HYBRID SDN/LEGACY POLICY ENFORCEMENT

• US 20170006067A1
• Filed: 06/30/2016
• Published: 01/05/2017
• Est. Priority Date: 07/02/2015
• Status: Active Grant

• Current Assignee: Perspecta Labs Inc. (Perspecta, Inc.)
• Original Assignee: Vencore Labs, Inc.
• Inventors: Narain, Sanjai
• Granted Patent: US 10,250,444 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/403 with centralised control, e.g. polling
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method, system, and computer program product configure elements of a hybrid network. The method may include a processor obtaining at a first controller communicatively coupled to components of a hybrid network, a requirement for the hybrid network; the components include a first component type and a second component type. After obtaining the requirement, the processor generates a plan to configure a component of the first component type and a component of the second component type. The processor configures the component of the first component type according to a first portion of the plan by utilizing a security protocol over an unsecured connection. The processor configures the component of the second component type according to a second portion of the plan by transmitting this portion to a controller of components of the second component type in the hybrid network. The controller configures the component upon receipt of the portion.

Claims

1. A computer-implemented method comprising:

obtaining, by one or more processors, at a first controller communicatively coupled to components of a hybrid network, a requirement for the hybrid network, wherein the components of the hybrid network comprise a first component type and a second component type, wherein the first component type and the second component type are configured utilizing different protocols;

responsive to obtaining the requirement, generating, by the one or more processors, based on the requirement, a plan to configure at least one component of the first component type and at least one component of the second component type;

configuring, by the one or more processors, the at least one component of the first component type according to a first portion of the plan by utilizing a security protocol over an unsecured connection; and

configuring, by the one or more processors, the at least one component of the second component type according to the second portion of the plan, wherein the configuring comprises;

transmitting, by the one or more processor, to a controller of components of the second component type in the hybrid network, a second portion of the plan, wherein the controller configures the at least one component of the second component type according to the second plan portion of the plan, upon receipt of the second portion of the plan.

2. The method of claim 1, further comprising:

obtaining, by the one or more processors, based on the configuring of the at least one component of the first component type and the configuring of at least one component of the second component type, configuration and state information from the at least one component of the first component type and the at least one component of the second component type.

3. The method of claim 1, wherein the at least one component of the first component type comprises a legacy component and the at least one component of the second component type comprises a software-defined networking component.

4. The method of claim 3, wherein the legacy component is a level 3 component.

5. The method of claim 1, wherein the plan comprises configuration implementing requirements for the at least one component of the first component type and the at least one component of the second component type.

6. The method of claim 5, wherein the generating the plan comprises:

converting, by the one or more processors, the requirement into a primitive constraint;

utilizing, by the one or more processors, a simultaneous multi-threading solver to find a solution in abstract form for the primitive constraint; and

transforming, by the one or more processors, the solution into a configuration script.

7. The method of claim 6, wherein the configuring the at least one component of the first component type and the configuring the at least one component of the second component type, comprises applying, the one or more processors, the configuration script to the at least one component of the first component type and the configuring the at least one component of the second component type.

8. The method of claim 6, wherein the primitive constraint comprises at least one of:

a control constraint, a capacity constraint, a bandwidth constraint or a routing policy constraint.

9. The method of claim 1, wherein the generating the plan further comprises:

utilizing, by the one or more processors, a specification language with a catalog of requirements, wherein the specification language captures architecture patterns, logical structures, and relationships of the components of the hybrid network;

locating, by the one or more processors, the requirement in the catalog of requirements; and

utilizing the architecture patterns, the logical structures, and the relationships of the components of the hybrid network relevant to the requirement to formulate security and functionality tasks for configuring the at least one component of the at least one component of the first component type and the at least one component of the second component type to enable the hybrid network to meet the requirement.

10. The method of claim 1, wherein the generating comprises simultaneously generating the first portion of the plan and the second portion of the plan.

11. A computer program product comprising:

a computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method comprising;

obtaining, by the one or more processors, at a first controller communicatively coupled to components of a hybrid network, a requirement for the hybrid network, wherein the components of the hybrid network comprise a first component type and a second component type, wherein the first component type and the second component type are configured utilizing different protocols;

responsive to obtaining the requirement, generating, by the one or more processors, based on the requirement, a plan to configure at least one component of the first component type and at least one component of the second component type;

configuring, by the one or more processors, the at least one component of the first component type according to a first portion of the plan by utilizing a security protocol over an unsecured connection; and

configuring, by the one or more processors, the at least one component of the second component type according to the second portion of the plan, wherein the configuring comprises;

transmitting, by the one or more processor, to a controller of components of the second component type in the hybrid network, a second portion of the plan, wherein the controller configures the at least one component of the second component type according to the second plan portion of the plan, upon receipt of the second portion of the plan.

12. The computer program product of claim 11, further comprising:

obtaining, by the one or more processors, based on the configuring of the at least one component of the first component type and the configuring of at least one component of the second component type, configuration and state information from the at least one component of the first component type and the at least one component of the second component type.

13. The computer program product of claim 11, wherein the at least one component of the first component type comprises a legacy component and the at least one component of the second component type comprises a software-defined networking component.

14. The computer program product of claim 13, wherein the legacy component is a level 3 component.

15. The computer program product of claim 11, wherein the plan comprises configuration implementing requirements for the at least one component of the first component type and the at least one component of the second component type.

16. The computer program product of claim 15, wherein the generating the plan comprises:

converting, by the one or more processors, the requirement into a primitive constraint;

utilizing, by the one or more processors, a simultaneous multi-threading solver to find a solution in abstract form for the primitive constraint; and

transforming, by the one or more processors, the solution into a configuration script.

17. The computer program product of claim 16, wherein the configuring the at least one component of the first component type and the configuring the at least one component of the second component type, comprises applying, the one or more processors, the configuration script to the at least one component of the first component type and the configuring the at least one component of the second component type.

18. The computer program product of claim 16, wherein the primitive constraint comprises at least one of:

a control constraint, a capacity constraint, a bandwidth constraint or a routing policy constraint.

19. The computer program product of claim 11, wherein the generating the plan further comprises:

utilizing, by the one or more processors, a specification language with a catalog of requirements, wherein the specification language captures architecture patterns, logical structures, and relationships of the components of the hybrid network;

locating, by the one or more processors, the requirement in the catalog of requirements; and

utilizing the architecture patterns, the logical structures, and the relationships of the components of the hybrid network relevant to the requirement to formulate security and functionality tasks for configuring the at least one component of the at least one component of the first component type and the at least one component of the second component type to enable the hybrid network to meet the requirement.

20. A system comprising:

a memory;

one or more processors in communication with the memory; and

program instructions executable by the one or more processors via the memory to perform a method, the method comprising;

obtaining, by the one or more processors, at a first controller communicatively coupled to components of a hybrid network, a requirement for the hybrid network, wherein the components of the hybrid network comprise a first component type and a second component type, wherein the first component type and the second component type are configured utilizing different protocols;

responsive to obtaining the requirement, generating, by the one or more processors, based on the requirement, a plan to configure at least one component of the first component type and at least one component of the second component type;

configuring, by the one or more processors, the at least one component of the first component type according to a first portion of the plan by utilizing a security protocol over an unsecured connection; and

configuring, by the one or more processors, the at least one component of the second component type according to the second portion of the plan, wherein the configuring comprises;

transmitting, by the one or more processor, to a controller of components of the second component type in the hybrid network, a second portion of the plan, wherein the controller configures the at least one component of the second component type according to the second plan portion of the plan, upon receipt of the second portion of the plan.