Method and system to distribute policies

• US 8,495,227 B2
• Filed: 12/11/2003
• Issued: 07/23/2013
• Est. Priority Date: 12/11/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kaminsky, David L., Searcey, Carrie W., Kirchstein, Eric, Cruz, Christina M.
• Primary Examiner(s): Martin-Wallace, Valencia
• Assistant Examiner(s): MADAMBA, GLENFORD J
• Application Number:
  US10/707,408
• Publication Number:
  US 20050131712A1
• Time in Patent Office: 3,512 Days
• Field of Search: 709/225, 709/229, 705/1
• US Class Current: 709/229
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/344 Out-of-band transfers

Abstract

A method to distribute policies may include transmitting one of an identification (ID) assigned to a policy template or the policy template associated with each policy to an enforcement point or selected enforcement points for enforcement. The method may also include transmitting one set of parameters to be used in each policy template to the enforcement point.

Claims

1. A method to distribute policies, comprising:

determining if a policy template is present at an enforcement point in response to receiving an identification (ID) assigned to the policy template at the enforcement point, wherein the policy template includes a form of “

if a first parameter then a second parameter”

, the policy template and the parameters being transmitted separately to reduce use of communication resources by factoring the template and parameters to be used in the template and to permit different parameters to be transmitted from time to time to replace previous parameters in the policy template without the need of transmitting the entire policy template again to further reduce use of communication resources;

transmitting a query from the enforcement point to a repository, where policy templates are stored, in response to the policy template not being present at the enforcement point, wherein the query includes the ID assigned to the policy template;

receiving the policy template at the enforcement point, wherein the policy template is transmitted by the repository in response to the query; and

receiving a set of parameters to be used in the policy template at the enforcement point, wherein the set of parameters are transmitted separately from the policy template.

2. The method of claim 1, binding the parameters to the policy template.

3. The method of claim 2, further comprising implementing the policy associated with the policy template.

4. The method of claim 1, further comprising applying asynchronous, out-of-band communication to transmit the query and any policy templates.

5. The method of claim 1, further comprising compressing the policy template before transmitting to the enforcement point or any selected enforcement points.

6. The method of claim 1, further comprising forming the policy template in a structured document.

7. The method of claim 1, further comprising forming the policy template in a mark-up language.

8. A method to distribute policies, comprising:

defining a policy template associated with each policy, wherein the policy template includes a form of “

if a first parameter then a second parameter”

, the policy template and the parameters being transmitted separately to reduce use of communication resources by factoring the template and parameters to be used in the template and to permit different parameters to be transmitted from time to time to replace previous parameters in the policy template to change the policy associated with the policy template without the need of transmitting the entire policy or policy template again to further reduce use of communication resources;

assigning a unique identification (ID) to each policy template;

storing each policy template and assigned ID;

transmitting only the assigned ID to an enforcement point for each policy to be enforced by the enforcement point, wherein only the ID is transmitted to the enforcement point rather than the policy template to substantially minimize use of data processing and communication resources;

determining if the policy template corresponding to any transmitted ID is present at the enforcement point;

transmitting a query to a policy template repository in response to the policy template corresponding to any transmitted ID not being, present at the enforcement point, wherein the query includes the ID for any policy template not present at the enforcement point; and

transmitting the policy template from the policy template repository to the enforcement point in response to the query including the ID for the policy template.

9. The method of claim 8, further comprising identifying at least one set of parameters to be associated with each policy template.

10. The method of claim 9, further comprising transmitting the one set of parameters to be used in each associated policy template for enforcement to the enforcement point.

11. The method of claim 10, further comprising binding the parameters to each associated template.

12. The method of claim 11, further comprising implementing the policy associated with each policy template.

13. The method of claim 9, further comprising storing each one of the at least one set of parameters by name and type.

14. The method of claim 8, further comprising applying asynchronous, out-of-band communication to query the repository and transmit any templates.

15. The method of claim 8, further comprising compressing each template before transmitting to the enforcement point.

16. The method of claim 8, further comprising compressing each template before transmitting to the enforcement point.

17. The method of claim 8, further comprising forming each policy template in a structured document.

18. The method of claim 8, further comprising forming each policy template in a mark-up language.

19. A system to distribute policies, comprising:

a policy administrator to define policy templates and to transmit one of an identification (ID) assigned to a policy template or the policy template associated with each policy to be enforced, wherein each policy template includes a form of “

if a first parameter then a second parameter”

, each policy template and associated parameters being transmitted separately to reduce use of communication resources by factoring the template and associated parameters to be used in the template and to permit different parameters to be transmitted from time to time to replace previous parameters in the policy template without the need of transmitting the entire policy template again to further reduce use of communication resources;

an enforcement point to receive the ID assigned to the policy template or the policy template for each policy and to enforce each policy; and

a storage device to store each policy template and assigned ID, wherein the enforcement point determines if the policy template is present at the enforcement point in response to receiving the ID assigned to the policy template and transmits a query to the repository in response to the policy template not being present at the enforcement point.

20. The system of claim 19, wherein each policy administrator comprises a processor to transmit one of the ID assigned to the policy template or the policy template associated with each policy.

21. The system of claim 19, wherein each enforcement point comprises:

a processor to receive the IDs assigned to each policy template; and

a data source to store each policy template for enforcement and assigned ID, wherein the processor forms and transmits the query in response to each policy template corresponding to any transmitted IDs not present in the data source.

22. The system of claim 19, further comprising a server to interface between each policy administrator, each enforcement point and the repository.

23. A system to distribute policies, comprising:

processor means for defining a policy template associated with each policy, wherein the policy template includes a form of “

if a first parameter then a second parameter”

, the policy template and the parameters being transmitted separately to reduce use of communication resources by factoring the template and parameters to be used in the template and to permit different parameters to be transmitted from time to time to replace previous parameters in the policy template without the need of transmitting the entire policy template again to further reduce use of communication resources;

the processor means assigning a unique identification (ID) to each policy template;

a storage device to store each policy template and assigned ID;

transmitter means for transmitting one of the assigned ID or the policy template for each policy to be enforced;

an enforcement point to receive the assigned ID or the policy template for each policy and to enforce each policy; and

the transmitter means transmitting a query to a policy template repository in response to each policy template corresponding to any transmitted IDs not being present at the enforcement point, wherein the query includes any transmitted IDs for any policy templates not present at the enforcement point.

24. The system of claim 23, further comprising means for binding parameters to each associated policy template for enforcement.

25. The system of claim 23, further comprising means for transmitting any policy templates to the enforcement point in response to the query from the enforcement point including any IDs assigned to the policy templates.

26. The system of claim 25, further comprising means for applying asynchronous, out-of-band communication to transmit the query and any policy templates.

27. The system of claim 25, further comprising means for compressing each policy template before transmission to the enforcement point.

28. The system of claim 23, further comprising means for forming each policy template in a structured document.