Apparatus and method for managing a provider network

• US 8,103,755 B2
• Filed: 07/02/2002
• Issued: 01/24/2012
• Est. Priority Date: 07/02/2002
• Status: Expired due to Fees

• Current Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Original Assignee: Arbor Networks Incorporated (NetScout Systems Incorporated)
• Inventors: Malan, Gerald R., Stone, Robert, Langhorst, David
• Primary Examiner(s): Shaw, Peling
• Assistant Examiner(s): CLOUD, JOIYA M
• Application Number:
  US10/188,303
• Publication Number:
  US 20040004941A1
• Time in Patent Office: 3,493 Days
• Field of Search: 709220-227
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0627 by acting on the notification or alarm source
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/18 Delegation of network management function, e.g. customer network management [CNM]
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

An administration system is defined that provides an interface between a subscriber and resources on a provider network. The subscriber, via the administration system, has access to and control over certain of the resources on the provider network. The subscriber may have access to and control over only those resources on the provider network related to the services provided to his network. Also, the subscriber may not be capable of altering resources on the provider network in a way that affects the services provided to another subscriber. Because the administration system allows a user to control resources on the provider network that relate to services provided to his network, the amount of support required by the provider to administer those resources is reduced.

Claims

1. A method for managing a network configuration of a provider network, comprising:

a memory; and

a processor, wherein the processor is configured to perform the steps of determining, by an administration system, a first network resource supported by at least one network communication system over which a subscriber has control wherein the first network resource provides network services to the subscriber and network services to other subscribers;

receiving, at the administration system, at least one network configuration change from the subscriber, the at least one network configuration change being related to the first network resource;

detecting, by a network management system associated with the administration system, a denial of service attack on the subscriber;

sending, to a host device operated by the subscriber, a message indicating the denial of service attack;

providing, by the administration system in an interface, to the subscriber with a plurality of mitigation options within the interface, wherein the at least one network configuration change is represented by at least one of the plurality of mitigation options;

restricting, by the administration system, implementation of the at least one network configuration change to the at least one network communication system that affects the network services provided to the subscriber and not to configuration changes to the at least one network communication system that affect network services provided to other subscribers; and

responsive to the subscriber selecting the at least one of the plurality of mitigation options, performing, by the administration system, a network configuration change to the at least one network communication system that supports the first network resource;

determining a second network resource over which a second subscriber has control;

receiving a second network configuration change from the second subscriber, the second network configuration change being related to the second network resource;

implementing the received second network configuration change; and

denying, to the subscriber, control over the second network resource.

2. The method of claim 1, further comprising:

providing at least one network configuration option to the subscriber.

3. The method of claim 2, wherein the at least one network configuration option includes a change in a router configuration.

4. The method of claim 2, wherein the at least one network configuration option includes a filtering configuration.

5. The method of claim 2, wherein the received at least one network configuration change includes the at least one network configuration option.

6. The method of claim 1, further comprising:

verifying an identity of the subscriber to permit the act of implementing the received network configuration change.

7. The method of claim 1, wherein the first network resource includes at least one filter policy.

8. The method of claim 1, wherein the first network resource includes a network route.

9. The method of claim 1, wherein the network configuration change affects only the first network resource.

10. The method of claim 1, wherein the first network resource is located within the provider network.

11. The method of claim 1, wherein the network configuration change affects an entity located in the provider network.

12. The method of claim 1, wherein the network configuration change affects at least one service provided to the subscriber.

13. The method of claim 1, wherein the network configuration change affects an entity under control of the provider.

14. The method of claim 1, wherein the first network resource includes a routing entry stored in a memory of a network communication system.

15. The method of claim 14, wherein the network communication system is a router.

16. The method of claim 1, wherein the first network resource includes a filter entry stored in a memory of a network communication system.

17. The method of claim 16, wherein the network communication system is a router.

18. The method of claim 16, wherein the network communication system is a bridge.

19. The method of claim 1, wherein providing the subscriber with a mitigation option comprises providing the subscriber with a plurality of mitigation options, and wherein the at least one network configuration change is one of the plurality of mitigation options.

20. The method of claim 1, wherein the subscriber owns a network, the method further comprising determining an amount of a subscriber network afflicted by the denial of service attack.

21. The method of claim 20, wherein the mitigation option is based on the amount of the subscriber network afflicted by the denial of service attack.

22. The method of claim 1, further comprising determining a source of the denial of service attack.

23. The method of claim 22, wherein the mitigation option is based on the source of the denial of service attack.

24. The method of claim 1, further comprising alerting the subscriber of the denial of service attack.

25. The method of claim 1, wherein detecting the denial of service attack comprises receiving, from the subscriber, an indication that the subscriber is under attack.

26. The method of claim 1, further comprising:

providing network configuration options to the subscriber.

27. The method of claim 26, wherein the received network configuration change includes one of the network configuration options.

28. The method of claim 1, further comprising:

determining a second network resource over which a second subscriber has control; and

denying, to the subscriber, control over the second network resource.

29. The method of claim 28, further comprising:

receiving a second network configuration change from the second subscriber, the second network configuration change being related to the second network resource; and

implementing the received second network configuration change.

30. The method of claim 28, wherein the first network resource and the second network resource are not the same.

31. The method of claim 28, wherein the second network configuration change affects at least one service provided to the second subscriber.

32. A method of claim 1, wherein the subscriber has a first administrator and a second administrator, and the first network resource includes a second network resource and a third network resource, the method further comprising:

assigning control of the second network resource to the first administrator;

assigning control of the third network resource to the second administrator;

receiving a second network configuration change from the first administrator, the second network configuration change being related to the second network resource; and

implementing the received second network configuration change.

33. The method of claim 32, wherein the second network resource and the third network resource are not the same.

34. The method of claim 32, wherein the second network resource includes the third network resource.

35. The method of claim 32, further comprising:

providing a network configuration option to the first administrator.

36. The method of claim 35, wherein the second network configuration change submitted by the first administrator includes the network configuration option.

37. The method of claim 32, further comprising:

verifying the identity of the first administrator to permit the act of implementing the received second network configuration change.

38. The method of claim 32, wherein the second network resource includes at least one filter policy.

39. The method of claim 32, wherein the second network resource includes a network route.

40. The method of claim 32, wherein the second network configuration change affects only the second network resource.

41. The method of claim 32, wherein the second network resource is located within the provider network.

42. The method of claim 32, wherein the second network configuration change affects an entity located in the provider network.

43. The method of claim 32, wherein the second network configuration change affects at least one service provided to the subscriber.

44. The method of claim 32, further comprising:

receiving a third network configuration change from the second administrator; and

implementing the received third network configuration change submitted by the second administrator.

45. The method of claim 44, further comprising:

providing a second network configuration option to the second administrator.

46. The method of claim 45, wherein the third network configuration change includes the second network configuration option.

47. The method of claim 44, further comprising:

verifying the identity of the second administrator to permit the act of implementing the received third network configuration change.

48. The method of claim 46, wherein the second network configuration option includes at least one of the group comprising:

(a) adding, to a network communication device, a filter entry; and

(b) modifying, in the network communication device, a network route.

49. The method according to claim 1, wherein the act of providing, by the administration system within the interface, to the subscriber with a plurality of mitigation options within the interface comprises hiding implementation details of configuration changes associated with the plurality of mitigation options from the subscriber.

50. The method according to claim 1, wherein the act of performing, by the administration system, a network configuration change includes applying, by the administration system, the network configuration changes across multiple network communication systems.