node in the network topograph; and

displaying information about the first perimeter node, wherein the information was not displayed prior to the input being received.

32. A computer-readable medium as recited in claim 31, wherein the step of creating the network topograph comprises a step of representing, in the network topograph, a link in the network only if the link is a direct link between a key firewall object and another object in the network.

33. A computer-readable medium as recited in claim 31, wherein the step of determining the perimeter comprises a step of determining, based on a location, relative to a key firewall object, objects potentially within the perimeter.

34. A computer-readable medium as recited in claim 31, wherein the step of displaying information about the first perimeter node comprises a step of displaying one or more objects within a perimeter that is represented by the perimeter node.

35. A computer-readable medium as recited in claim 31, wherein the step of determining the perimeter comprises steps of:

identifying a plurality of key firewall objects that collectively define a security domain that comprises one or more other objects; and

placing all the other objects, which are in the security domain, in the perimeter.

36. A computer-readable medium as recited in claim 31, wherein the step of determining the perimeter comprises recursive steps of:

including the first object in the perimeter; and

for each element in a set that includes all objects that (a) directly link to the first object, that (b) are not included in the perimeter, and that (c) are not key firewall objects, performing the recursive steps with that element being the first object.