Alarm-driven access control in an enterprise network

• US 20070283012A1
• Filed: 06/01/2006
• Published: 12/06/2007
• Est. Priority Date: 06/01/2006
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Chu, Christopher, Rozensky, Ronald S., Seibel, Robert Rhea, Sundararajan, Mukund
• Granted Patent: US 8,775,602 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 41/022 Multivendor or multi-standard integration
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An alarm access controller is operative to control access to an enterprise network of a communication system responsive to alarms generated by products that are part of a set of internal resources of the enterprise network. In one aspect, the alarm access controller is implemented by a server or other processing element comprising a processor coupled to a memory. The alarm access controller is configured to receive an alarm from one of the products, to identify an external service provider for handling the alarm, and to provide temporary authenticated access of the service provider to the product. By limiting service provider access to an alarm-generating product in accordance with specified time periods or other conditions determined based at least in part on the alarm itself, system security is considerably improved and access control is made more flexible and efficient.

Claims

1. An apparatus for use in a communication system, the apparatus comprising:

at least one processing element comprising a processor coupled to a memory, the processing element implementing an alarm access controller operative to control access to an enterprise network of the system;

wherein the alarm access controller is configured to receive an alarm from a product that is part of a set of internal resources of the enterprise network, to identify an external service provider for handling the alarm, and to provide temporary authenticated access of the service provider to the product.

2. The apparatus of claim 1 wherein the alarm access controller further comprises an alarm severity analyzer operative to process the alarm to determine its severity, wherein one or more conditions of the temporary authenticated access of the service provider to the product are determined based at least in part on the severity of the alarm.

3. The apparatus of claim 1 wherein the alarm access controller further comprises a notice generator operative to generate an alarm notification signal for delivery to the identified service provider.

4. The apparatus of claim 1 wherein the alarm access controller further comprises a trouble ticket generator operative to generate a unique identifier of the alarm.

5. The apparatus of claim 4 wherein the alarm access controller is operative to send the unique identifier of the alarm to the identified service provider in conjunction with an alarm notification.

6. The apparatus of claim 4 wherein the alarm access controller comprises an authenticator operative to authenticate the identified service provider responsive to an access request thereof based at least in part on the unique identifier of the alarm.

7. The apparatus of claim 1 wherein the alarm access controller comprises service-related storage for storing service-related information for respective ones of a plurality of products that are part of the set of internal resources of the enterprise network.

8. The apparatus of claim 7 wherein the service-related information comprises, for each of the products, one or more permitted access times for alarm resolution for that product, as well as information identifying one or more corresponding service providers that should handle alarms generated by that product.

9. The apparatus of claim 8 wherein the access times for a given one of the products are indexed by alarm severity, such that different access times may be determined based on the alarm severity.

10. The apparatus of claim 7 wherein the service-related information comprises, for at least a given one of the products, information identifying at least one additional product for which access is granted to the identified service provider in conjunction with a grant of access to the given product.

11. The apparatus of claim 7 wherein the service-related information comprises, for at least a given one of the products, information identifying one or more access control managers whose authorization is required to obtain any change in one or more specified conditions of the temporary authenticated access of the service provider to the given product.

12. The apparatus of claim 11 wherein in the absence of an alarm generated by the given product the service provider is not permitted to access the given product without approval of the one or more access control managers associated with that product.

13. The apparatus of claim 1 wherein the enterprise network is associated with a customer site, and the set of internal resources of the enterprise network comprises at least a plurality of products from a first vendor, and a plurality of products from a second vendor, wherein the alarm access controller is operative to permit a first service provider to access one of the products from the first vendor responsive to an alarm generated by that first vendor product, and to permit a second service provider to access one of the products from the second vendor responsive to an alarm generated by that second vendor product.

14. The apparatus of claim 1 wherein the service provider accesses the product utilizing a federated identity.

15. The apparatus of claim 1 wherein the service provider comprises at least one of a technician and an expert system.

16. The apparatus of claim 1 wherein the alarm access controller is implemented at least in part in the form of software running on the processor.

17. The apparatus of claim 1 wherein the set of internal resources of the enterprise network comprises a plurality of products all from a single vendor.

18. A system comprising:

an enterprise network comprising a set of internal resources including at least one product; and

an alarm access controller operative to control access to the enterprise network;

wherein the alarm access controller is configured to receive an alarm from the product, to identify an external service provider for handling the alarm, and to provide temporary authenticated access of the service provider to the product.

19. A method for use in controlling access to an enterprise network of a communication system, the method comprising the steps of:

receiving an alarm from a product that is part of a set of internal resources of the enterprise network;

identifying an external service provider for handling the alarm; and

providing temporary authenticated access of the service provider to the product.

20. The method of claim 19 wherein the receiving, identifying and providing steps are implemented at least in part in software running on a processing element of the system.

21. The method of claim 19 wherein the processing element further comprises at least one of a router of the system and a firewall of the system.

22. An article of manufacture comprising a machine-readable storage medium containing software code, wherein the software code when executed by a processing element of the system performs the steps of the method of claim 19.