System and method for dynamic network policy management

• US 7,739,372 B2
• Filed: 03/20/2009
• Issued: 06/15/2010
• Est. Priority Date: 07/29/2003
• Status: Expired due to Term

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Enterasys Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Graham, Richard W., Roese, John J.
• Primary Examiner(s): BOUTAH, ALINA A
• Application Number:
  US12/408,289
• Publication Number:
  US 20090187968A1
• Time in Patent Office: 452 Days
• Field of Search: 709223-225, 709227-229, 709243-244, 719/318, 726/1
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management

Abstract

A system and method that provides dynamic network policy management. The system enables a network administrator to regulate usage of network services upon initiation of and throughout network sessions. The system employs a method of identifying selectable characteristics of attached functions to establish static and dynamic policies, which policies may be amended before, during and after any session throughout the network based on the monitored detection of any of a number of specified triggering events or activities. Particular policies associated with a particular identified attached function in prior sessions may be cached or saved and employed in subsequent sessions to provide network usage permissions more rapidly in such subsequent sessions. The cached or saved policy information may also be used to identify network usage, control, and security. The system and method of the present invention provides static and dynamic policy allocation for network usage provisioning.

Claims

1. A method of controlling the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and one or more network infrastructure devices, the method comprising the steps of:

a. determining whether a stored policy exists for an attached function seeking access to the network services;

b. if the stored policy history exists for the attached function, establishing in one or more packet forwarding devices of the network infrastructure connected to the attached function one or more static and/or dynamic policies for the attached function for network services usage based upon the stored policy history;

c. if no stored policy history exists for the attached function, establishing for the attached function one or more static and/or dynamic policies for network services usage;

d. monitoring the network system for triggers;

e. modifying in one or more of the one or more packet forwarding devices one or more static and/or dynamic policies for the attached function upon the detection of one or more of the monitored triggers; and

f. saving set and modified policies associated with the attached function as the stored policy history for the attached function,

wherein a portion of the saved set and modified policies are stored on one or more of the one or more packet forwarding devices and a remainder of the saved set and modified policies are stored on another network infrastructure device.

2. The method as claimed in claim 1 further comprising the step of establishing rules of hierarchy for saved set and modified policies.

3. The method as claimed in claim 1 further comprising the steps of acquiring information about the attached function and granting to the attached function preliminary entry to the network system based upon the information acquired.

4. The method as claimed in claim 3 further comprising the step of associating a level of trust with the information about the attached function prior to the step of granting preliminary entry.

5. The method as claimed in claim 3 wherein the triggers monitored include triggers unrelated to the information acquired about the attached function.

6. The method as claimed in claim 1 wherein the attached function is connected directly to one of the one or more packet forwarding device and is not directly connected to the another network infrastructure device.

7. The method as claimed in claim 1 further comprising the step of using stored policy history information in the step of monitoring for triggers.

8. A method of controlling the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and one or more network infrastructure devices, the method comprising the steps of:

a. establishing in one or more packet forwarding devices of the network system one or more static and/or dynamic policies for an attached function seeking access to the network services;

b. monitoring the network system for triggers;

c. modifying in one or more of the one or more packet forwarding devices one or more static and/or dynamic policies for the attached function upon the detection of one or more of the monitored triggers; and

d. saving set and modified policies associated with the attached function as the stored policy history for the attached function,

wherein a portion of the saved set and modified policies are stored on one or more of the one or more packet forwarding devices and a remainder of the saved set and modified policies are stored on another network infrastructure device.

9. The method as claimed in claim 8 further comprising the step of establishing rules of hierarchy for saved set and modified policies.

10. The method as claimed in claim 8 further comprising the steps of acquiring information about the attached function and granting to the attached function preliminary entry to the network system based upon the information acquired.

11. The method as claimed in claim 10 further comprising the step of associating a level of trust with the information about the attached function prior to the step of granting preliminary entry.

12. The method as claimed in claim 10 wherein the triggers monitored include triggers unrelated to the information acquired about the attached function.

13. The method as claimed in claim 8 wherein the attached function is connected directly to one of the one or more packet forwarding devices and is not directly connected to the another network infrastructure device.

14. The method as claimed in claim 8 further comprising the step of using stored policy history information in the step of monitoring for triggers.

15. The method as claimed in claim 8 further comprising the step of invalidating the stored policy history based upon the occurrence of a specified event.

16. The method as claimed in claim 15 wherein the specified event is selected from the group consisting of a bandwidth limitation, a manual intervention, an IDS event, a quality of service metric, a network device status or configuration change, a network load change, a change of internet availability, a network link status change, time, size limitations, storage limits, a policy change, and a network system change.

17. The method as claimed in claim 8 wherein the only static policy is that there are only dynamic policies.

18. A computer system to control the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, the computer system comprising:

a dynamic policy function module configured to;

a. establish in one or more packet forwarding devices of the network system one or more static and/or dynamic policies for an attached function seeking access to the network services;

b. monitor the network system for triggers;

c. modify in one or more of the one or more packet forwarding devices one or more static and/or dynamic policies for the attached function upon the detection of one or more of the monitored triggers; and

d. save set and modified policies associated with the attached function as the stored policy history for the attached function, wherein a portion of the saved set and modified policies are stored on one or more of the one or more packet forwarding devices and a remainder of the saved set and modified policies are stored on another network infrastructure device.

19. The system as claimed in claim 18 wherein the dynamic policy function module is further configured to establish rules of hierarchy for saved set and modified policies.

20. The system as claimed in claim 18 wherein the dynamic policy function module is further configured to acquire information about the attached function and grant to the attached function preliminary entry to the network system based upon the information acquired.

21. The system as claimed in claim 20 wherein the dynamic policy function module is further configured to associate a level of trust with the information about the attached function prior to granting preliminary entry.

22. The system as claimed in claim 20 wherein the triggers monitored include triggers unrelated to the information acquired about the attached function.

23. The system as claimed in claim 18 wherein the attached function is connected directly to one of the one or more packet forwarding devices and is not directly connected to the another network infrastructure device.

24. The system as claimed in claim 18 wherein the dynamic policy function module is further configured to use stored policy history information in the monitoring for triggers.

25. The system as claimed in claim 18 wherein the dynamic policy function module is further configured to invalidate the stored policy history based upon the occurrence of a specified event.

26. The system as claimed in claim 25 wherein the specified event is selected from the group consisting of a bandwidth limitation, a manual intervention, an IDS event, a quality of service metric, a network device status or configuration change, a network load change, a change of internet availability, a network link status change, time, size limitations, storage limits, a policy change, and a network system change.

27. The system as claimed in claim 18 wherein the only static policy is that there are only dynamic policies.

28. The system as claimed in claim 18 wherein the dynamic policy function module is a centralized module of a policy server of the network infrastructure.

29. The system as claimed in claim 18 wherein the dynamic policy function module is a distributed module forming portions of two or more devices of the network infrastructure.

30. The system as claimed in claim 29 wherein the two or more devices are selected from a combination of one or more servers and one or more of the one or more packet forwarding devices or a combination of two or more of the one or more packet forwarding devices.

31. The system as claimed in claim 18 wherein the means for saving set and modified policies includes means for caching the set and modified policies on a centralized network device, a local network device, or a combination of a centralized network device and a local network device.

32. The system as claimed in claim 18 wherein the dynamic policy function module is further configured to determine whether a stored policy history exists for the attached function prior to establishing one or more static and/or dynamic policies for the attached function.