Context-aware network service policy management

• US 9,667,653 B2
• Filed: 12/15/2014
• Issued: 05/30/2017
• Est. Priority Date: 12/15/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Barabash, Katherine, Raichstein, Eran, Cohen, Rami, Levin, Anna
• Primary Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US14/569,810
• Publication Number:
  US 20160173535A1
• Time in Patent Office: 897 Days
• Field of Search: 726 1
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/342 between virtual entities, e.g. orchestrators, SDN or NFV entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method includes converting, by a computer, a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context, and conveying, to the data forwarding devices, the set of network configuration forwarding rules. Upon detecting a change in the dynamic context of the network, the set of network configuration forwarding rules ae updated based on the set of context-aware data forwarding policies and the change in the dynamic context, and the updated set of network configuration forwarding rules are conveyed to the data forwarding devices.

Claims

1. A method, comprising:

configuring a computer with a set of context-aware data forwarding policies of a network having a dynamic context;

monitoring the dynamic context of the network;

determining a set of network configuration forwarding rules for one or more data forwarding devices of the network, responsively to the configured context-aware data forwarding policies and the dynamic context of the network;

operating by the computer, a first thread that detects changes in the dynamic context of the network, responsively to the monitoring and in response to detected changes, updates, based on the set of context-aware data forwarding policies and the detected changes in the dynamic context, the set of network configuration forwarding rules;

in parallel to operating the first thread, operating a second thread that receives rule requests and in response to the received rule requests conveys to the data forwarding devices, the updated set of network configuration forwarding rules; and

handling packets by the data forwarding devices according to the conveyed updated set of network configuration forwarding rules.

2. The method according to claim 1, wherein the data forwarding devices are selected from a list consisting of gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

3. The method according to claim 1, wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

4. The method according to claim 1, wherein conveying a given data forwarding rule comprises receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

5. The method according to claim 1, wherein multiple network configuration forwarding rules define a path between two endpoints on the network.

6. The method according to claim 5, wherein each of the endpoints is selected from a list consisting of a virtual machine and a physical computing device.

7. The method according to claim 1, wherein the dynamic context comprises a network attribute.

18. The method according to claim 1, wherein the set of context-aware data forwarding policies comprises a policy dependent on a measure of available bandwidth in the network and wherein monitoring the dynamic context of the network comprises monitoring the measure of the available bandwidth in the network.

19. The method according to claim 1, wherein the set of context-aware data forwarding policies comprises policies dependent on network endpoint locations and wherein monitoring the dynamic context of the network comprises monitoring the endpoint locations.

20. The method according to claim 1, wherein the set of context-aware data forwarding policies comprises policies dependent on a load on an element in the network and wherein monitoring the dynamic context of the network comprises monitoring the load on the element in the network.

21. The method according to claim 1, wherein conveying, to the data forwarding devices, the updated set of network configuration forwarding rules comprises identifying a subset of the data forwarding devices affected by the change and conveying updated rules only to the identified subset.

22. The method according to claim 1, wherein determining a set of network configuration forwarding rules comprises determining whether to compress data transmitted through the network responsive to the dynamic context.

23. The method according to claim 1, wherein monitoring the dynamic context comprises monitoring a location, connection status or utilization level of one or more elements of the network.

8. An apparatus, comprising:

a network adapter coupled to a network having a dynamic context and comprising one or more data forwarding devices;

a memory configured to store a set of context-aware data forwarding policies; and

a processor configured;

to monitor the dynamic context of the network,

to determine a set of network configuration forwarding rules for the one or more data forwarding devices, responsively to the configured context-aware data forwarding policies and the dynamic context of the network,

to operate a first thread that detects changes in the dynamic context of the network, responsively to the monitoring, and in response to detected changes, updates,

based on the set of context-aware data forwarding policies and the detected changes in the dynamic context, the set of network configuration forwarding rules, and

in parallel to operating the first thread, operates a second thread that receives rule requests and in response to the received rule conveys to the data forwarding devices, the updated set of network configuration forwarding rules.

9. The apparatus according to claim 8, wherein the data forwarding devices are selected from a list consisting of gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

10. The apparatus according to claim 8, wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

11. The apparatus according to claim 8, wherein the processor is configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

12. The apparatus according to claim 8, wherein the dynamic context comprises a data attribute.

13. A computer program product, the computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured with a set of context-aware data forwarding policies of a network having a dynamic context;

computer readable program code configured to monitor the dynamic context of the network, and to determine a set of network configuration forwarding rules for one or more data forwarding devices of the network, responsively to the configured context-aware data forwarding policies and the dynamic context of the network;

computer readable program code configured to operate a first thread that detects changes in the dynamic context of the network, responsively to the monitoring and in response to detected changes, updates, based on the set of context-aware data forwarding policies and the detected changes in the dynamic context, the set of network configuration forwarding rules; and

computer readable program code configured to operate in parallel to the first thread, a second thread that receives rule requests and in response to the received rule requests conveys, to the data forwarding devices, the updated set of network configuration forwarding rules.

14. The computer program product according to claim 13, wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

15. The computer program product according to claim 13, wherein a given network configuration forwarding rule defines a path between two endpoints on the network, and wherein each of the endpoints is selected from a list consisting of a virtual machine and a computing device.

16. The computer program product according to claim 13, wherein the computer readable program code is configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

17. The computer program product according to claim 13, wherein the dynamic context comprises a network attribute.