Establishment and enforcement of policies in packet-switched networks

• US 20080077970A1
• Filed: 07/25/2007
• Published: 03/27/2008
• Est. Priority Date: 08/25/2003
• Status: Abandoned Application

• Current Assignee: Susan Hares
• Original Assignee: Susan Hares
• Inventors: Hares, Susan
• Application Number:
  US11/881,231
• Publication Number:
  US 20080077970A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/021 Ensuring consistency of routing table updates, e.g. by using epoch numbers
• CPC Class Codes: H04L 45/033 by updating distance vector protocols
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Policy domains are introduced, which include methods and algorithms for ensuring policy consistency within defined regions of one or more communications networks. Examples of such policies include network functions such as routing, filtering, security, authentication, information summarization and expansion. These policies may be organized into hierarchies of policy categories. The policy domains include mechanisms for adding and deleting policies while preserving consistency, as well as mechanisms for allowing fast synchronization and convergence of policies between local databases resident different nodes/peers in the networks. Policy domains may delineated by pre-existing logical topologies, such as autonomous systems, or may have evolving boundaries.

Claims

1. In an inter-network including a plurality of interconnected communications nodes, a method of colluding between the plurality of nodes, the method comprising:

at a first node in the plurality of nodes, receiving a network policy instance from a second node in the plurality of nodes, the network policy instance regulating processing of data traversing the inter-network;

determining consistency of the network policy instance with a local policy database resident in the first node, the local policy database regulating network processing in the first node, determining consistency of the network policy instance further including identifying the network policy instance in a hierarchy of network policies to determine a rank for the network policy instance; and

if and only if the network policy is consistent with the local policy database, adding the network policy to the local policy database.

2. The method of claim 1, wherein the plurality of network nodes are distributed across one or more autonomous systems.

3. The method of claim 1, wherein the plurality of network nodes are distributed across two or more autonomous systems.

4. The method of claim 1, wherein the plurality of network nodes are at least partially packet-switched.

5. The method of claim 1 wherein the plurality of network nodes are at least partially cell-based.

6. The method of claim 1, wherein the inter-network includes one or more Exterior Gateway Protocols.

7. The method of claim 1, wherein the inter-network includes one or more interior gateway protocols.

8. The method of claim 1, wherein the inter-network employs Border Gateway Protocol.

9. The method of claim 1, wherein the network policy instance specifies which of the plurality of nodes are reachable from the first node.

10. The method of claim 1, wherein the network policy instance specifies certificate authorities for authenticating information passed between the plurality of nodes.

11. The method of claim 1, wherein the network policy instance specifies syntax rules for packets received by the first node.

12. The method of claim 1, wherein the network policy instance specifies attestation policies for the first node.

13. The method of claim 12, wherein the attestation policies are based on IPSec.

14. The method of claim 12, wherein the attestation policies are based on MD-5.

15. The method of claim 12, wherein the attestation policies are based on Public Key Infrastructure.

16. The method of claim 1, wherein the network policy instance specifies policies for compressing information forwarded in the plurality of nodes.

17. The method of claim 1, wherein the network policy instance specifies policies for expanding information traversing the plurality of nodes.

18. The method of claim 1, wherein the network policy instance specifies route selection policies.

19. The method of claim 1, wherein the network policy instance specifies route distribution.

20. The method of claim 19, wherein the route distribution policies may be time-based.

21. The method of claim 20, wherein the route distribution policies may be event-based.

22. The method of claim 1, wherein the network policy instance includes peer policies, the peer policies determining at least one of a network information base supported by the peer and one or more protocol functions supported by the peer.