Implementing network management policies using topology reduction

• US 7,000,006 B1
• Filed: 05/31/2001
• Issued: 02/14/2006
• Est. Priority Date: 05/31/2001
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Chen, Shigang
• Primary Examiner(s): DINH, KHANH Q
• Application Number:
  US09/872,056
• Time in Patent Office: 1,720 Days
• Field of Search: 709/224, 709/226, 709/238, 709/227, 709/223, 709/225, 709/228, 709/218, 709/239, 370/254, 370/256, 370/229, 370/257, 370/445, 370/252, 370/389, 707/10, 713/201
• US Class Current: 709/218
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and apparatus for implementing network management policies is provided. A communication path is determined that passes through a domain of a network. The communication path characterizes the first domain as a node, but does not lose information. A management policy is then implemented using the communication path. Another aspect of the invention provides a method implementing a management policy using topology reduction. A network is abstracted into domains, and each domain may be cloudified if that domain is determined to have a cloudification characteristic. Domains that are cloudified are subsequently represented as having reduced topology and internal connectivity, but this representation does not incur information loss when management policies are implemented using the cloudified domains. In other aspects, the invention provides a computer-readable medium and system configured to carry out the foregoing.

Claims

1. A method for implementing management policies on a network using topology reduction, the network including at least a first domain having a plurality of network elements, the method comprising:

determining one or more management components in the network;

determining two or more domains, wherein each (a) is bounded, in the network, by one or more of the management components and (b) does not contain any management components;

determining a communication path passing through the first domain of the network that characterizes the first domain as a node, the communication path being characterized to pass communications without information loss;

implementing a management policy for the network using the communication path;

wherein determining the communication path passing through the first domain includes;

identifying a second domain for a source element of a communication that uses the communication path, the second domain including a plurality of network elements;

identifying a third domain for a destination element for the communication, the third domain including a plurality of network elements;

characterizing a portion of the communication path within the second domain as a distance between the source element and an interface to the second domain, the portion of the communication path within the second domain being characterized without information loss; and

characterizing a portion of the communication path within the third domain as a distance between the destination element and an interface to the third domain, the portion of the communication path within the third domain being characterized without information loss.

2. The method of claim 1, wherein determining the communication path passing through the first domain includes identifying a particular domain containing a particular source element and a particular destination element, a communication from the particular source element being signaled from the particular domain to the first domain before being signaled to the particular destination element.

3. The method of claim 1, wherein determining the communication path passing through the first domain includes:

characterizing a portion of the communication path passing through the first domain as a distance between the second domain and the third domain.

4. The method of claim 1, wherein determining the two or more domains comprises:

identifying a particular domain in the two or more domains having a cloudification characteristic, the particular domain having at least a first management component and a corresponding interface that forms an edge to the particular domain; and

characterizing at least a first communication path for communications having an end element within the particular domain as being a distance between the corresponding interface to the particular domain and the end element, the first communication path passing communications without information loss.

5. The method of claim 4, further comprising storing the first communication path as a data structure defining the distance between the corresponding interface to the particular domain and the end element.

6. The method of claim 4, wherein the one or more management components comprise a plurality of management components, each management component in the plurality of management components having a corresponding interface and forming an edge for at least one domain.

7. The method of claim 4, wherein determining the two or more domains includes identifying a plurality of network elements that are interconnected between one or more interfaces of management components.

8. The method of claim 4, wherein determining the two or more domains includes identifying a plurality of firewall components, each firewall component having a corresponding interface and forming an edge for at least one domain.

9. The method of claim 4, wherein identifying the particular domain includes determining that the first management component has only one interface to the particular domain.

10. The method of claim 4, wherein identifying the particular domain includes determining that each management component for the particular domain has multiple interfaces to the particular domain, wherein each of the multiple interfaces are configured to forward communications received from a network element within the particular domain to another element or interface that is exterior to the particular domain.

11. The method of claim 4, wherein identifying the particular domain includes determining that the particular domain has only one or two corresponding interfaces that form edges for the particular domain.

12. The method of claim 1, wherein determining the two or more domains comprises:

identifying a plurality of domains in the network, each of the plurality of domains having at least one network element;

identifying a plurality of cloudified domains from the plurality of domains, each cloudified domain being bounded by a management component and at least one interface for the management component;

identifying a particular source element and a particular destination element for a communication; and

defining a plurality of communication paths passing within a first cloudified domain in the plurality of cloudified domains, each of the plurality of communication paths characterizing the first cloudified domain as a distance between an interface to the first cloudified domain and an end point element, the end point element characterizing at least one of the particular source element and the particular destination element, each of the plurality of communication paths passing communications within the first cloudified domain without information loss.

13. The method of claim 12, wherein identifying at least a first path in the plurality of communication paths includes characterizing the communication passing through a second cloudified domain in the plurality of domains as a node.

14. The method of claim 12, wherein identifying at least a first path in the plurality of communication paths includes:

characterizing the communication passing through a second cloudified domain in the plurality of domains as a node; and

characterizing the communication passing through a third cloudified domain in the plurality of domains as a second distance between an interface to the third cloudified domain and an end point element within the third cloudified domain.

15. The method of claim 1, wherein implementing the management policy includes implementing a firewall configuration on the communication path.

16. A computer-readable medium for implementing a management policy on a network that includes at least a first domain having a plurality of network elements, the computer readable medium carrying instructions for performing the steps of:

determining one or more management components in the network;

determining two or more domains, wherein each (a) is bounded, in the network, by one or more of the management components and (b) does not contain any management components;

determining a communication path passing through the first domain of the network that characterizes the first domain as a node, the communication path being characterized to pass communications without information loss;

implementing a management policy for the network using the communication path;

wherein determining the communication path passing through the first domain includes;

identifying a second domain for a source element of a communication that uses the communication path, the second domain including a plurality of network elements;

identifying a third domain for a destination element for the communication, the third domain including a plurality of network elements;

characterizing a portion of the communication path within the second domain as a distance between the source element and an interface to the second domain, the portion of the communication path within the second domain being characterized without information loss; and

characterizing a portion of the communication path within the third domain as a distance between the destination element and an interface to the third domain, the portion of the communication path within the third domain being characterized without information loss.

17. An apparatus for implementing a management policy on a network that includes at least a first domain having a plurality of network elements, the apparatus comprising:

means for determining one or more management components in the network;

means for determining two or more domains, wherein each (a) is bounded, in the network, by one or more of the management components and (b) does not contain any management components;

means for determining a communication path passing through the first domain of the network that characterizes the first domain as a node, the communication path being characterized to pass communications without information loss; and

means for implementing a management policy for the network using the communication path;

wherein the means for determining the communication path passing through the first domain includes;

means for identifying a second domain for a source element of a communication that uses the communication path, the second domain including a plurality of network elements;

means for identifying a third domain for a destination element for the communication, the third domain including a plurality of network elements;

means for characterizing a portion of the communication path within the second domain as a distance between the source element and an interface to the second domain, the portion of the communication path within the second domain being characterized without information loss; and

means for characterizing a portion of the communication path within the third domain as a distance between the destination element and an interface to the third domain, the portion of the communication path within the third domain being characterized without information loss.