Object model for network policy management

• US 6,944,183 B1
• Filed: 06/12/2000
• Issued: 09/13/2005
• Est. Priority Date: 06/10/1999
• Status: Expired due to Term

• Current Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Original Assignee: Alcatel SA (Nokia Corporation)
• Inventors: Iyer, Mahadevan, Apsani, Lavanya, Malviya, Pankaj
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US09/592,165
• Time in Patent Office: 1,919 Days
• Field of Search: 370/241.1, 370/395.5, 370/401, 370/466, 709223-225, 709/217, 707/202
• US Class Current: 370/466
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/41 by acting on aggregated flows or links
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: Y02D 30/50 : in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A unified policy management system for an organization including a central policy server and remotely situated policy enforcers. A central database and policy enforcer databases storing policy settings are configured as LDAP databases adhering to a hierarchical object oriented structure. Such structure allows the policy settings to be defined in an intuitive and extensible fashion. Changes in the policy settings made at the central policy server are automatically transferred to the policy enforcers for updating their respective databases. Each policy enforcer collects and transmits health and status information in a predefined log format and transmits it to the policy server for efficient monitoring by the policy server. For further efficiencies, the policy enforcement functionalities of the policy enforcers are effectively partitioned so as to be readily implemented in hardware. The system also provides for dynamically routed VPNs where VPN membership lists are automatically created and shared with the member policy enforcers. Updates to such membership lists are also automatically transferred to remote VPN clients. The system further provides for fine grain access control of the traffic in the VPN by allowing definition of firewall rules within the VPN. In addition, policy server and policy enforcers may be configured for high availability by maintaining a backup unit in addition to a primary unit. The backup unit becomes active upon failure of the primary unit.

Claims

1. A system for managing policy services in an organization, the organization including a first network having a first set of resources and a second network remote from the first network having a second set of resources, the system comprising:

a first edge device associated with the first network, the first edge device configured to manage policies for the first network and the first set of resources in accordance with first policy settings stored in a first database;

a second edge device associated with the second network, the second edge device configured to manage policies for the second network and the second set of resources in accordance with second policy settings stored in a second database; and

a central policy server defining the first and second policy settings and managing the first and second edge devices from a single location, the central policy server being associated with a central database storing configuration information of the first and second edge devices, wherein the central database is organized according to a hierarchical object oriented structure;

wherein;

the central policy server is configured to transmit, in response to a user command, a first policy settings update to the first edge device for storing in the first database and a second policy settings update to the second edge device for storing in the second database.

2. The system of claim 1, wherein the first and second databases are organized according to the hierarchical object oriented structure.

3. The system of claim 1, wherein the configuration information includes the first and second policy settings.

4. The system of claim 3, wherein the hierarchical object oriented structure includes a plurality of resource objects and policy objects for defining the first and second policy settings.

5. The system of claim 4, wherein the central database and the first and second databases are Lightweight Directory Access Protocol (LDAP) databases storing each resource object and policy object as an LDAP entry.

6. The system of claim 4, wherein the resource objects are selected form a group consisting of devices, users, hosts, services, and time.

7. The system of claim 6, wherein the devices include the first and second edge devices, each device being associated with a set of users and a particular host.

8. The system of claim 6, wherein the hosts include the first and second networks.

9. The system of claim 4, wherein the policy objects are selected from a group consisting of bandwidth, firewall, administration, and virtual private network grouping.

10. The system of claim 9, wherein the virtual private network grouping includes a virtual private network associated with one or more sites, users, and rules.

11. The system of claim 10, wherein each site includes one or more networks behind an edge device.

12. The system of claim 10, wherein the rules are firewall rules providing access control over network traffic flowing through the virtual private network.

13. In a system including a first network having a first set of resources and a second network remote from the first network having a second set of resources, the first network being associated with a first edge device and a first database, and the second network being associated with a second edge device and a second database, the system further including a central policy server in communication with the first and second edge devices, the central policy server being associated with a central database, a method for managing policy services in the system comprising:

storing configuration information of the first and second edge devices in the central database, the central database being organized in a hierarchical object oriented structure;

storing first policy settings in the first database;

storing second policy settings in the second database;

managing policies for the first network and the first set of resources from the first edge device in accordance with the first policy settings stored in the first database;

managing policies for the second network and the second set of resources from the second edge device in accordance with the second policy settings stored in the second database;

defining the first and second policy settings and managing the first and second edge devices from the central policy server;

generating by the central policy server in response to a user command, an update for the first policy settings and an update for the second policy settings;

transmitting, by the central policy server, the update for the first policy settings to the first edge device and the update for the second policy settings to the second edge device; and

storing the update to the first edge device in the first data base and the update to the second edge device in the second data base.

14. The method of claim 13, wherein the first and second databases are organized according to the hierarchical object oriented structure.

15. The method of claim 13, wherein the configuration information includes the first and second policy settings.

16. The method of claim 15, wherein the hierarchical object oriented structure includes a plurality of resource objects and policy objects for defining the first and second policy settings.

17. The method of claim 16, wherein the central database and the first and second databases are Lightweight Directory Access Protocol (LDAP) databases storing each resource object and policy object as an LDAP entry.

18. The method of claim 16, wherein the resource objects are selected from a group consisting of devices, users, hosts, services, and time.

19. The method of claim 18, wherein the devices include the first and second edge devices, each device being associated with a set of users and a particular host.

20. The method of claim 18, wherein the hosts include the first and second networks.

21. The method of claim 16, where the policy objects are selected from a group consisting of bandwidth, firewall, administration, and virtual private network grouping.

22. The method of claim 21, wherein the virtual private network grouping includes a virtual private network associated with one or more sites, users, and rules.

23. The method of claim 22, wherein each site includes one or more networks behind an edge device.

24. The method of claim 22, wherein the rules are firewall rules providing access control over network traffic flowing through the virtual private network.