Policy management system

• US 7,213,068 B1
• Filed: 11/09/2000
• Issued: 05/01/2007
• Est. Priority Date: 11/12/1999
• Status: Expired due to Fees

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Virmani, Aashu, Naqvi, Shamin A., Lobo, Jorge, Kohli, Madhur
• Primary Examiner(s): Lim, Krisna
• Assistant Examiner(s): BARQADLE, YASIN M
• Application Number:
  US09/710,551
• Time in Patent Office: 2,364 Days
• Field of Search: 709220-225, 714/4, 714/37, 714/47
• US Class Current: 709/225
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/508 based on type of value added network service under agreement
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A policy management system implements a programmable policy-based approach for managing network elements in a telecommunication network. The policy management system includes one or more policy proxies associated with the network elements and a central policy processing point in communication with the policy proxies. The policy proxies are configured to notify the policy processing point of events occurring in the network. The policy processing point is run-time programmable with one or more policies to process such events and to notify one or more of the policy proxies of actions to be taken in response thereto. The policy proxies implement these actions at the network elements they represent.

Claims

1. A policy management system for managing network elements in a telecommunication network, comprising:

one or more policy proxies associated with said network elements; and

a central policy processing point in communication with said policy proxies;

wherein said policy proxies are configured to notify said policy processing point of events occurring in said network;

wherein said policy processing point is run-time programmable with one or more policies to process said events and to notify one or more of said policy proxies of actions to be taken in response to said events;

wherein said policies are based on a policy definition language that defines (1) primitive events representing a single network element event, (2) basic events representing a group of primitive events occurring within a single time epoch, (3) complex events representing an accumulation of primitive events over plural time epochs, (4) internal events generated in response to network elements failing to take required actions, and (5) policy defined events generated by said policies according to policy defined event rules

wherein said policy proxies are configured to implement said actions at network elements they represent; and

further including a failover and upgrade system wherein;

an external monitoring script functions to restart said policy processing point and said policy proxies should such components become non-operational;

said policy processing point and said policy proxies are configured to enter a retry mode if communication with another component cannot be established, and if said retry mode is unsuccessful to consult a directory server to refresh location information relative to said component;

said policy proxies are configured to raise internal alarms if they are disconnected from, or cannot reach, an associated network element for a period of time;

an aggregator or said policy proxies maintain state on event registrations performed at each policy proxy;

said policy processing point monitors connection status with said aggregator, and following a disconnection therefrom, reloads its policies upon a reconnect; and

said policy processing point stores its policies in said directory server.

2. A system in accordance with claim 1 wherein said events are associated with event contexts and said policies are defined to produce actions in response to said events based on policy defined rules.

3. A system in accordance with claim 1 wherein one or more of said policy proxies are respectively associated with only a single network element.

4. A system in accordance with claim 1 wherein said policy proxies include an event filter.

5. A system in accordance with claim 4 wherein said event filter is configured to perform one or more of processing events into a device independent format, aggregating primitive events into basic or complex events, and raising internal events that reflect non occurrence of expected events.

6. A system in accordance with claim 1 wherein said policy proxies are configured to store event registration information identifying policies that have registered for selected events.

7. A system in accordance with claim 1 wherein said policy processing point includes one or more of an event registration unit for registering events processed by said policy processing point with said policy proxies, an event distribution component for distributing event registration information to said policy proxies, an action/condition handler, and an action distribution component.

8. A system in accordance with claim 1 further including one or more distributed policy processing points associated with said policy proxies and adapted to process local events received from said policy proxies.

9. A system in accordance with claim 1 further including an aggregator for routing action commands from said policy processing point to said policy proxies.

10. A system in accordance with claim 9 wherein said policy proxies are identified in said policies using domain information, and said system includes a directory server that maintains a domain registry that associates said domain information with policy proxy addresses, said directory server being responsive to domain resolution queries from said aggregator.

11. A system in accordance with claim 1 wherein said policy proxies are identified in said policies using domain information, and said system includes a directory server that maintains a domain registry that associates said domain information with policy proxy addresses, said directory server being responsive to domain resolution queries from said policy processing point.

12. A system in accordance with claim 1 further including a failover and upgrade system wherein processes run by said policy processing point and said policy proxies are duplicated on separate hardware.

13. A system in accordance with claim 1 further including an administrative module implementing a graphical user interface for writing policies run by said policy processing point.

14. A system in accordance with claim 1 further including an administrative module implementing a graphical user interface for tracing policies run by said policy processing point, said interface being configured to allow users to select actions and trigger events involved in said policies, and to trace sources that cause said actions or trigger said events.

15. A system in accordance with claim 1 further including a debugging tool for testing and debugging policies, said debugging tool being responsive to questions about said policies under hypothetical circumstances by providing information about operational conditions of said system under said circumstances.

16. A system in accordance with claim 15 wherein said debugging tool is configured to respond to (1) queries requesting an event history that will trigger a specified action or sequence of actions, and (2) queries requesting completion of an event history until a specified action is triggered.

17. A system in accordance with claim 1 wherein said actions include complex actions performed according to a prescribed work flow of subactions.

18. A system in accordance with claim 1 further including a policy monitor configured to detect rule conflicts in said policies based on a specified set of constraints on concurrent execution of certain actions.

19. A policy management method for managing network elements in a telecommunication network, comprising the steps of:

configuring a policy execution space at run time to run one or more policies;

monitoring events occurring at said network elements;

processing said events at a central policy processing point by applying said one or more policies;

said processing including applying policy rules to said events to determine actions to be taken in response to said events;

said policies being based on a policy definition language that defines (1) primitive events representing a single network element event, (2) basic events representing a group of primitive events occurring within a single time epoch, (3) complex events representing an accumulation of primitive events over plural time epochs, (4) internal events generated in response to network elements failing to take required actions, and (5) policy defined events generated by said policies according to policy defined event rules;

controlling one or more of said network elements according to said actions; and

further including failover and upgrade steps wherein;

an external monitoring script functions to restart said policy processing point and said policy proxies should such components become non-operational;

said policy processing point and said policy proxies are configured to enter a retry mode if communication with another component cannot be established, and if said retry mode is unsuccessful, to consult a directory server to refresh location information relative to said component;

said policy proxies are configured to raise internal alarms if they are disconnected from or cannot reach, an associated network element for a period of time;

an aggregator or said policy proxies maintain state on event registrations performed at

said policy processing point monitors connection status with said aggregator, and following a disconnection therefrom, reloads its policies upon a reconnect; and

said policy processing point stores its policies in said directory server.

20. A method in accordance with claim 19 wherein said events are associated with event contexts and said policies are programmed to produce actions in response to said events based on said policy rules.

21. A method in accordance with claim 19 further including one or more of aggregating primitive events into basic or complex events, generating internal events, registering events to associate with said policies, and filtering events prior to processing them at said policy processing point.

22. A method in accordance with claim 19 further including defining said network elements according to domain information in said policies and using domain resolution to determine which network elements to advise of said actions.

23. A method in accordance with claim 22 wherein said domain information is centrally stored in a domain registry.

26. A product in accordance with claim 21 further including program means recorded on said data storage medium for aggregating primitive events into basic or complex events, generating internal events, performing one or more of registering events to associate them with said policies, and filtering events prior to processing them at said policy processing point.

24. A computer program product for policy management of network elements in a telecommunication network, comprising:

a data storage medium;

program means recorded on said data storage medium for configuring a policy execution space at runtime to run one or more policies;

program means recorded on said data storage medium for monitoring events occurring at said network elements;

program means recorded on said data storage medium for processing said events at a central policy processing point by applying said one or more policies, said processing including applying policy rules to said events to determine actions in response to said events;

said policies being based on a policy definition language that defines (1) primitive events representing a single network element event, (2) basic events representing a group of primitive events occurring within a single time epoch, (3) complex events representing an accumulation of primitive events over plural time epochs, (4) internal events generated in response to network elements failing to take required actions, and (5) policy defined events generated by said policies according to policy defined event rules;

program means recorded on said data storage medium for advising one or more of said network elements of said actions; and

further including means recorded on said data storage medium for providing a failover and upgrade system wherein;

an external monitoring script functions to restart said policy processing point and said policy proxies should such components become non-operational;

said policy processing point and said policy proxies are configured to enter a retry mode if communication with another component cannot be established, and if said retry mode is unsuccessful, to consult a directory server to refresh location information relative to said component;

said policy proxies are configured to raise internal alarms if they are disconnected from or cannot reach, an associated network element for a period of time;

an aggregator or said policy proxies maintain state on event registrations performed at each policy proxy;

said policy processing point monitors connection status with said aggregator, and following a disconnection therefore reloads its policies upon a reconnect; and

said policy processing point stores its policies in said directory server.

25. A product in accordance with claim 24 wherein said events are associated with event contexts and said policies are programmed to produce actions in response to said events based on said policy rules.

27. A product in accordance with claim 24 further including program means recorded on said data storage medium for using domain resolution to identify policy proxies defined by way of domain information in said policies.