Independent role based authorization in boundary interface elements

• US 20100132027A1
• Filed: 11/25/2008
• Published: 05/27/2010
• Est. Priority Date: 11/25/2008
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Ou, Shukong
• Granted Patent: US 8,272,029 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A boundary interface element for communications networks is disclosed. The boundary interface element is adapted for enabling a network administrator for a first network coupled to a first network interface of the boundary interface element to configure a policy for the first network interface independently of the other administrators of the other interfaces, while restricting access to a second network interface of the boundary interface element. Similarly, the boundary interface element enables a network administrator for a second network coupled to the second network interface of the boundary interface element to configure a policy for the second network interface while restricting access to the first network interface. The network administrator for the first network is permitted to view the policy configured for the second network interface, and the network administrator for the second network is permitted to view the policy configured for the first network interface. The boundary interface element may be employed in a variety of network deployment scenarios.

Claims

1. A boundary interface element having at least two interfaces, comprising:

a supervisory module for controlling the switching of communications between the interfaces; and

an interface administrator coupled to the supervisory module and adapted for enabling a network administrator for a first network coupled to a first network interface of the boundary interface element to configure a policy for the first network interface, while restricting access to a second network interface of the boundary interface element, and for enabling a network administrator for a second network coupled to the second network interface of the boundary interface element to configure a policy for the second network interface while restricting access to the first network interface.

2. The boundary interface element of claim 1, wherein the restricted access by the interface administrator enables the network administrator for the first network to view the policy for the second network interface and the network administrator for the second network to view the policy for the first network interface.

3. The boundary interface element of claim 2, wherein the first network interface is coupled to a service provider network and the second network interface is coupled to a customer network.

4. The boundary interface element of claim 2, wherein the first network interface is coupled to a first customer network and the second network interface is coupled to a second customer network.

5. The boundary interface element of claim 2, wherein the first network interface is coupled to a first peer network and the second network interface is coupled to a second peer network.

6. The boundary interface element of claim 2, wherein the first network interface is coupled to a first home network and the second network interface is coupled to a second home network, and the boundary interface element further comprises a third network interface coupled to a first service provider network and a fourth network interface coupled to a second service provider network.

7. A method of configuring a network boundary interface element, comprising the steps of:

enabling a network administrator for a first network coupled to a first network interface of the boundary interface element to configure a policy for the first network interface, while restricting access to a second network interface of the boundary interface element, and

enabling a network administrator for the second network coupled to the second network interface of the boundary interface element to configure a policy for the second network interface while restricting access to the second network interface.

8. The method of claim 7, further comprising the steps of enabling the network administrator for the first network to view the policy for the second network interface, and the network administrator for the second network to view the policy for the first network interface.

9. The method of claim 8, wherein the first network interface is coupled to a service provider network and the second network interface is coupled to a customer network.

10. The method of claim 8, wherein the first network interface is coupled to a first customer network and the second network interface is coupled to a second customer network.

11. The method of claim 8, wherein the first network interface is coupled to a first peer network and the second network interface is coupled to a second peer network.

12. The method of claim 8, wherein the first network interface is coupled to a first home network and the second network interface is coupled to a second home network, and the boundary interface element further comprises a third network interface coupled to a first service provider network and a fourth network interface coupled to a second service provider network.

13. A machine-readable medium having computer encoded instructions thereon, which when executed by a processor, enable a boundary interface element having at least two interfaces, a supervisory module for controlling the switching of communications between the interfaces;

and an interface administrator coupled to the supervisory module, to;

enable a network administrator for a first network coupled to a first network interface of the boundary interface element to configure a policy for the first network interface, while restricting access to a second network interface of the boundary interface element, and enable a network administrator for a second network coupled to the second network interface of the boundary interface element to configure a policy for the second network interface while restricting access to the first network interface.

14. The computer-readable medium of claim 13, further enabling the network administrator for the first network to view the policy for the second network interface, and the network administrator for the second network to view the policy for the first network interface.