System and method for dynamic network policy management

• US 20050027837A1
• Filed: 07/29/2003
• Published: 02/03/2005
• Est. Priority Date: 07/29/2003
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Enterasys Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Roese, John J., Graham, Richard W.
• Granted Patent: US 7,526,541 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management

Abstract

A system and method that provides dynamic network policy management. The system enables a network administrator to regulate usage of network services upon initiation of and throughout network sessions. The system employs a method of identifying selectable characteristics of attached functions to establish static and dynamic policies, which policies may be amended before, during and after any session throughout the network based on the monitored detection of any of a number of specified triggering events or activities. Particular policies associated with a particular identified attached function in prior sessions may be cached or saved and employed in subsequent sessions to provide network usage permissions more rapidly in such subsequent sessions. The cached or saved policy information may also be used to identify network usage, control, and security. The system and method of the present invention provides static and dynamic policy allocation for network usage provisioning.

Claims

1. A method of controlling the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, the method comprising the steps of:

a. obtaining information associated with the network system;

b. setting one or more static policies for network services usage by the attached function;

c. setting one or more dynamic policies for network services usage by the attached function;

d. monitoring the network system for triggers; and

e. modifying the static policies, the dynamic policies, or both for the attached function based upon the monitored triggers.

2. The method as claimed in claim 1 further comprising the step of saving set and modified policies associated with the attached function as policy history for the attached function.

3. The method as claimed in claim 2 further comprising the step of querying whether a policy history exists for the attached function after obtaining the information from the network system.

4. The method as claimed in claim 2 wherein the step of saving the set and modified policies associated with the attached function includes the step of caching some or all of the policy history in a network system device.

5. The method as claimed in claim 4 further comprising the step of invalidating the cached policy history based upon the occurrence of a specified event.

6. The method as claimed in claim 5 wherein the specified event is selected from the group consisting of time, size limitations, storage limits, a policy change, or a network system change.

7. The method as claimed in claim 2 further comprising the step of evaluating whether the policy history includes any static policies that may be set for the attached function in a current session.

8. The method as claimed in claim 1 wherein the triggers include timeouts, attached function changes, network infrastructure changes, intrusion detection events, firewall events, administrator inputs, network service changes and network service change requests.

9. The method as claimed in claim 1 wherein the information includes attached function information, access device information, access port, number of devices per port, priority per port, priority per application, priority per device, application requested, exchange protocols available, port security, access location, and access time.

10. The method as claimed in claim 1 wherein the only static policy is that there are only dynamic policies.

11. A method of controlling the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, the method comprising the steps of:

a. obtaining information associated with the network system;

b. setting one or more dynamic policies for network services usage by the attached function;

c. monitoring the network system for triggers; and

d. modifying the dynamic policies for the attached function based upon the monitored triggers.

12. The method as claimed in claim 11 further comprising the step of saving set and modified policies associated with the attached function as policy history for the attached function.

13. The method as claimed in claim 12 further comprising the step of querying whether a policy history exists for the attached function after obtaining the information from the network system.

14. The method as claimed in claim 12 wherein the step of saving the set and modified policies associated with the attached function includes the step of caching the policy history in a network system device.

15. The method as claimed in claim 14 further comprising the step of invalidating the cached policy history based upon the occurrence of a specified event.

16. The method as claimed in claim 15 wherein the specified event is selected from the group consisting of time, size limitations, storage limits, a policy change, or a network system change.

17. The method as claimed in claim 11 wherein the triggers include timeouts, attached function changes, network infrastructure changes, intrusion detection events, firewall events, administrator inputs, network service changes and network service change requests.

18. A system to control the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, the system comprising:

a. means, forming part of the network system, for obtaining information associated with the network system; and

b. a dynamic policy function module for setting static and dynamic policies for the attached function, for monitoring the network system for triggers, and for modifying the static policies, the dynamic policies, or both for the attached function based upon the monitored triggers.

19. The system as claimed in claim 18 wherein the dynamic policy function module is a centralized module of a policy server of the network infrastructure.

20. The system as claimed in claim 18 further comprising means for saving set and modified policies history.

21. The system as claimed in claim 20 wherein the means for storing set and modified policies history forms part of the policy server of the network infrastructure.

22. The system as claimed in claim 20 wherein the means for storing set and modified policies forms part of an interconnection device of the network infrastructure.

23. The system as claimed in claim 18 wherein the dynamic policy function module is a distributed module forming portions of two or more devices of the network infrastructure.

24. The system as claimed in claim 23 wherein the two or more devices are selected from a combination of one or more servers and one or more interconnection devices or a combination of two or more interconnection devices.

25. The system as claimed in claim 20 wherein the means for saving set and modified policies includes means for caching the set and modified policies on a centralized network device, a local network device, or a combination of a centralized network device and a local network device.

26. The system as claimed in claim 18 wherein the means for obtaining information associated with the network system includes IEEE 802.1X authentication, RADIUS authentication, or a combination of IEEE 802.1X authentication and RADIUS authentication of the attached function.

27. A system to control the usage by an attached function of network services of a network system that includes the attached function, one or more other attached functions and network infrastructure, the system comprising:

a. means, forming part of the network system, for obtaining information associated with the network system; and

b. a dynamic policy function module for setting dynamic policies for network services usage by the attached function, for monitoring the network system for triggers, and for modifying the dynamic policies for the attached function based upon the monitored triggers.

28. The system as claimed in claim 27 wherein the dynamic policy function module is a centralized module of a policy server of the network infrastructure.

29. The system as claimed in claim 27 further comprising means for saving set and modified policies history.

30. The system as claimed in claim 27 wherein the dynamic policy function module is a distributed module forming portions of two or more network devices of the network infrastructure.

31. The system as claimed in claim 27 further comprising means for caching set and modified policies history on one or more local network devices of the network infrastructure.

32. A system to control the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, based on one or more usage policies assigned to the attached function, the system comprising means for saving the assigned policies on a network device of the network infrastructure.

33. The system as claimed in claim 32 wherein the means for saving the assigned policies is a distributed module forming portions of two or more devices of the network infrastructure.

34. A system to control the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, based on dynamic policies assigned to the attached function, the system comprising means for saving the assigned dynamic policies as policies histories.

35. The system as claimed in claim 34 wherein the policies histories are saved on a policy server of the network infrastructure.

36. The system as claimed in claim 34 wherein the policies histories are saved on one or more local network devices of the network infrastructure.

37. A system to control usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, based on one or more usage policies assigned to the attached function, the system comprising means for caching the assigned usage policies as policies histories.

38. The system as claimed in claim 37 further comprising means for invalidating one or more of the cached policies histories based on a specified event.

39. The system as claimed in claim 38 wherein the specified event is selected from the group consisting of time, size limitations, storage limits, a policy change, or a network system change.

40. A method of controlling the usage by an attached function of network services associated with a network system that includes the attached function, one or more other attached functions and network infrastructure, the method comprising the steps of:

a. setting one or more policies for network services usage by the attached function;

b. saving the one or more policies set as policies histories;

c. monitoring the policies histories for triggers; and

d. modifying the policies for the attached function based upon the monitored triggers.