CONTEXT-AWARE NETWORK SERVICE POLICY MANAGEMENT

• US 20160173535A1
• Filed: 12/15/2014
• Published: 06/16/2016
• Est. Priority Date: 12/15/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: COHEN, RAMI, LEVIN, ANNA, RAICHSTEIN, ERAN, Barabash, Katherine
• Granted Patent: US 9,667,653 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/342 between virtual entities, e.g. orchestrators, SDN or NFV entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method includes converting, by a computer, a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context, and conveying, to the data forwarding devices, the set of network configuration forwarding rules. Upon detecting a change in the dynamic context of the network, the set of network configuration forwarding rules ae updated based on the set of context-aware data forwarding policies and the change in the dynamic context, and the updated set of network configuration forwarding rules are conveyed to the data forwarding devices.

Claims

1. A method, comprising:

converting, by a computer, a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context;

conveying, to the data forwarding devices, the set of network configuration forwarding rules;

detecting a change in the dynamic context of the network;

updating, based on the set of context-aware data forwarding policies and the change in the dynamic context, the set of network configuration forwarding rules; and

conveying, to the data forwarding devices, the updated set of network configuration forwarding rules.

2. The method according to claim 1, wherein the data forwarding devices are selected from a list consisting of switches, gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

3. The method according to claim 1, wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

4. The method according to claim 1, wherein conveying a given data forwarding rule comprises receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

5. The method according to claim 1, wherein multiple network configuration forwarding rules define a path between two endpoints on the network.

6. The method according to claim 5, wherein each of the endpoints is selected from a list consisting of a virtual machine and a physical computing device.

7. The method according to claim 1, wherein the dynamic context is selected from a list consisting of a data attribute and a network attribute.

8. An apparatus, comprising:

a network adapter coupled to a network having a dynamic context and comprising one or more data forwarding devices;

a memory configured to store a set of context-aware data forwarding policies; and

a processor configured;

to convert, the set of context-aware data forwarding policies to a set of network configuration forwarding rules for the one or more data forwarding devices,

to convey, to the data forwarding devices, the set of network configuration forwarding rules,

to detect a change in the dynamic context of the network,

to update, based on the set of context-aware data forwarding policies and the change in the dynamic context, the set of network configuration forwarding rules, and

to convey, to the data forwarding devices, the updated set of network configuration forwarding rules.

9. The apparatus according to claim 8, wherein the data forwarding devices are selected from a list consisting of switches, gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

10. The apparatus according to claim 8, wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

11. The apparatus according to claim 8, wherein the processor is configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device..

12. The apparatus according to claim 8, wherein multiple network configuration forwarding rules defines a path between two endpoints on the network.

13. The apparatus according to claim 12, wherein each of the endpoints is selected from a list consisting of a virtual machine and a computing device.

14. The apparatus according to claim 8, wherein the dynamic context is selected from a list consisting of a data attribute and a network attribute.

15. A computer program product, the computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to convert a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context;

computer readable program code configured to convey, to the data forwarding devices, the set of network configuration forwarding rules;

computer readable program code configured to detect a change in the dynamic context of the network;

computer readable program code configured to update, based on the set of context-aware data forwarding policies and the change in the dynamic context, the set of network configuration forwarding rules; and

computer readable program code configured to convey, to the data forwarding devices, the updated set of network configuration forwarding rules.

16. The computer program product according to claim 15, wherein the data forwarding devices are selected from a list consisting of switches, gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

17. The computer program product according to claim 15, wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

18. The computer program product according to claim 15, wherein a given network configuration forwarding rule defines a path between two endpoints on the network, and wherein each of the endpoints is selected from a list consisting of a virtual machine and a computing device.

19. The computer program product according to claim 15, wherein the computer readable program code configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

20. The computer program product according to claim 15, wherein the dynamic context is selected from a list consisting of a data attribute and a network attribute.