Apparatus for mediating in management orders

• US 8,010,642 B2
• Filed: 11/28/2003
• Issued: 08/30/2011
• Est. Priority Date: 11/28/2003
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Castro Castro, Fabian, González Lopéz, Maria Pilar
• Primary Examiner(s): Chan; Wing
• Assistant Examiner(s): KATSIKIS, KOSTAS J
• Application Number:
  US10/596,003
• Publication Number:
  US 20070204015A1
• Time in Patent Office: 2,832 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/223
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration

Abstract

A method and an apparatus are described herein for mediating management orders between a plurality of origin managers and a plurality of managed devices in a telecommunications system. The apparatus comprises: a Communication Receiver Component arranged for receiving management orders, a Communication Sender Component arranged to send an allowed management order to a managed device, and a Management Verifier Component, arranged to determine whether a received management order is an allowed management order.

Claims

1. A hardware-containing apparatus for mediating in management orders between a plurality of origin managing devices and a plurality of managed devices in a telecommunications system, the management orders intended to execute management operations over the managed devices, comprising:

a communication receiver component arranged to receive a management order from one of the origin managing devices;

a management verifier component arranged to determine whether the received management order is an allowed management order by checking whether content of the received management order fits access attributes comprised in a first management access template in relationship with an identifier of the origin managing device, a second management access template in relationship with an identifier of a managed data object affected by the management order, and a third management access template in relationship with an identifier of a managed device affected by the management order;

a communication sender component arranged to send an allowed management order to a managed device; and

the hardware-containing apparatus is interposed between the plurality of origin managing devices and the plurality of managed devices so as to receive management orders from the plurality of origin managing devices and issue allowed management orders to the plurality of managed devices.

2. The apparatus of claim 1, wherein the first management access template further comprises at least one access attribute selected from the group consisting of:

an identifier of an allowed management operation;

an identifier of an allowed managed data object;

a pattern structure of the managed data object;

an identifier of an allowed managed device;

an identifier of an allowed management operation over an allowed managed device; and

an identifier of an allowed management operation over an allowed managed data object.

3. The apparatus of claim 1, wherein the second management access template further comprises at least one access attribute selected from the group consisting of:

a pattern structure of the managed data object;

an identifier of an allowed management operation;

an identifier of a managed device holding the managed data object;

an identifier of an allowed origin managing device;

an identifier of an allowed management operation from an allowed origin managing device; and

an identifier of an allowed management operation over a holding managed device.

4. The apparatus of claim 1, wherein the third management access template comprises at least one access attribute selected from the group consisting of:

an identifier of an allowed management operation;

an identifier of a managed data object held on the managed device;

an identifier of an allowed origin managing device;

an identifier of an allowed management operation from an allowed origin managing device; and

an identifier of an allowed management operation over a held managed data object.

5. The apparatus of claim 1, wherein the management verifier component is arranged to determine, from the identifier of a management operation, at least one identifier, the identifier being one selected from the group consisting of:

an identifier of a managed data object affected by the operation; and

an identifier of a managed device, affected by the operation.

6. The apparatus of claim 1, wherein the management verifier component is arranged to select a management access template, among the first, second, and third management templates, according to an identifier received in a management order.

7. The apparatus of claim 6, wherein the management verifier component is arranged to select a management access template, among the first, second, and third management templates, according to an access attribute comprised in another selected management access template.

8. The apparatus of claim 6, wherein the identifier of the origin managing device comprises at least one identifier selected from the group consisting of:

an identifier of a management server sending a management order; and

an identifier of a user operating the management server; and

wherein the management verifier component is arranged to select the first management access template according to the at least one identifier.

9. The apparatus of claim 6, wherein the identifier of the origin managing device comprises at least one identifier selected from the group consisting of:

an identifier of a management server sending a management order; and

an identifier of a user operating the management server; and

wherein the management verifier component is arranged to authenticate the at least one identifier.

10. The apparatus of claim 6, wherein the management verifier component is arranged to determine a management role associated to at least one identifier, the identifier being one selected from the group consisting of:

an identifier of a management server sending a management order; and

an identifier of a user operating the management server.

11. The apparatus of claim 10, wherein the management verifier component is further arranged to select at least one management access template in relationship with the role.

12. The apparatus of claim 10, wherein at least one management access template among the second or third management templates comprises an identifier (ROm) of at least one role as an access attribute, and wherein the Management Verifier Component is further arranged to check whether the management order fits with the role.

13. The apparatus of claim 1, wherein the management verifier component is arranged to determine whether a managed data object affected by an allowed management order is an access attribute in a management access template, and further comprising a management execution component, arranged to execute a management operation over the access attribute.

14. The apparatus of claim 1, wherein the communication receiver component is further arranged;

to receive an access request from one of the origin managing devices;

wherein the management verifier component is further arranged to determine the first management access template; and

wherein the communication sender component is further arranged to send an access response to the origin managing device that comprises an access attribute of the management access template.

15. In a telecommunications system, a method implemented by a hardware-containing apparatus for mediating in the management of a plurality of managed devices from a plurality of origin managing devices, comprising the steps of:

receiving a management order from one of the origin managing devices in the managed device;

executing a management operation requested by the management order in the managed device;

the step of receiving a management order comprising the further steps of;

receiving a management order in a centralized management mediator;

determining whether the received management order is an allowed management order by checking in the centralized management mediator whether content of the received management order fits access attributes comprised in a first management access template in relationship with an identifier of the origin managing device, a second management access template in relationship with an identifier of a managed data object affected by the management order, and a third management access template in relationship with an identifier of a managed device affected by the management order;

granting the management order to be sent to a managed device if it is an allowed management order; and

the hardware-containing apparatus is interposed between the plurality of origin managing devices and the plurality of managed devices so as to receive management orders from the plurality of origin managing devices and issue allowed management orders to the plurality of managed devices.

16. The method of claim 15, wherein the step of checking the management order comprises the further step of determining, from the identifier of a management operation, at least one identifier selected from the group consisting of:

an identifier of a managed data object affected by the operation; and

an identifier of a managed device, affected by the operation.

17. The method of claim 16, wherein the step of checking the management order comprises the further step of selecting a management access template, among the first, second, and third management templates, according to an identifier received in a management order.

18. The method of claim 17, wherein the step of checking the management order comprises the further step of selecting a management access template, among the first, second, and third management templates, according to an access attribute comprised in another selected management access template.

19. The method of claim 17, wherein the identifier of the origin managing device comprises at least one identifier among:

an identifier of a management server sending a management order;

an identifier of a user operating the management server; and

wherein the step of selecting a management access template comprises the further step of selecting the first management access template according to the at least one identifier.

20. The method of claim 17, wherein the identifier of the origin managing device comprises at least one identifier selected from:

an identifier of a management server sending a management order; and

an identifier of a user operating the management server; and

wherein the step of checking the management order comprises the further step of authenticating the at least one identifier.

21. The method of claim 17, wherein the step of checking the management order comprises the further step of determining a management role associated to at least one identifier selected from:

an identifier of a management server sending a management order; and

an identifier of a user operating the management server.

22. The method of claim 21, wherein the step of checking the management order comprises the further step of selecting a management access template in relationship with the role.

23. The method of claim 21, wherein at least one management access template among the second or third management templates comprises an identifier (ROm) of at least one role as an access attribute, and wherein the step of checking the management order comprises the further step of checking whether the management order fits with the role.

24. The method of claim 15, wherein the step of checking the management order comprises the further step of checking whether a managed data object affected by an allowed management order is an access attribute in a management access template;

and wherein the step of granting the management order comprises the further step of executing a management operation over the access attribute.

25. The method of claim 15, comprising the further steps of:

receiving an access request from the origin managing device;

determining the first management access template; and

sending an access response to the origin managing device that comprises an access attribute of the management access template.

26. A computer program stored on a non-transitory data storage in a computer-based apparatus for mediating management orders between a plurality of origin managing devices and a plurality of managed devices in a telecommunications system, the management orders intended to execute management operations over the managed devices, comprising:

a computer-readable program having code adapted to cause a computer-based apparatus to process the reception of a management order from one of the origin managing devices;

the computer-readable program having code adapted to cause the computer-based apparatus to determine whether a received management order is an allowed management order by checking whether content of the received management order fits access attributes comprised in a first management access template in relationship with an identifier of the origin managing device, a second management access template in relationship with an identifier of a managed data object affected by the management order, and a third management access template in relationship with an identifier of a managed device affected by the management order,

the computer-readable program having code adapted to cause the computer-based apparatus to send an allowed management order to a managed device; and

the computer-based apparatus is interposed between the plurality of origin managing devices and the plurality of managed devices so as to receive management orders from the plurality of origin managing devices and issue allowed management orders to the plurality of managed devices.

27. The computer program of claim 26, further comprising the computer-readable program having code adapted to cause the computer-based apparatus to determine, from the identifier of a management operation, at least one identifier selected from:

an identifier of a managed data object affected by the operation; and

an identifier of a managed device, affected by the operation.

28. The computer program of claim 26, further comprising the computer-readable program having code adapted to cause the computer-based apparatus to select a management access template, among the first, second, and third management templates, according to an identifier received in a management order.

29. The computer program of claim 28, further comprising the computer-readable program having code adapted to cause the computer-based apparatus to select a management access template, among the first, second, and third management templates, according to an access attribute comprised in another selected management access template.

30. The computer program of claim 28, wherein the identifier of the origin managing device comprises at least one identifier among:

an identifier of a management server sending a management order;

an identifier of a user operating the management server; and

the computer-readable program having code adapted to cause the computer-based apparatus to select the first management access template according to the at least one identifier.

31. The computer program of claim 28, wherein the identifier of the origin managing device comprises at least one identifier selected from among:

an identifier of a management server sending a management order;

an identifier of a user operating the management server; and

wherein the computer-readable program has code adapted to cause the computer-based apparatus to authenticate the at least one identifier.

32. The computer program of claim 28, further comprising the computer-readable program having code adapted to cause the computer-based apparatus to determine a management role associated to at least one identifier selected from:

an identifier of a management server sending a management order; and

an identifier of a user operating the management server.

33. The computer program of claim 32, further comprising the computer-readable program having code adapted to cause the computer-based apparatus to select at least one management access template in relationship with the role.

34. The computer program of claim 32, wherein at least one management access template among the second or third management templates comprises an identifier (ROm) of at least one role as an access attribute, and further comprising a computer-readable program code for causing the computer-based apparatus to check whether the management order fits with the role.

35. The computer program of claim 26, further comprising the computer-readable program having code adapted to cause the computer-based apparatus to determine whether a managed data object affected by an allowed management order is an access attribute in a management access template, and a computer-readable program code for causing the computer-based apparatus to execute a management operation over the access attribute.

36. The computer program of claim 26, further comprising:

the computer-readable program having code adapted to cause the computer-based apparatus to process the reception of an access request from the origin managing device;

the computer-readable program having code adapted to cause the computer-based apparatus to determine the first management access template, and

the computer-readable program having code adapted to cause the computer-based apparatus to send an access response to the origin managing device that comprises an access attribute of the management access template.