Systems, apparatus and methods for managing networking devices

• US 7,966,391 B2
• Filed: 05/10/2005
• Issued: 06/21/2011
• Est. Priority Date: 05/11/2004
• Status: Expired due to Fees

• Current Assignee: Todd J. Anderson
• Original Assignee: Todd J. Anderson
• Inventors: Anderson, Todd J., Phillipi, Mark P., Ross, Bradley S.
• Primary Examiner(s): Bates; Kevin
• Assistant Examiner(s): McKenzie; Marcus
• Application Number:
  US11/125,165
• Publication Number:
  US 20050267928A1
• Time in Patent Office: 2,233 Days
• Field of Search: 709223-226, 707/201, 707/203, 703/22
• US Class Current: 709/223
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration

Abstract

Provided are systems, apparatus and methods for the management and control of a plurality of networking devices. Embodiments include a database at each node of a communications network, where the database stores all networking and/or security data associated with each networking device at all nodes. Further, a replication module communicates any networking and/or security data changes to the databases, and insures that each database has the same information. Other embodiments may include an adaptive networking module operable to analyze and optimize the behavior, performance and/or security of the networking devices, and a simulation module to insure that any optimization-related changes do not adversely affect any of the networking devices. Therefore, the network management systems, apparatus and methods advantageously provide a decentralized system of all networking and/or security data that allows each network node to individually optimize its, and the entire network'"'"'s, networking performance and security.

Claims

1. A decentralized network management system, comprising:

a networking database module disposed at least two of a plurality of nodes of a communications network, each networking database module comprising a data repository having a plurality of networking device configuration data corresponding to a local networking device and a plurality of remotely-located peer networking devices each associated with one of the plurality of nodes, wherein the local networking device and each remotely-located peer networking device operates or manages communications for one or more networked devices at a corresponding one of the plurality of nodes according to at least a portion of the plurality of networking device configuration data;

an adaptive networking module disposed at the at least two of the plurality of nodes and operable to receive actual performance data or actual security data associated with a corresponding one of the plurality of peer networking devices, each adaptive networking module further operable to generate new networking device configuration data based on the actual performance data or the actual security data and based on determining that the new networking device configuration data improves local networking device performance or security and remotely-located networking device performance or security by taking into account the plurality of networking device configuration data of both the local networking device and the plurality of remotely-located peer networking devices, wherein the new networking device configuration data is different from the plurality of networking device configuration data; and

a replication module disposed at the at least two of the plurality of nodes, wherein each replication module is operable in a two-way, decentralized manner to update the plurality of networking device configuration data with the new networking device configuration data generated at or received at the corresponding node, and to transmit the new networking device configuration data generated at the corresponding node to another replication module at, at least, one other one of the plurality of nodes to synchronize the plurality of networking device configuration data for the plurality of peer networking devices between the respective nodes, wherein the local networking device or one of the remotely-located peer networking devices operates or manages communications for one or more networked devices at the corresponding one of the plurality of nodes according to the new networking device configuration data.

2. The system of claim 1, wherein the new networking device configuration data is transmitted from the respective one of the plurality of nodes at which the new networking device configuration data is generated to every other one of the plurality of nodes.

3. The system of claim 1, wherein each of the plurality of networking device configuration data comprises a set of operational data suitable to control a functionality of the respective peer networking device.

4. The system of claim 1, wherein each of the plurality of networking device configuration data comprises at least one of physical data and behavioral data, wherein the physical data comprises data associated with an identification of the respective node or the respective peer networking device and the behavioral data comprises data associated with one or more rules, configurations, or settings that control a function of the respective peer networking device.

5. The system of claim 1, wherein the data repository further comprises status-related data associated with a networking performance status or a security status of at least one of the plurality of peer networking devices, wherein the status-related data comprises the actual performance data or the actual security data.

6. The system of claim 1, wherein the data repository comprises data selected from the group consisting of routing data, firewall data, virtual private network data, encryption key data, proxy gateway data, intrusion detection data, intrusion prevention data, network forensic data, vulnerability assessment data, anti-virus data, content filter data, network anomaly data, authentication data, access control data, authorization data, spam filter data, application filter data, media access control address filter data, port filter data, physical site data, network site data, protocol data, network performance data, network control data, web cache data, quality of service data, banned data, trusted data, dynamic host control protocol data, networking information data, communication protocol data, and distributed site data.

7. The system of claim 1, wherein the communications network comprises a public communications network, and wherein a group of the plurality of peer networking devices at ones of the plurality of nodes distributed across the public communications network defines a wide area network.

8. The system of claim 1, further comprising a network management module operable to change the networking device configuration data associated with at least one of the plurality of peer networking devices corresponding to one of the plurality of nodes.

9. The system of claim 1, further comprising a network simulation module having at least one network model operable to receive the new networking device configuration data and generate simulated performance data or simulated security data.

10. The system of claim 9, further comprising a data analyzer operable to compare the simulated performance data or the simulated security data to the actual performance data or the actual security data, respectively, and determine if the new networking device configuration data improves networking performance or networking security, respectively.

11. The system of claim 10, wherein the replication module is operable if the new networking device configuration data improves the networking performance or the networking security, respectively.

12. The system of claim 1, further comprising a networking services module having at least one networking communication function.

13. The system of claim 12, wherein the networking communications function is selected from the group consisting of routing, quality of service, firewall, virtual private network, web cache, web filter, intrusion detection, performance monitoring, intrusion prevention, spam prevention, virus prevention, content filtering, network analysis, and broadband network communications optimization.

14. The system of claim 12, wherein the plurality of networking device configuration data comprise networking level instructions, wherein the networking services module further comprises at least one networking service application operable with service-specific instructions having a different protocol than the networking level instructions, and further comprising a translator module having a translator mechanism operable to receive the networking level instructions and generate the corresponding service-specific instructions.

22. The system of claim 1, wherein the data repository further comprises networked device data corresponding to a networked device.

23. The system of claim 12, further comprising a local network management device having a memory operable to store the networking database module and a processor operable to execute the adaptive networking module and the replication module.

24. The system of claim 23, wherein the data repository further comprises networked device data corresponding to a networked device.

25. The system of claim 1, wherein the adaptive networking module is operable to receive the actual security data corresponding to the local networking device, and wherein the adaptive networking module is further operable to generate new networking device configuration data for the local networking device based on the actual security data corresponding to the local networking device.

15. A decentralized networking system, comprising:

a plurality of peer networking devices associated with a plurality of interconnected nodes of a communications network, wherein each of the plurality of nodes includes at least one of the plurality of peer networking devices, wherein each peer networking device operates or manages communications for one or more networked devices at a corresponding one of the plurality of nodes according to a corresponding set of networking device configuration data;

a networking database at least two of the plurality of nodes, wherein the networking database at a first one of the plurality of nodes comprises a first plurality of sets of networking device configuration data comprising a first set of at least one of networking data or security data associated with a first local networking device at the first node and each remotely-located one of the plurality of peer networking devices;

wherein the networking database at a second one of the plurality of nodes-comprises a second plurality of sets of networking device configuration data comprising a second set of at least one of networking data or security data associated with a second networking device at the second node and each remotely-located one of the plurality of peer networking devices;

an adaptive networking module disposed at the at least two of the plurality of nodes and operable to receive actual performance data or actual security data associated with a corresponding one of the plurality of peer networking devices, each adaptive networking module further operable to generate new networking device configuration data based on the actual performance data or the actual security data and based on determining that the new networking device configuration data improves local networking device performance or security and remotely-located networking device performance or security by taking into account the plurality of networking device configuration data of both the local networking device and the plurality of remotely-located peer networking devices, wherein the new networking device configuration data is different from the first or second plurality of sets of networking device configuration data; and

a replication module at the at least two of the plurality of nodes, wherein each replication module is operable in a two-way, decentralized manner to update the respective plurality of sets of networking device configuration data with the new networking device configuration data generated at or received at the corresponding node, and to transmit the new networking device configuration data generated at the corresponding node to another replication module at, at least, one other one of the plurality of nodes to synchronize the first plurality of sets of networking device configuration data and the second plurality of sets of networking device configuration data, wherein a local one or a remote one of the plurality of peer networking device operates or manages communications for one or more networked devices at the corresponding one of the plurality of nodes according to the new networking device configuration data.

26. The system of claim 15, wherein the first set and the second set each comprise respective security data, and wherein the replication module is operable to synchronize each networking database such that the respective security data is identical.

16. A decentralized method of managing a communications network, comprising:

maintaining a data repository at least two of a plurality of nodes each having at least one peer networking device, where each data repository comprises networking device configuration data associated with a local peer networking device and each remotely-located peer networking device at each of the plurality of nodes, wherein each peer networking device operates or manages communications for one or more networked devices at a corresponding one of the plurality of nodes according to at least a portion of the networking device configuration data;

receiving or generating, at any one of the at least two of the plurality of nodes, new networking device configuration data based on actual performance data or actual security data and based on determining that the new networking device configuration data improves local networking device performance or security and remotely-located networking device performance or security by taking into account the networking device configuration data of both the local peer networking device and the plurality of remotely-located peer networking devices, wherein the new networking device configuration data is different from the networking device configuration data; and

updating, in a two-way, decentralized manner, the networking device configuration data with the new networking device configuration data generated at or received at the corresponding node, and transmitting the new networking device configuration data if generated at the corresponding node to at least one other one of the plurality of nodes, to synchronize the networking device configuration data for the corresponding peer networking devices, wherein the local networking device or one of the remotely-located peer networking devices operates or manages communications for one or more networked devices at the corresponding one of the plurality of nodes according to the new networking device configuration data.

27. The method of claim 16, wherein the networking device configuration data comprises security-related configuration data.

17. A decentralized method of adaptive networking, comprising:

receiving, at any one of a plurality of nodes each having a corresponding one of a plurality of peer networking devices in a communications network, performance data or security data associated with the corresponding local peer networking device, wherein the plurality of peer networking devices each operates or manage communications for one or more networked devices at the respective node according to at least a portion of a plurality of networking device configuration data;

comparing, at any one of the plurality of nodes, the received performance data or security data to a standard and identifying anomalous data;

generating, at any one of the plurality of nodes, proposed performance-related networking device configuration data or proposed security-related networking device configuration data based on the identified anomalous data and based on determining that the proposed performance-related or security-related networking device configuration data improves local networking device performance or security and remotely-located networking device performance or security by taking into account the plurality of networking device configuration data of both the local peer networking device and the remotely-located ones of the plurality of peer networking devices, where the proposed performance-related networking device configuration data or the proposed security-related networking device configuration data respectively results in new performance data or new security data falling within the standard; and

causing, at any one of the plurality of nodes in a two-way, decentralized manner, synchronization of a data repository at each of the plurality of nodes and associated with each of the plurality of peer networking devices, with the proposed performance-related networking device configuration data or proposed security-related networking device configuration data generated by the local networking device or by one of the remotely-located networking devices, wherein the data repository at each of the plurality of nodes comprises the plurality of networking device configuration data for each of the plurality of peer networking devices, wherein the local networking device or one of the remotely-located networking devices operates or manages communications for one or more networked devices at the corresponding one of the plurality of nodes according to the proposed performance-related networking device configuration data or proposed security-related networking device configuration data.

18. The method of claim 17, further comprising iteratively generating the proposed performance-related networking device configuration data or proposed security-related networking device configuration data until an optimized performance-related networking device configuration data or optimized security-related networking device configuration data is achieved.

19. The method of claim 17, further comprising generating simulated performance data or simulated security data to predict the new performance data or the new security data.

28. The method of claim 17, wherein the receiving and the comparing of the performance data or the security data further comprises receiving and comparing of the security data, wherein the generating further comprises generating the proposed security-related networking device configuration data, and wherein the causing synchronization further comprises causing synchronization with the proposed security-related networking device configuration data.

20. A computer program product, comprising:

a non-transitory computer-usable medium having control logic stored therein for causing a computer to manage networking information in a decentralized manner, the control logic comprising;

first computer readable program code for maintaining a data repository at least two of a plurality of nodes each having at least one peer networking device, where each data repository comprises networking device configuration data associated with a local peer networking device and each remotely-located peer networking device at each of the plurality of nodes, wherein each peer networking device operates or manages communications for one or more networked devices at a corresponding one of the plurality of nodes according to at least a portion of the networking device configuration data;

second computer readable program code for receiving or generating, at any one of the at least two of the plurality of nodes, new networking device configuration data based on actual performance data or actual security data and based on determining that the new networking device configuration data improves local networking device performance or security and remotely-located networking device performance or security by taking into account the networking device configuration data of both the local peer networking device and the plurality of remotely-located peer networking devices, wherein the new networking device configuration data is different from the networking device configuration data; and

third computer readable program code for updating, in a two-way, decentralized manner, the networking device configuration data with the new networking device configuration data generated at or received at the corresponding node, and transmitting the new networking device configuration data if generated at the corresponding node to at least one other one of the plurality of nodes, to synchronize the networking device configuration data for the corresponding peer networking devices, wherein the local networking device or one of the remotely-located peer networking devices operates or manages communications for one or more networked devices at the corresponding one of the plurality of nodes according to the new networking device configuration data.

29. The computer program product of claim 20, wherein the networking device configuration data comprises security-related configuration data.

21. A computer program product, comprising:

a non-transitory computer-usable medium having control logic stored therein for causing a computer to adaptively manage networking information in a decentralized manner, the control logic comprising;

first computer readable program code for receiving, at any one node of a plurality of nodes having a corresponding one of a plurality of peer networking devices in a communications network, performance data or security data associated with the corresponding local peer networking device, wherein the plurality of peer networking devices each operates or manage communications for one or more networked devices at the respective node according to at least a portion of a plurality of networking device configuration data;

second computer readable program code for comparing, at any one node of the plurality of nodes, the received performance data or security data to a standard and identifying anomalous data;

third computer readable program code for generating, at any one node of the plurality of nodes, proposed performance-related networking device configuration data or proposed security-related networking device configuration data based on the identified anomalous data and based on determining that the proposed performance-related or security-related networking device configuration data improves local networking device performance or security and remotely-located networking device performance or security by taking into account the plurality of networking device configuration data of both the local peer networking device and the remotely-located ones of the plurality of peer networking devices, where the proposed performance-related networking device configuration data or the proposed security-related networking device configuration data respectively results in new performance data or new security data falling within the standard; and

fourth computer readable program code for causing, at any one node of the plurality of nodes in a two-way, decentralized manner, synchronization of a data repository at each of the plurality of nodes and associated with each of the plurality of peer networking devices, with the proposed performance-related networking device configuration data or proposed security-related networking device configuration data generated by the local networking device or by one of the remotely-located networking devices, wherein the data repository at each of the plurality of nodes comprises the plurality of networking device configuration data for each of the plurality of peer networking devices, wherein the local networking device or one of the remotely-located networking devices operates or manages communications for one or more networked devices at the corresponding one of the plurality of nodes according to the proposed performance-related networking device configuration data or proposed security-related networking device configuration data.

30. The computer program product of claim 21, wherein the code for receiving and the code for comparing of the performance data or the security data further comprises code receiving and code comparing of the security data, wherein the code for generating further comprises code for generating the proposed security-related networking device configuration data, and wherein the code for causing synchronization further comprises code for causing synchronization with the proposed security-related networking device configuration data.