Distributed network management using a logical multi-dimensional label-based policy model

• US 9,882,783 B2
• Filed: 04/09/2014
• Issued: 01/30/2018
• Est. Priority Date: 04/10/2013
• Status: Active Grant

• Current Assignee: Illumio, Inc.
• Original Assignee: Illumio, Inc.
• Inventors: Kirner, Paul J., Cook, Daniel R., Fandli, Juraj G., Glenn, Matthew K., Gupta, Mukesh, Rubin, Andrew S., Scott, Jerry B., Chang, Sehyo, Stokol, Alan B.
• Primary Examiner(s): Anyan, Barbara B
• Application Number:
  US14/249,128
• Publication Number:
  US 20140310415A1
• Time in Patent Office: 1,392 Days
• CPC Class Codes: G06F 11/3624 by performing operations on the source code, e.g. via a compiler
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0222 During e-commerce, i.e. online transactions
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/22 Traffic shaping
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/108 : when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/53 : using third party service providers
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 48/02 : Access restriction performed under specific conditions
• CPC Class Codes: H04W 48/04 : based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 48/08 : Access restriction or access information delivery, e.g. discovery data delivery signalling during connection H04W76/00
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information

Abstract

Management instructions for a particular managed server within an administrative domain are generated according to an administrative domain-wide management policy that comprises a set of one or more rules. The administrative domain includes a plurality of managed servers. A determination is made regarding which rules within the set of rules are relevant to the particular managed server. Function-level instructions are generated based on the rules that were determined to be relevant. A determination is made regarding which managed servers within the plurality of managed servers are relevant to the particular managed server. The function-level instructions and information regarding the managed servers that were determined to be relevant are sent to the particular managed server. The particular managed server uses the function-level instructions and information regarding the managed servers to configure a management module so that the configured management module implements the administrative domain-wide management policy.

Claims

1. A method of generating management instructions for a particular managed server within an administrative domain according to a set of one or more rules, wherein the administrative domain includes a plurality of managed servers, the method comprising:

storing label sets for each of the plurality of managed servers, each of the label sets having one or more labels identifying a high-level characteristic of a corresponding one of the plurality of managed servers;

storing the set of one or more rules, each rule specifying a service, labels in a provided-by portion of the rule, and labels in a used-by portion of the rule, wherein each rule controls providing of the service by managed servers having one of the labels in the provided-by portion of the rule and controls use of the service by managed servers having one of the labels in the used-by portion of the rule;

determining which of the set of rules specify a label within a label set of the particular managed server to determine relevant rules;

enumerating a plurality of actor-sets each associated with a different possible combination of labels, each actor-set comprising actor-set records identifying managed servers having a label associated with the actor-set;

filtering the enumerated plurality of actor-sets to determine which of the plurality of actor-sets have at least one label corresponding to at least one of the relevant rules to determine relevant actor-sets;

generating function-level instructions for the particular managed server based on the relevant rules, each of the function-level instructions referencing a single label in the provided-by portion of a corresponding relevant rule and a single label in the used-by portion of the corresponding relevant rule; and

sending, to the particular managed server, the function-level instructions and actor-set records included in the relevant actor-sets, wherein the particular managed server uses the function-level instructions and the actor-set records to configure the particular managed server to implement the relevant rules.

2. The method of claim 1, wherein the labels each comprise a dimension comprising one element of a group containing Role, Environment, Application, Line of Business, and Location.

3. The method of claim 1, wherein the actor-set records included in the relevant actor-sets include network exposure information of the relevant managed servers, wherein the actor-set records include a first actor-set record indicating a first internet protocol address of one of the relevant managed servers and a second actor-set record indicating a second internet protocol address of the one of the relevant managed servers.

4. The method of claim 1, wherein generating the function-level instructions and filtering the enumerated plurality of actor-sets comprises generating the function-level instructions in parallel with filtering the enumerated plurality of actor-sets.

5. The method of claim 1, wherein each of the actor-set records comprises at least one of:

a unique identifier of a respective managed server of the plurality of managed servers, an identifier of an operating system of the respective managed server, or an IP address of the respective managed server.

6. The method of claim 1, wherein at least one of the rules in the set of rules includes multiple labels in the each of the provided-by portion and the used-by portion.

7. The method of claim 1, wherein at least one of the actor-sets corresponds to a single label and at least one of the actor-sets corresponds to a combination of multiple labels.

8. A non-transitory computer-readable storage medium storing computer program instructions for generating management instructions for a particular managed server within an administrative domain according to a set of one or more rules, wherein the administrative domain includes a plurality of managed servers, the computer program instructions executable to perform steps comprising:

storing label sets for each of the plurality of managed servers, each of the label sets having one or more labels identifying a high-level characteristic of a corresponding one of the plurality of managed servers;

storing the set of one or more rules, each rule specifying a service, labels in a provided-by portion of the rule, and labels in a used-by portion of the rule, wherein each rule controls providing of the service by managed servers having one of the labels in the provided-by portion of the rule and controls use of the service by managed servers having one of the labels in the used-by portion of the rule;

determining which of the set of rules specify a label within a label set of the particular managed server to determine relevant rules;

enumerating a plurality of actor-sets each associated with a different possible combination of labels, each actor-set comprising actor-set records identifying managed servers having a label associated with the actor-set;

filtering the enumerated plurality of actor-sets to determine which of the plurality of actor-sets have at least one label corresponding to at least one of the relevant rules to determine relevant actor-sets;

generating function-level instructions for the particular managed server based on the relevant rules, each of the function-level instructions referencing a single label in the provided-by portion of a corresponding relevant rule and a single label in the used-by portion of the corresponding relevant rule; and

sending, to the particular managed server, the function-level instructions and actor-set records included in the relevant actor-sets, wherein the particular managed server uses the function-level instructions and the actor-set records to configure the particular managed server to implement the relevant rules.

9. The computer-readable storage medium of claim 8, wherein the labels each comprise a dimension comprising one element of a group containing Role, Environment, Application, Line of Business, and Location.

10. The computer-readable storage medium of claim 8, wherein the actor-set records included in the relevant actor-sets include network exposure information of the relevant managed servers, wherein the actor-set records include a first actor-set record indicating a first internet protocol address of one of the relevant managed servers and a second actor-set record indicating a second internet protocol address of the one of the relevant managed servers.

11. The computer-readable storage medium of claim 8, wherein generating the function-level instructions and filtering the enumerated plurality of actor-sets comprises generating the function-level instructions in parallel with filtering the enumerated plurality of actor-sets.

12. The computer-readable storage medium of claim 8, wherein each of the actor-set records comprises at least one of:

a unique identifier of a respective managed server of the plurality of managed servers, an identifier of an operating system of the respective managed server, or an IP address of the respective managed server.

13. The computer-readable storage medium of claim 8, wherein at least one of the rules in the set of rules includes multiple labels in the each of the provided-by portion and the used-by portion.

14. The computer-readable storage medium of claim 8, wherein at least one of the actor-sets corresponds to a single label and at least one of the actor-sets corresponds to a combination of multiple labels.

15. A system for generating management instructions for a particular managed server within an administrative domain according to a set of one or more rules, wherein the administrative domain includes a plurality of managed servers, the system comprising:

a non-transitory computer-readable storage medium storing computer program instructions executable to perform steps comprising;

storing label sets for each of the plurality of managed servers, each of the label sets having one or more labels identifying a high-level characteristic of a corresponding one of the plurality of managed servers;

storing the set of one or more rules, each rule specifying a service, labels in a provided-by portion of the rule, and labels in a used-by portion of the rule, wherein each rule controls providing of the service by managed servers having one of the labels in the provided-by portion of the rule and controls use of the service by managed servers having one of the labels in the used-by portion of the rule;

determining which of the set of rules specify a label within a label set of the particular managed server to determine relevant rules;

enumerating a plurality of actor-sets each associated with a different possible combination of labels, each actor-set comprising actor-set records identifying managed servers having a label associated with the actor-set;

filtering the enumerated plurality of actor-sets to determine which of the plurality of actor-sets have at least one label corresponding to at least one of the relevant rules to determine relevant actor-sets;

generating function-level instructions for the particular managed server based on the relevant rules, each of the function-level instructions referencing a single label in the provided-by portion of a corresponding relevant rule and a single label in the used-by portion of the corresponding relevant rule; and

sending, to the particular managed server, the function-level instructions and actor-set records included in the relevant actor-sets, wherein the particular managed server uses the function-level instructions and the actor-set records to configure the particular managed server to implement the relevant rules; and

a computer processor for executing the computer program modules.

16. The system of claim 15, wherein the labels each comprise a dimension comprising one element of a group containing Role, Environment, Application, Line of Business, and Location.

17. The system of claim 15, wherein the actor-set records included in the relevant actor-sets include network exposure information of the relevant managed servers, wherein the actor-set records include a first actor-set record indicating a first internet protocol address of one of the relevant managed servers and a second actor-set record indicating a second internet protocol address of the one of the relevant managed servers.

18. The system of claim 15, wherein each of the actor-set records comprises at least one of:

a unique identifier of a respective managed server of the plurality of managed servers, an identifier of an operating system of the respective managed server, or an IP address of the respective managed server.

19. The system of claim 15, wherein at least one of the rules in the set of rules includes multiple labels in the each of the provided-by portion and the used-by portion.

20. The system of claim 15, wherein at least one of the actor-sets corresponds to a single label and at least one of the actor-sets corresponds to a combination of multiple labels.