Secure access to managed network objects using a configurable platform-independent gateway providing individual object-level access control

• US 7,478,403 B1
• Filed: 04/21/2000
• Issued: 01/13/2009
• Est. Priority Date: 04/21/2000
• Status: Expired due to Fees

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Dong, Xeusi, Lee, Linda C., Allavarpu, Sai V.
• Primary Examiner(s): Patel; Haresh N
• Application Number:
  US09/556,068
• Time in Patent Office: 3,189 Days
• Field of Search: 709/206, 709/320, 709217-228, 709/230, 709200-203, 705/44, 713/201, 713/153, 345/853, 719310-318, 710/20, 370/254
• US Class Current: 719/316
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/052 using standardised network management architectures, e.g. telecommunication management network [TMN] or unified network management architecture [UNMA]
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time

Abstract

A gateway between client manager applications and an enterprise manager may be provided to manage various networked objects. In one embodiment, CORBA-based TMN manager applications may be communicatively coupled to a CORBA Object Request Broker (ORB) and may be operable to send Interface Definition Language (IDL) requests to, and receive IDL responses and CORBA events from, managed objects through the CORBA ORB. The client manager may first be authenticated to the gateway by username and password, or other validation information associated with the client manager, which may be represented in a user profile. Once the initial client authentication is accomplished, the gateway may provide object-level access control between manager applications and managed objects at an individual object level so that one of the managers is granted access to one of the managed objects while being prevented from interfacing with a different one of the managed objects.

Claims

1. A network management system, comprising:

a gateway which is coupled between a plurality of managed objects and a plurality of proxy agent managers; and

which is configured to deliver one or more events generated by the managed objects to one or more managers and to deliver one or more requests generated by the managers to one or more of the managed objects, wherein each of the events and each of the requests include a user identification, wherein the user identification identifies the respective manager to which the event or the request belongs;

a platform-independent interface to the gateway, wherein the gateway is configured to communicate with the one or more managers through the platform-independent interface to deliver the one or more events or the one or more requests, wherein the managers share a singleton Request Service Access Point (Request SAP) object;

wherein the gateway is configured to provide object-level access control between the one or more managers and the managed objects to receive the one or more events from or to send the one or more requests to the managed objects, wherein said object-level access control is provided by the Request SAP object at an individual object level so that one of the one or more managers is granted access to one of the managed objects while being prevented from interfacing with a different one of the managed objects.

2. The network management system of claim 1, wherein the gateway is configured to determine whether each of the one or more managers is authorized to communicate with each of the managed objects.

3. The network management system of claim 1, wherein the gateway is configured to authenticate the one or more managers to receive the one or more events from or to send the one or more requests to the managed objects as a function of the identity of the managed object.

4. The network management system of claim 1, wherein the gateway is configured to authenticate the one or more managers to receive the one or more events or send the one or more requests as a function of user IDs entered by users of the one or more managers.

5. The network management system of claim 1, wherein the one or more events or one or more requests are delivered by the gateway through the platform-independent interface according to Internet Inter-Object Protocol (IIOP).

6. The network management system of claim 1, wherein the platform-independent interface to the gateway is expressed in an interface definition language, and wherein the interface definition language comprises a language for defining interfaces to the managed objects across a plurality of platforms and across a plurality of programming languages.

7. The network management system of claim 6, wherein the interface definition language comprises OMG IDL.

8. The network management system of claim 1, wherein the managed objects comprise one or more objects corresponding to a telephone network.

9. The network management system of claim 1, wherein the managed objects comprise an object corresponding to a telecommunications device.

10. The network management system of claim 1, wherein the gateway is configured to provide security audit trails.

11. The network management system of claim 10, wherein the gateway providing security audit trails comprises the gateway providing access to a logging service.

12. The network management system of claim 11, wherein the logging service is operable to log an ID of a user that receives each event or sends each request.

13. The network management system of claim 11, wherein the logging service is operable to log an ID of a respective one of the plurality of managed objects that is a source of each event or a target of each request.

14. The network management system of claim 11, wherein the logging service is operable to log a time at which each event or request is generated.

15. The network management system of claim 11, wherein the logging service is operable to log a time at which each event or request is delivered.

16. The network management system of claim 1, wherein the one or more requests comprise a query for information concerning one of the managed objects.

17. The network management system of claim 1, wherein the one or more requests comprise a command to set one or more parameters of one of the managed objects.

18. The network management system of claim 6, wherein the one or more requests are converted from the interface definition language to a Portable Management Interface (PMI) format prior to delivery to the managed objects.

19. The network management system of claim 6, wherein the one or more requests are converted from the interface definition language to a platform-specific format prior to delivery to the managed objects.

20. A network management method, comprising:

sending an identity of a user of a manager application to a gateway, wherein the gateway is configured to communicate with the manager application through a platform-independent interface, wherein the gateway is coupled between a plurality of managed objects and the manager application;

determining at a managed object level whether or not the manager application is allowed to receive an event generated by one of a plurality of managed objects or to send a request to the one of the plurality of managed objects as a function of the identity of the user of the manager application, wherein the event and the request include a user identification, wherein the user identification identifies the manager application to which the event or the request belongs;

whereby access for the manager application to receive the event or send the request is approved or denied for said one of the plurality of managed objects by a singleton Request Service Access Point (Request SAP) at an individual object level so that the manager application is granted access to one of the plurality of managed objects while being prevented from interfacing with a different one of the plurality of managed objects; and

delivering the event to the manager application or the request to the managed object if the manager access is approved.

21. The network management method of claim 20, wherein the gateway is configured to determine whether the manager application is authorized to communicate with the one of the plurality of managed objects.

22. The network management method of claim 20, wherein the gateway is configured to authenticate the manager application to receive the event or send the request as a function as the identity of the managed object generating the event or receiving the request.

23. The network management method of claim 20, wherein the gateway is configured to authenticate the manager application to receive the event or send the request as a function of a user ID entered by the user of the manager application.

24. The network management method of claim 20, wherein the event or request is delivered by the gateway through the platform-independent interface according to Internet Inter-Object Protocol (IIOP).

25. The network management method of claim 20, wherein the platform-independent interface to the gateway is expressed in an interface definition language, and wherein the interface definition language comprises a language for defining interfaces to the managed objects across a plurality of platforms and across a plurality of programming languages.

26. The network management method of claim 25, wherein the interface definition language comprises OMG IDL.

27. The network management method of claim 20, wherein the one of the plurality of managed objects comprises an object corresponding to a telephone network.

28. The network management method of claim 20, wherein the one of the plurality of managed objects comprises an object corresponding to a telecommunications device.

29. The network management method of claim 20, wherein the gateway is configured to provide security audit trails.

30. The network management method of claim 29, wherein the gateway providing security audit trails comprises the gateway providing access to a logging service.

31. The network management method of claim 30, wherein the logging service is operable to log an ID of a user that receives the event or sends the request.

32. The network management method of claim 30, wherein the logging service is operable to log an ID of the respective one of the plurality of managed objects that is a source of the event or a target of the request.

33. The network management method of claim 30, wherein the logging service is operable to log a time at which the event or request is generated.

34. The network management method of claim 30, wherein the logging service is operable to log a time at which the event or request is delivered.

35. The network management method of claim 20, wherein the request comprises a query for information concerning the one of the plurality of managed objects.

36. The network management method of claim 20, wherein the request comprises a command to set one or more parameters of the one of the plurality of managed objects.

37. The network management method of claim 25, wherein the request is converted from the interface definition language to a Portable Management Interface (PMI) format prior to delivery to the one of the plurality of managed objects.

38. The network management method of claim 25, wherein the request is converted from the interface definition language to a platform-specific format prior to delivery to the one of the plurality of managed objects.

39. A tangible, computer-readable storage medium, comprising program instructions for network management, wherein the program instructions are computer-executable to perform:

sending an identity of a user of a manager application to a gateway, wherein the gateway is configured to communicate with the manager application through a platform-independent interface, wherein the gateway is coupled between a plurality of managed objects and the manager application;

determining at a managed object level whether or not the manager application is allowed to receive an event generated by one of a plurality of managed objects or to send a request to the one of the plurality of managed objects as a function of the identity of the user of the manager application, wherein the event and the request include a user identification, wherein the user identification identifies the manager application to which the event or the request belongs;

whereby access for the manager application to receive the event or send the request is approved or denied for said one of the plurality of managed objects by a singleton Request Service Access Point (Request SAP) at an individual object level so that the manager application is granted access to one of the plurality of managed objects while being prevented from interfacing with a different one of the plurality of managed objects; and

delivering the event to the manager application or the request to the managed object if the manager access is approved.

40. The tangible, computer-readable storage medium of claim 39, wherein the gateway is configured to determine whether the manager application is authorized to communicate with the one of the plurality of managed objects.

41. The tangible, computer-readable storage medium of claim 39, wherein the gateway is configured to authenticate the manager application to receive the event or send the request as a function as the identity of the managed object generating the event or receiving the request.

42. The tangible, computer-readable storage medium of claim 39, wherein the gateway is configured to authenticate the manager application to receive the event or send the request as a function of a user ID entered by the user of the manager application.

43. The tangible, computer-readable storage medium of claim 39, wherein the event or request is delivered by the gateway through the platform-independent interface according to Internet Inter-Object Protocol (IIOP).

44. The tangible, computer-readable storage medium of claim 39, wherein the platform-independent interface to the gateway is expressed in an interface definition language, and wherein the interface definition language comprises a language for defining interfaces to the managed objects across a plurality of platforms and across a plurality of programming languages.

45. The tangible, computer-readable storage medium of claim 44, wherein the interface definition language comprises OMG IDL.

46. The tangible, computer-readable storage medium of claim 39, wherein the one of the plurality of managed objects comprises an object corresponding to a telephone network.

47. The tangible, computer-readable storage medium of claim 39, wherein the one of the plurality of managed objects comprises an object corresponding to a telecommunications device.

48. The tangible, computer-readable storage medium of claim 39, wherein the gateway is configured to provide security audit trails.

49. The tangible, computer-readable storage medium of claim 48, wherein the gateway providing security audit trails comprises the gateway providing access to a logging service.

50. The tangible, computer-readable storage medium of claim 49, wherein the logging service is operable to log an ID of a user that receives the event or sends the request.

51. The tangible, computer-readable storage medium of claim 49, wherein the logging service is operable to log an ID of the respective one of the plurality of managed objects that is a source of the event or a target of the request.

52. The tangible, computer-readable storage medium of claim 49, wherein the logging service is operable to log a time at which the event or request is generated.

53. The tangible, computer-readable storage medium of claim 49, wherein the logging service is operable to log a time at which the event or request is delivered.

54. The tangible, computer-readable storage medium of claim 39, wherein the request comprises a query for information concerning the one of the plurality of managed objects.

55. The tangible, computer-readable storage medium of claim 39, wherein the request comprises a command to set one or more parameters of the one of the plurality of managed objects.

56. The tangible, computer-readable storage medium of claim 44, wherein the request is converted from the interface definition language to a Portable Management Interface (PMI) format prior to delivery to the one of the plurality of managed objects.

57. The tangible, computer-readable storage medium of claim 44, wherein the request is converted from the interface definition language to a platform-specific format prior to delivery to the managed object.