APPROACH TO VISUALIZE CURRENT AND HISTORICAL ACCESS POLICY OF A GROUP BASED POLICY

• US 20170206701A1
• Filed: 01/15/2016
• Published: 07/20/2017
• Est. Priority Date: 01/15/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Agrawal, Sanjay, Gupta, Ruchir, Ahmed, Syed Basheeruddin, Yang, Yi, Kaushik, Meenakshi
• Granted Patent: US 10,187,270 B2
• Time in Patent Office: Days
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: G06T 2200/04 involving 3D image data
• CPC Class Codes: G06T 2200/24 involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

Systems, methods, and non-transitory computer-readable storage media for visualizing current and historical access policy of a group based policy. A first group based policy and a second group based policy are received at a computing device, where each group based policy includes policy rules defining a range of destination internet protocol addresses, a range of source internet protocol addresses and a range of access ports. The computing device renders a three dimensional representation of the first group based policy, based on the policy rules of the first group based policy. The computing device renders a three dimensional representation of the second group based policy, based on the policy rules of the second group based policy. The computing device displays the representations of the first group based policy and second group based policy on a graphical interface.

Claims

1. A computer implemented method comprising:

receiving, by a computing device, a first group based policy and a second group based policy, each group based policy including policy rules defining a range of destination internet protocol addresses, a range of source internet protocol addresses and a range of access ports;

based on the policy rules of the first group based policy, rendering, by the computing device, a three dimensional representation of the first group based policy;

based on the policy rules of the second group based policy, rendering, by the computing device, a three dimensional representation of the second group based policy; and

displaying, on the computing device, the three dimensional representation of the first group based policy and the three dimensional representation of the second group based policy on a graphical interface.

2. The computer implemented method of claim 1, wherein rendering the three dimensional representation of the first group based policy further comprises:

rendering the range of destination internet protocol addresses of the first group based policy on a first-axis;

rendering the range of source internet protocol addresses of the first group based policy on a second-axis; and

rendering the range of access ports of the first group based policy on a third-axis.

3. The computer implemented method of claim 1, further comprising:

receiving flow data describing a destination internet protocol address, a source internet protocol address, and an access port; and

rendering a representation of the flow data on the graphical interface.

4. The computer implemented method of claim 1, wherein the access ports are transmission control protocol ports.

5. The computer implemented method of claim 1, further comprising:

receiving a third group based policy, the third group based policy including policy rules defining a range of destination internet protocol addresses, a range of source internet protocol addresses and a range of access ports;

based on the policy rules of the third group based policy, rendering a three dimensional representation of the third group based policy; and

displaying the three dimensional representation of the third group based policy on the graphical interface, wherein the three dimensional representation of the third group based policy is visually distinct from the three dimensional representation of the first group based policy and the three dimensional representation of the second group based policy.

6. The computer implemented method of claim 1, further comprising:

in response to a determination that the first group based policy has been deleted, deleting the three dimensional representation of the first group based policy on the graphical interface.

7. The computer implemented method of claim 1, further comprising:

receiving modifications to the first group based policy; and

in response to receiving the modifications to the first group based policy, modifying the three dimensional representation of the first group based policy on the graphical interface based on the modifications.

8. A non-transitory computer-readable medium containing instructions that, when executed by a computing device, cause the computing device to:

receive a first group based policy and a second group based policy, each group based policy including policy rules defining a range of destination internet protocol addresses, a range of source internet protocol addresses and a range of access ports;

based on the policy rules of the first group based policy, render a three dimensional representation of the first group based policy;

based on the policy rules of the second group based policy, render a three dimensional representation of the second group based policy; and

display the three dimensional representation of the first group based policy and the three dimensional representation of the second group based policy on a graphical interface.

9. The non-transitory computer-readable medium of claim 8, wherein the instructions to render in the three dimensions the representation of the first group based policy further cause the computing device to:

render the range of destination internet protocol addresses of the first group based policy on a first-axis;

render the range of source internet protocol addresses of the first group based policy on a second-axis; and

render the range of access ports of the first group based policy on a third-axis.

10. The non-transitory computer-readable medium of claim 8, wherein the instructions further cause the computing device to:

receive flow data describing a destination internet protocol address, a source internet protocol address, and an access port; and

render a representation of the flow data on the graphical interface.

11. The non-transitory computer-readable medium of claim 10, wherein the access ports are user datagram protocol ports.

12. The non-transitory computer-readable medium of claim 8, wherein the instructions further cause the computing device to:

receive a third group based policy, the third group based policy including policy rules defining a range of destination internet protocol addresses, a range of source internet protocol addresses and a range of access ports;

based on the policy rules of the third group based policy, render a three dimensional representation of the third group based policy; and

display the three dimensional representation of the third group based policy on the graphical interface, wherein the three dimensional representation of the third group based policy is visually distinct from the three dimensional representation of the first group based policy and the three dimensional representation of the second group based policy.

13. The non-transitory computer-readable medium of claim 8, wherein the instructions further cause the computing device to:

in response to a determination that the first group based policy has been deleted, delete the three dimensional representation of the first group based policy on the graphical interface.

14. The non-transitory computer-readable medium of claim 8, wherein the instructions further cause the computing device to:

receive modifications to the first group based policy; and

in response to receiving the modifications to the first group based policy, modify the three dimensional representation of the first group based policy on the graphical interface based on the modifications.

15. A computing system comprising:

one or more computer processors; and

a memory containing instructions that, when executed by the one or more computer processors, cause the computing system to;

receive a first group based policy and a second group based policy, each group based policy including policy rules defining a range of destination internet protocol addresses, a range of source internet protocol addresses and a range of access ports;

based on the policy rules of the first group based policy, render a three dimensional representation of the first group based policy;

based on the policy rules of the second group based policy, render a three dimensional representation of the second group based policy; and

display the three dimensional representation of the first group based policy and the three dimensional representation of the second group based policy on a graphical interface.

16. The computing system of claim 15, wherein rendering the three dimensional representation of the first group based policy further comprises:

rendering the range of destination internet protocol addresses of the first group based policy on a first-axis;

rendering the range of source internet protocol addresses of the first group based policy on a second-axis; and

rendering the range of access ports of the first group based policy on a third-axis.

17. The computing system of claim 15, wherein the instructions further cause the computing system to:

receive flow data describing a destination internet protocol address, a source internet protocol address, and an access port; and

render a representation of the flow data on the graphical interface.

18. The computing system of claim 15, wherein the instructions further cause the computing system to:

receive a third group based policy, the third group based policy including policy rules defining a range of destination internet protocol addresses, a range of source internet protocol addresses and a range of access ports;

based on the policy rules of the third group based policy, render a three dimensional representation of the third group based policy; and

display the three dimensional representation of the third group based policy on the graphical interface, wherein the three dimensional representation of the third group based policy is visually distinct from the three dimensional representation of the first group based policy and the three dimensional representation of the second group based policy.

19. The computing system of claim 15, wherein the instructions further cause the computing system to:

in response to a determination that the first group based policy has been deleted, delete the three dimensional representation of the first group based policy on the graphical interface.

20. The computing system of claim 15, wherein the instructions further cause computing system to:

receive modifications to the first group based policy; and

in response to receiving the modifications to the first group based policy, modify the three dimensional representation of the first group based policy on the graphical interface based on the modification.