PROVIDING ACCESS CONTROL LIST MANAGEMENT

• US 20090119750A1
• Filed: 12/14/2007
• Published: 05/07/2009
• Est. Priority Date: 12/14/2007
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: SEMBUGAMOORTHY, Vel, TORAB, Homayoun
• Granted Patent: US 8,176,146 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Control list management may be provided. First, it may be detected that an event has occurred on a data network. Then, it may be determined, in response to the detected event, that a device on the data network needs to be provided with an access control list. Next, the access control list may be obtained from a database central to the data network. Then, the device may be provided with the obtained access control list.

Claims

1. A method for providing access control list management, the method comprising:

detecting that an event has occurred on a network;

determining, in response to the detected event, that a device on the network needs to be provided with an access control list;

obtaining the access control list from a database central to the network; and

providing the device with the obtained access control list.

2. The method of claim 1, wherein detecting that the event has occurred on the network comprises detecting the event comprising at least one of the following:

a malicious attack on the network and a violation of service assurance on the network.

3. The method of claim 1, wherein detecting that the event has occurred on the network comprises detecting the event comprising the device being replaced.

4. The method of claim 1, wherein detecting that the event has occurred on the network comprises detecting the event comprising the device being repaired.

5. The method of claim 1, wherein detecting that the event has occurred on the network comprises detecting the event comprising a service provider indicating a desire to reallocate bandwidth assigned to different types of services provided over the network through the device.

6. The method of claim 1, wherein detecting that the event has occurred on the network comprises detecting the event comprising a service provider indicating a desire to reallocate bandwidth assigned to different types of services provided over the network through the device, the different types of services comprising at least two of the following:

video, voice-over-IP, and data.

7. The method of claim 1, wherein determining, in response to the detected event, that the device on the network needs to be provided with the access control list comprises determining wherein the device comprises one of the following:

an access device, an aggregation device, a core network device, and a video/voice-over-ip device.

8. The method of claim 1, wherein obtaining the access control list from the database central to the network comprises selecting the access control list from a plurality of access control lists in the database.

9. The method of claim 8, wherein selecting the access control list from the plurality of access control lists in the database comprises selecting based upon a device type associated with the device.

10. The method of claim 8, wherein selecting the access control list from the plurality of access control lists in the database comprises selecting based upon a device type associated with the device, the device type comprising one of the following:

a core router, an edge router, an access device, an aggregating router, and a video/voice-over-ip device.

11. The method of claim 8, wherein selecting the access control list from the plurality of access control lists in the database comprises selecting based upon bandwidths assigned to different types of services provided over the network, the bandwidths being one of the following:

predetermined and dynamically determined.

12. The method of claim 8, wherein selecting the access control list from the plurality of access control lists in the database comprises selecting based upon bandwidths assigned to different types of services provided over the network, the different types of services comprising the following:

video, voice-over-IP, and data, the bandwidths being one of the following;

predetermined and dynamically determined.

13. The method of claim 1, wherein providing the device with the access control list comprises providing the device with the access control list over the network.

14. The method of claim 1, further comprising, subsequent to obtaining the access control list, displaying the access control list.

15. The method of claim 14, further comprising providing a user the capability to edit the displayed access control list.

16. The method of claim 1, wherein obtaining the access control list comprises:

obtaining the access control list comprising a template; and

customizing the obtained access control list.

17. The method of claim 1, wherein detecting that the event has occurred on the network comprises detecting that the event has occurred on the network comprising one of the following:

a data network and a communication network.

18. The method of claim 1, wherein providing the device with the access control list comprises importing a generic access control list template from an external source.

19. A computer-readable medium which stores a set of instructions which when executed performs a method for providing control list management, the method executed by the set of instructions comprising:

determining that a first device on a data network corresponds to a first grouping type;

obtaining a first access control list from a database central to the data network, the first access control list corresponding to the first grouping type; and

providing, over the data network, the first device with the first access control list.

20. A system for providing control list management, the system comprising:

a memory storage; and

a processing unit coupled to the memory storage, wherein the processing unit is operative to;

create a first access control list in response to user input;

provide the access control list to a first device on a data network;

determine that the access control list functions to a predetermined expectation in the first device; and

provide the access control list to a second device on the data network in response to determining that the access control list functions to the predetermined expectation in the first device, the second device and the first device being of a same device type.