Systems and methods for managing network services between private networks

• US 20060233180A1
• Filed: 04/14/2005
• Published: 10/19/2006
• Est. Priority Date: 04/14/2005
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel SA (Nokia Corporation)
• Inventors: Bou-Diab, Bashar Said, Serghi, Laura Mihaela, McBride, Brian
• Granted Patent: US 7,483,438 B2
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Systems and methods for managing network services between private networks are disclosed. Advertisement of network services which are available in a services network is controlled in accordance with a policy associated with each network service. Network service information is advertised to an external services network only for those network services which have associated policies permitting distribution of the network services through external networks. External network services may also or instead be advertised to a services network from one or more external services networks and subsequently made available in the services network.

Claims

1. An apparatus for managing network services in a private services network, the apparatus comprising:

a proxy module configured to receive network service information for a network service which is available in the services network and has an associated network service access policy specifying a permitted access level for distribution of the network service in external networks, and to control advertisement of the network service information to an external services network in accordance with the network service access policy associated with the network service.

2. The apparatus of claim 1, wherein the access policy comprises a service policy stored in a service policies registry of the private services network.

3. The apparatus of claim 1, wherein the proxy module is further configured to receive, from an external services network, network service information associated with an external network service available in the external services network, and to make the external network service available in the services network.

4. The apparatus of claim 3, wherein the proxy module is configured to make the external network service available in the services network by publishing the external network service in a services registry of the services network.

5. The apparatus of claim 4, wherein the services registry is configured to store information associated with internal network services available in the services network and external network services available from the external services network.

6. The apparatus of claim 3, wherein the network service information associated with the external network service comprises access information specifying access rules for controlling access to the external network service, and wherein the proxy module makes the external network service available in the services network in accordance with the access rules.

7. The apparatus of claim 1, wherein the proxy module comprises a network controller proxy module configured to receive the network service information from a network services advertisement module comprising a network controller of the services network, and to control advertisement of the network service by mediating advertisement in the services network of a network service description for the network service, and further configured to receive from an external services network and forward to the network controller network service information associated with an external network service available in the external services network.

8. The apparatus of claim 1, further comprising at least one of:

a policy enforcement module configured to enforce policies of the services network;

a security module configured to provide secure communication between the services network and the external services network, and within the services network;

a forwarding module configured to forward communication traffic from the services network to the external services network;

a Simple Object Access Protocol (SOAP) proxy module configured to adapt service messages associated with network services between addressing schemes of the services network and the external services network;

a service handling module configured to handle network service messages, associated with network services, from both the services network and the external services network; and

a data collector module for collecting logs of transactions between the services network and the external services network.

9. The apparatus of claim 8, wherein the SOAP proxy module is further configured to classify traffic associated with network services as control traffic or data traffic, to transmit control traffic comprising the received network service information to the proxy module for transfer to the external services network, and to modify SOAP information in data traffic for further processing.

10. A system for managing network services of a private services network, the system comprising:

at least one services network gateway operatively coupled to the services network and to a respective external services network, each of the at least one services network gateway comprising the apparatus of claim 1;

and

at least one network controller, the at least one network controller comprising a designated network controller operatively coupled to the at least one services network gateway for managing network service access policies associated with network services available in the services network and a registry of network services available in the services network.

11. The system of claim 10, wherein the designated network controller comprises a network services advertisement module configured to identify network services which are available in the services network and have associated network service access policies permitting distribution of the network services in external networks, and to generate advertisement information comprising network service information associated with the identified network services.

12. The system of claim 10, wherein each external services network comprises a services registry into which network services advertised to the external services network from the services network are published.

13. The system of claim 10, wherein the proxy module of each services network gateway is further configured to receive from the external services network to which it is operatively coupled, network service information associated with external network services available in the external services network, and to make the external network services available in the services network.

14. The system of claim 10, further comprising at least one of:

a client gateway operatively coupled to one of the at least one network controller and to the services network for providing an access point to the services network for client of the services network, the network controller to which the client gateway is operatively coupled managing policies to be enforced by the client gateway for controlling client access to the external services network and network services; and

a public network gateway operatively coupled to the services network and to a public network for providing an access point to the services network for a client of the services network through the public network, an access point to network services in the public network for a client of the services network, or both.

15. The system of claim 10,

wherein each of the external services networks comprises:

at least one services network gateway comprising the apparatus of claim 1 and operatively coupled to the external services network and to a respective services network gateway of the services network;

at least one network controller, the at least one network controller comprising a designated network controller operatively coupled to each services network gateway for managing network service access policies associated with network services available in the services network, and a registry of network services available in the services network; and

at least one of;

a client gateway operatively coupled to one of the at least one network controller and to the external services network for providing an access point to the external services network for a client of the external services network, the network controller to which the client gateway is operatively coupled managing policies to be enforced by the client gateway for controlling client access to the external services network and network services; and

a public network gateway operatively coupled to one of the at least one network controller, to the external services network and to a respective public network for providing an access point to the external services network for a respective group of clients of the external services network through the public network, an access point to network services in the public network for clients of the external services network, or both, the network controller to which the public network gateway is operatively coupled managing policies to be enforced by the public network gateway for controlling client access to the external services network and network services through the public network.

16. An apparatus for managing network services in a private services network, the apparatus comprising:

a proxy module configured to receive, from an external services network, network service information associated with an external network service available in the external services network, and to make the external network service available in the services network.

17. The apparatus of claim 16, wherein the proxy module is configured to make the external network service available in the services network by publishing the external network service in a services registry of the services network, the services registry being configured to store information associated with internal network services available in the services network and external network services available from the external services network.

18. A system for managing network services of a private services network, the system comprising:

at least one services network gateway operatively coupled to the services network and to a respective external services network, each of the at least one services network gateway comprising the apparatus of claim 16;

and

at least one network controller, the at least one network controller comprising a designated network controller operatively coupled to each services network gateway for managing a registry of internal network services available in the services network and external network services available in the at least one external services network for which information is received by a services network gateway.

19. An apparatus for managing network services in a private services network, the apparatus comprising:

a gateway interface to be operatively coupled to a services network gateway configured to exchange communication traffic between the services network and an external services network; and

a network service advertisement module, operatively coupled to a services registry and to the gateway interface, and configured to receive from the services network gateway through the gateway interface external network service information associated with a network service available in the external services network, to publish the external network service to the services registry, to identify an internal network service which is available in the services network and has an associated network service access policy permitting distribution of the network service in the external services network, and to generate and forward to the services network gateway through the gateway interface advertisement information associated with the identified internal network service, the advertisement information comprising information for advertising the identified internal network service to the external services network.

20. A system for managing a private services network in which network services provided by network service provider clients of the services network are made accessible to network service consumer clients of the services network, the system comprising:

at least one services network gateway to be operatively coupled to a respective external services network; and

at least one network controller, the at least one network controller comprising a designated network controller operatively coupled to each services network gateway and comprising the apparatus of claim 19, each services network gateway mediating advertisement of internal network services of the services network to the external services network to which it is to be operatively coupled.

21. A method of managing network services between private services networks, the method comprising:

identifying a network service available in a services network, the network service having an associated network service access policy specifying a permitted access level of the network service;

advertising the identified network service to an external services network where the network service access policy associated with the identified network service allows access to the identified network service from the external services network;

receiving, from an external services network, network service information associated with an external network service available in the external services network; and

making the external network service available in the services network.

22. The method of claim 21, wherein the access policy comprises a service policy stored in a service policies registry of the services network, further comprising:

accessing the network service access policy associated with the identified network service in the service policies registry.

23. The method of claim 21, wherein making comprises publishing the external network service in a services registry of the services network.

24. The method of claim 21, wherein identifying comprises accessing a services registry of the services network to identify an internal network service available in the services network, and wherein making comprises publishing the external network service in the services registry.

25. A machine-readable medium storing instructions which when executed perform the method of claim 21.