Network policy distribution

• US 7,428,583 B1
• Filed: 10/31/2000
• Issued: 09/23/2008
• Est. Priority Date: 10/31/2000
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Saint-Hilaire, Ylian, Jason, James L. Jr., Lortz, Victor B.
• Primary Examiner(s): BATES, KEVIN T
• Application Number:
  US09/704,384
• Time in Patent Office: 2,884 Days
• Field of Search: 709/221, 709/222, 709/223, 709/224, 715/513, 715/531
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/30 Profiles

Abstract

A method includes receiving a specification for translating a network policy from a first schema to a second, different schema and translating the network policy into the second different schema based on the specification. A network system is configured based on the translated policy.

Claims

1. A method, comprising:

receiving, in a client, a file including both a network policy and multiple translation specifications for translating the network policy from a first schema to multiple, different schemas, the file being the same file that is received by at least plural other clients within a network system;

translating the network policy, in the client, into one of the multiple, different schemas based on one of the multiple translation specifications, the one of the multiple, different schemas being associated with the client; and

configuring the network system based on the translated network policy.

2. The method of claim 1 wherein the network policy is represented in Markup Language which uses tags.

3. A method as in claim 1, wherein the network policy received in the client includes an indicia that represents a first version number of the network policy that is received in the file, and wherein said one of the multiple translation specifications for translating includes information for translating the network policy from said first version number to a second version number different than the first version number.

4. A method as in claim 1, wherein said one of the multiple translation specifications for translating includes information indicative of a different kind of encryption that is used and a second schema, and information about how to translate the network policy to use said different kind of encryption.

5. An article comprising a machine-readable medium which stores machine-executable instructions for checking events performed by a device, the instructions causing a machine to:

receive, in a client, a file including both a network policy and multiple translation specifications for translating a policy from a first schema to multiple, different schemas, the file being the same file received by at least plural other clients in a network system;

translate the network policy into one of the multiple, different schemas based on one of the multiple translation specifications, the one of the multiple, different schemas being associated with the client; and

configure the network system based on the translated network policy.

6. The article of claim 5 wherein the network policy is represented in eXtensible Markup Language and the multiple translation specifications are represented in eXtensible Stylesheet Language.

7. An article as in claim 5, wherein the network policy includes an indicia that represents a first version number of the network policy that is received in the file, and wherein said one of the multiple translation specifications for translating includes information for translating the network policy that is received in the file from said first version number to a second version number different than the first version number.

8. An article as in claim 5, wherein said one of the multiple translation specifications for translating includes information indicative of a different kind of encryption that is used in a second schema, and information about how to translate the network policy to use said different kind of encryption, and wherein translate comprises translating the network policy including changing the kind of encryption that it uses.

9. An apparatus comprising:

a memory which stores computer readable instructions; and

a processor which executes the computer readable instructions to;

receive in a client, a file including both a network policy and multiple translation specifications for translating a policy from a first schema to multiple, different schemas, the file being the same file received by at least plural other clients in a network system;

translate the network policy into one of the multiple, different schemas based on one of the multiple translation specifications, the one of the multiple, different schemas being associated with the client; and

configure the network system based on the translated network policy.

10. The apparatus of claim 9 wherein the network policy is represented in eXtensible Markup Language and the multiple translation specifications are represented in eXtensible Stylesheet Language.

11. An apparatus as in claim 9, wherein said processor receives in said file, the network policy that includes an indicia that represents a first version number of the network policy in the file, and said one of the multiple translation specifications, wherein said one of the multiple translation specifications includes information for translating the network policy that is received in the file from said first version number to a second version number different than the first version number.

12. An apparatus as in claim 9, wherein said one of the multiple translation specifications for translating includes information indicative of a different kind of encryption that is used in a second schema, and wherein said processor operates to translate the network policy including changing the kind of encryption that is used.

13. A method, comprising:

sending a network policy to a client computer;

said network policy being for configuring a network system according to a first schema;

sending multiple translation specifications for translating the network policy to the client computer;

said multiple translation specifications being for translating the network policy from the first schema to multiple, different schemas;

said network policy and said multiple translation specifications being sent in a file, the file being the same file received by at least plural other clients in a network system;

receiving an indication that the client computer cannot translate the network policy;

translating the network policy into one of the multiple, different schemas based on one of the multiple translation specifications in response to said receiving, the one of the multiple, different schemas being associated with the client computer; and

after said translating, sending the translated network policy to a client computer.

14. The method of claim 13 wherein the network policy is represented in eXtensible Markup Language and the multiple translation specifications are represented in eXtensible Stylesheet Language.

15. The method of claim 13 wherein the network policy and the multiple translation specifications are stored in the same file.

16. A method as in claim 13, wherein the network policy received in the client includes an indicia that represents a first version number of the network policy that is received in the file, and wherein said one of the multiple translation specifications for translating includes information for translating the network policy from said first version number to a second version number different than the first version number.

17. A method as in claim 13, wherein said one of the multiple translation specifications for translating includes information indicative of a different kind of encryption that is used and a second schema, and information about how to translate the network policy to use said different kind of encryption.

18. An article comprising a computer-readable medium which stores computer-executable instructions for checking events performed by a device, the instructions causing a machine to:

send a network policy for configuring a network system according to a first schema to plural clients in the network system, including at least a first client computer;

send multiple translation specifications for translating the network policy from the first schema to multiple different schemas to the first client computer;

said network policy and said multiple translation specifications being sent in a file, the file being the same file received by at least said plural clients in the network system;

receive an indication that the first client computer cannot translate the network policy;

translate the network policy into one of the multiple, different schemas based on one of the multiple translation specifications in response to said received indication, the one of the multiple, different schemas being associated with the first client; and

send a translated network policy to the first client computer.

19. The article of claim 18 wherein the network policy is represented in eXtensible Markup Language and the multiple translation specifications are represented in eXtensible Stylesheet Language.

20. The article of claim 18 wherein the network policy and the multiple translation specifications are stored in the same file.

21. An article as in claim 18, wherein the network policy includes an indicia that represents a first version number of the network policy that is received in the file, and wherein said one of the multiple translation specifications for translating includes information for translating the network policy that is received in the file from said first version number to a second version number different than the first version number.

22. An article as in claim 18, wherein said one of the multiple translation specifications for translating includes information indicative of a different kind of encryption that is used in a second schema, and information about how to translate the network policy to use said different kind of encryption, and wherein translate comprises translating the network policy including changing the kind of encryption that it uses.

23. An apparatus comprising:

a memory which stores computer readable instructions;

a processor which executes the computer readable instructions to;

send a network policy for configuring a network system according to a first schema to a client computer;

send multiple translation specifications for translating the network policy from the first schema to multiple, different schemas to the client computer;

said network policy and said multiple translation specifications being sent in a file, the file being the same file received by all clients in a network;

receive an indication that the client computer cannot translate the network policy;

translate the network policy into one of the multiple, different schemas based on one of the multiple translation specifications, the one of the multiple, different schemas being associated with the client computer; and

send a translated network policy to the client computer.

24. The apparatus of claim 23 wherein the network policy is represented in eXtensible Markup Language and the multiple translation specifications are represented in eXtensible Stylesheet Language.

25. The apparatus of claim 23 wherein the network policy and the multiple translation specifications are stored in one file.

26. An apparatus as in claim 23, wherein said processor receives in said file, the network policy that includes an indicia that represents a first version number of the network policy in the file, and said one of the multiple translation specifications, wherein said one of the multiple translation specifications includes information for translating the network policy that is received in the file from said first version number to a second version number different than the first version number.

27. An apparatus as in claim 23, wherein said one of the multiple translation specifications for translating includes information indicative of a different kind of encryption that is used in a second schema, and wherein said processor operates to translate the network policy including changing the kind of encryption that is used.

28. A method of configuring a network comprising:

transmitting a file that includes both network policy according to a first schema and multiple translation specifications for translating the network policy from the first schema to multiple, different schemas from a server, said transmitting comprising transmitting the file to all clients in a network;

receiving the network policy and the multiple translation specifications on a first client computer;

translating on the first client computer the network policy from the first schema to one of the multiple, different schemas using one of the multiple translation specifications, the one of the multiple, different schemas being associated with the first client computer; and

configuring the network system on the first client computer using on the translated network policy.

29. The method of claim 28 further comprising:

receiving the network policy on a second client computer; and

configuring the network system on the second client computer using the network policy.

30. The method of claim 28 further comprising:

receiving the network policy on a third client computer;

transmitting to the server an indication that the third client computer cannot translate the network policy;

translating on the server the network policy from the first schema to one of the multiple, different schema using one of the multiple translation specifications, the one of the multiple, different schemas being associated with the third client computer; and

transmitting the translated network policy to the third client computer.

31. The method of claim 30 wherein the network policy is represented in eXtensible Markup Language and the multiple translation specifications are represented in eXtensible Stylesheet Language.

32. A method as in claim 28, wherein the network policy received in the client includes an indicia that represents a first version number of the network policy that is received in the file, and wherein said one of the multiple translation specifications for translating includes information for translating the network policy from said first version number to a second version number different than the first version number.

33. A method as in claim 28, wherein said one of the multiple translation specifications for translating includes information indicative of a different kind of encryption that is used and a second schema, and information about how to translate the network policy to use said different kind of encryption.