Policy management and conflict resolution in computer networks

• US 6,381,639 B1
• Filed: 12/22/1998
• Issued: 04/30/2002
• Est. Priority Date: 05/25/1995
• Status: Expired due to Term

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Aprisma Management Technologies Incorporated (Broadcom, Inc.)
• Inventors: Scott, Walter, Dev, Roger, Rustici, Eric, Thebaut, Suzanne, Kaikini, Prasan, Aggarwal, Ajay, Wohlers, Todd, Ibe, Oliver, Lewis, Lundy, Malik, Rajiv, Sycamore, Steve
• Primary Examiner(s): Coulter, Kenneth R.
• Application Number:
  US09/219,294
• Time in Patent Office: 1,225 Days
• Field of Search: 709/221, 709/222
• US Class Current: 709/222
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/0879 Manual configuration through operator
• CPC Class Codes: H04L 41/0883 Semiautomatic configuration, e.g. proposals from system
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages

Abstract

Method and apparatus for determining an enforceable policy applicable to one or more network devices. The method includes attaching one or more rule elements to one or more domain elements to create policies, the domain elements representing network devices and groups of network devices, and the rule elements defining actions, a method for determining whether a conflict exists between the polices, and a method for resolving the conflicts to produce one or more enforceable policies.

Claims

1. A system for determining an enforceable policy applicable to one or more network devices, the system comprising a computer-readable medium encoded with:

a data structure defining one or more domain elements that represent one or more network devices, and defining a plurality of rule elements that define one or more actions; and

a plurality of executable methods comprising;

a method for attaching one or more of the plurality of rule elements to the one or more of the domain elements to create at least one policy.

2. The system of claim 1, wherein the plurality of executable methods further comprises:

a method for determining whether at least one conflict exists between at least two of the policies; and

a method for resolving the at least one conflict to produce one or more enforceable policies.

3. The system of claim 2, wherein the method for resolving conflicts comprises resolving the at least one conflict when any policy becomes active at a scheduled event.

4. The system of claim 1, wherein the one or more domain elements include both location-based groups and nonlocation-based groups.

5. The system of claim 4, wherein the location-based groups are topological groups and the nonlocation-based groups are selected from the group comprising logical end systems groups and logical user groups.

6. The system of claim 2, further comprising a method for executing at least one of the one or more enforceable policies.

7. The system of claim 1, the one or more domain elements include at least one of topological and logical domains.

8. The system of claim 2, wherein the method for determining whether at least one conflict exists comprises determining whether at least two policies have an overlap in an attribute of the domain elements and scheduling.

9. The system of claim 2, wherein the one or more domain elements include at least one attribute and at least one attribute value, the rules specify attribute values for the one or more domain elements, and the method for determining whether at least one conflict exists includes comparing the attribute values.

10. The system of claim 9, wherein the rules are “

if/then”

rules having the attribute values on the “

if”

side of the rule and the one or more actions on the “

then”

side of the rule.

11. The system of claim 1, wherein the one or more actions include at least one of:

permission or forbiddance of an operation on the one or more network devices, modification of the one or more domain elements, display of a message, and entry in a log.

12. The system of claim 2, wherein the method for determining at least one conflict for a domain element E comprises:

collecting all domain elements D of which E is a member;

collecting the rules that apply to each domain element D, if any, and the rules that apply to E, if any; and

determining whether any conflicts exist between the collected rules.

13. The system of claim 2, wherein the method for resolving the at least one conflict comprises determining at least one prevalent policy.

14. The system of claim 2, wherein the method for resolving the at least one conflict comprises determining at least one prevalent policy made up of prevalent attributes of the one or more domain elements.

15. The system of claim 2, wherein the one or more domain elements are hierarchical and the method for resolving at least one conflict comprises resolving any conflicts at the highest level of the hierarchy at which the conflict arises.

16. A system for determining an enforceable policy applicable to one or more network devices, comprising a computer-readable medium encoded with:

a data structure comprising a policy space, the policy space including domain elements representing network devices and groups of network devices, and rule elements defining actions; and

a plurality of executable methods comprising;

a method for attaching one or more of the rule elements to one or more of the domain elements to create policies;

a method for determining whether conflicts exist between the policies; and

a method for resolving the conflicts to produce one or more enforceable policies,

wherein the method of resolving conflicts includes at least one of;

selecting a policy that issues from a pre-defined priority;

selecting a policy that issues from the least specific domain element among the conflicting policies;

selecting a policy that satisfies a largest number of conditions included in the conflicting policies;

reporting the conflicting policies to a user and allowing the user to adjudicate between the conflicting policies.