Systems and methods for enterprise mission management of a computer network

• US 9,503,324 B2
• Filed: 11/05/2013
• Issued: 11/22/2016
• Est. Priority Date: 11/05/2013
• Status: Active Grant

• Current Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Smith, Wayne B., Knepper, Margaret, Kopman, Ashley M.
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): Shitayewoldetsadi, Berhanu
• Application Number:
  US14/072,361
• Publication Number:
  US 20150127790A1
• Time in Patent Office: 1,113 Days
• Field of Search: 709/221, 709/223, 709/224, 709/229, 709/232, 709/225, 709/245, 706/55, 726/1, 726/26, 705/7.36
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Systems (100) and methods (1400) for enterprise mission management of a Computer Network (“CN”). The methods involve configuring CN to operate in accordance with a first Mission Plan (“MP”) specifying a manner in which an assigned value for a first IDentity Parameter (“IDP”) is to be dynamically modified by a first node of CN; detecting a trigger event which indicates that a new MP needs to be implemented within CN; obtaining a second MP that specifies a manner in which an assigned value for a second IDP is to be dynamically modified by a second node of CN; determining if any conflicts exist between operations of the second node defined by the second MP and operations of the first node defined by the first MP; and configuring operations of CN to further operate in accordance with the second MP if it is determined that no conflict exists.

Claims

1. A method for enterprise mission management of a computer network in which node operations are dynamically configurable, the method comprising:

configuring said computer network to behave in accordance with at least one first mission plan of a plurality of mission plans, said first mission plan specifying a manner in which an assigned value for at least one first identity parameter of a plurality of identity parameters contained in a data packet is to be dynamically modified by at least one first node of said computer network based on a first selected function, where the plurality of identity parameters uniquely identify hardware and software of at least one node of the plurality of nodes in said computer network;

detecting a first trigger event within said computer network which indicates that a new mission plan needs to be implemented within said computer network;

obtaining a second mission plan of the plurality of mission plans in response to said trigger event, the second mission plan different from the first mission plan and specifying a manner in which an assigned value for at least one second identity parameter of the plurality of identity parameters is to be dynamically modified by at least one second node of the computer network based on a second selected function;

determining if any conflicts exist between operations of the second node defined by the second mission plan and operations of the first node defined by the first mission plan; and

configuring operations of said computer network to further behave in accordance with said second mission plan such that said manner as specified by the second mission plan is different than said manner specified by the first mission plan, if it is determined that no conflict exists between operations of the first and second nodes as defined by the first and second mission plans;

wherein said manner is further defined in accordance with at least a selection of said at least one identity parameter comprising an IP address, a MAC address, a network/subnet, a TCP sequence or a port number from among said plurality of identity parameters.

2. The method according to claim 1, wherein the first trigger event is detected based on at least one of content of a packet being communicated within the computer network, a congestion level of the computer network, a state of the computer network, user activities within the computer network, and malicious attacks to the computer network.

3. The method according to claim 1, wherein the second mission plan is obtained by selecting a mission plan from a plurality of pre-stored mission plans based on at least one of requirements of a new mission and results from analyzing operational aspects of the computer network.

4. The method according to claim 1, wherein the second mission plan is obtained by selecting a mission plan from a plurality of pre-stored mission plans based on at least one of requirements of a new mission and results from analyzing operational aspects of the computer network.

5. The method according to claim 1, wherein the second mission plan is obtained by dynamically generating a mission plan based on at least one of a concept of operations for a mission, an architecture of the computer network, relationships between resources of the computer network, and effectiveness ratings associated with a plurality of identity parameters.

6. The method according to claim 1, further comprising modifying the second mission plan to obtain a third mission plan if a conflict is determined to exist between operations of the first and second nodes as defined by the first and second mission plans.

7. The method according to claim 2, further comprising determining if any conflicts exist between operations of a third node defined by the third mission plan and operations of the first node defined by the first mission plan.

8. The method according to claim 7, further comprising configuring operations of said computer network to operate in accordance with said third mission plan if it is determined that no conflict exists between operations of the first and third nodes as defined by the first and third mission plans.

9. The method according to claim 1, further comprising:

determining whether the computer network should continue to behave in accordance with the first or second mission plan; and

re-configuring the computer network such that the computer network no longer behaves in accordance with the first or second mission plan, if it is determined that the computer network should not continue to operate in accordance with the first or second mission plan.

10. The method according to claim 1, further comprising:

determining whether the computer network should continue to behave in accordance with the first or second mission plan; and

re-configuring the computer network to behave in accordance with a third mission plan instead of the first or second mission plan, if it is determined that the computer network should not continue to operate in accordance with the first or second mission plan.

11. The method according to claim 1, further comprising reconfiguring operations of the computer network such that a location where at least one of the first and second identity parameters are being modified is changed based on a distance vector.

12. The method according to claim 1, wherein the distance vector has a variable value which changes in accordance with an overall network behavior specified a mission plan.

13. A system, comprising:

one or more processors operating to;

configure a computer network to behave in accordance with at least one first mission plan of a plurality of mission plans, said first mission plan specifying a manner in which an assigned value for at least one first identity parameter of a plurality of identity parameters contained in a data packet is to be dynamically modified by at least one first node of said computer network based on a first selected function, where the plurality of identity parameters uniquely identify hardware and software of at least one node of the plurality of nodes in said computer network;

detect a first trigger event within said computer network which indicates that a new mission plan needs to be implemented within said computer network;

obtain a second mission plan of the plurality of mission plans in response to said trigger event, the second mission plan different from the first mission plan and specifying a manner in which an assigned value for at least one second identity parameter of the plurality of identity parameters is to be dynamically modified by at least one second node of the computer network based on a second selected function;

determine if any conflicts exist between operations of the second node defined by the second mission plan and operations of the first node defined by the first mission plan; and

configure operations of said computer network to further behave in accordance with said second mission plan such that said manner as specified by the second mission plan is different than said manner specified by the first mission plan, if it is determined that no conflict exists between operations of the first and second nodes as defined by the first and second mission plans;

wherein said manner is further defined in accordance with at least one selection of said at least one identity parameter comprising an IP address, a MAC address, a network/subnet, a TCP sequence or a port number from among said plurality of identity parameters.

14. The system according to claim 13, wherein the first trigger event is detected based on at least one of content of a packet being communicated within the computer network, a congestion level of the computer network, a state of the computer network, user activities within the computer network, and malicious attacks to the computer network.

15. The system according to claim 13, wherein the second mission plan is obtained by selecting a mission plan from a plurality of pre-stored mission plans based on at least one of requirements of a new mission and results from analyzing operational aspects of the computer network.

16. The system according to claim 13, wherein the second mission plan is obtained by automatically generating a mission plan based on at least one of requirements of a new mission and results from analyzing operational aspects of the computer network.

17. The system according to claim 13, wherein the second mission plan is obtained by dynamically generating a mission plan based on at least one of a concept of operations for a mission, an architecture of the computer network, relationships between resources of the computer network, and effectiveness ratings associated with a plurality of identity parameters.

18. The system according to claim 13, wherein the one or more processors are further operative to modify the second mission plan to obtain a third mission plan if a conflict is determined to exist between operations of the first and second nodes as defined by the first and second mission plans.

19. The system according to claim 18, wherein the one or more processors are further operative to determine if any conflicts exist between operations of a third node defined by the third mission plan and operations of the first node defined by the first mission plan.

20. The system according to claim 19, wherein the one or more processors are further operative to configure operations of said computer network to operate in accordance with said third mission plan if it is determined that no conflict exists between operations of the first and third nodes as defined by the first and third mission plans.

21. The system according to claim 13, wherein the one or more processors are further operative to:

determine whether the computer network should continue to behave in accordance with the first or second mission plan; and

re-configure the computer network such that the computer network no longer behaves in accordance with the first or second mission plan, if it is determined that the computer network should not continue to operate in accordance with the first or second mission plan.

22. The system according to claim 13, wherein the one or more processors are further operative to:

determine whether the computer network should continue to behave in accordance with the first or second mission plan; and

re-configure the computer network to behave in accordance with a third mission plan instead of the first or second mission plan, if it is determined that the computer network should not continue to operate in accordance with the first or second mission plan.