JPH0622028A - Management system in communication network - Google Patents

Abstract

PURPOSE:To attain access control up to each subscriber level in each network element with respect to the management system used to manage each network element individually in the communication network including plural network elements interconnected by a data link. CONSTITUTION:In order to build up the network management system to be managed under an object oriented way, each network element is decomposed into at least an agent processor 11 in the instance unit and a managed object 12 in the unit of instance managed directly by the agent processor 11 and each command publicated from each agent processor 11 to each managed object 12 is subjected to access control.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a management system for individually managing each network element in a communication network including a plurality of network elements interconnected by data links. A communication network usually has a structure in which a large number of network elements (transmission or communication devices) are connected in a mesh by data links.

In the case of individually managing such network elements, for example, in the case of monitoring or adding control from the outside, typically, a switch mounted in a part of a unit forming each network element, for example, It has been performed that a DIP switch or a pin is operated to arbitrarily set a control state, or conversely, monitoring is performed from the set state of these switches or the like.

Thereafter, the use of a central processing unit (CPU) has become active, and the above management has been performed by mounting the CPU in each network element. That is, the CPU is provided with an appropriate program or database to monitor or control the network element.

[0004]

2. Description of the Related Art FIG. 6 is a flowchart showing the basics of conventional access control. In the figure, step user identification information is input. The user can access the CPU in the network element of the user by using a terminal such as a personal computer, and monitor and control the network element. At this time, no one other than the user is allowed to access this network element. This is to prevent a malicious person from damaging the network element.

Therefore, in the conventional access control, first, the above-mentioned user identification information is input. The user identification information is information indicating whether or not the input is made by a person who is authorized to start the program of the personal computer, and is, for example, "LOGON" or "PASSWORD". If the user identification information registered in advance in the step personal computer and the user identification information input just now match (OK), the access control proceeds to the subsequent operation, and if they do not match, the original (step) returns. .

Step Due to the coincidence, the personal computer inputs a command to the CPU in the network element. This command is various commands related to management. Step The CPU in the network element executes the command given in Step, and when the execution is completed,
Wait for next command input.

[0007]

The conventional access control shown in FIG. 6 extends only to the network element itself. In other words, access control does not extend to the step command itself.
By the way, in recent years, management in communication networks has further advanced, and there is a tendency that programs and databases are supplied to the CPU in the above-mentioned network element remotely, for example, from a central office. In this case, the transfer of programs and databases from the remote to the CPU of each network element is performed via the data communication unit (DCN).
A so-called public network is actually used as N.

Here, a network management system is completed between the central office and each network element via the public network. As a result, the service provider, that is, the telephone company can provide a new service in which the telephone company performs the network management, which should be originally performed by the user (subscriber), on behalf of the user. Thus, the intra-user network is partly under the control of the service provider (telephone company) through the remote control. However, it may be inconvenient if this in-user network is completely under the control of the service provider. This is an inconvenience when performing maintenance, especially urgent maintenance. For example, when a failure occurs in the network in the building where various subscribers live, the central office is required to quickly recover from this failure. There is a limit to remote control from.

Then, it is convenient if the user can individually access the communication equipment of each subscriber in order to isolate the failure location when recovering from the failure. The term "communication device" as used herein means, for example, to multiplex and send low-speed digital signals from each subscriber to a high-speed communication network and to separate and supply low-speed digital signals to each subscriber from the high-speed communication network. It is a multiplexer / demultiplexer provided for each subscriber.

However, if the user can freely access the communication equipment of each subscriber as described above, security becomes a problem this time. Security means that each user can touch only the communication device of each subscriber from the personal computer for network management, and prevent one subscriber from touching the communication device of another subscriber. is there.

Therefore, in view of the above problems, it is an object of the present invention to enable access control not only to the network element of each user but also to the level of each subscriber in this network element.

[0012]

FIG. 1 is a system block diagram modeled based on the management system of the present invention. According to the present invention, the network management system described above is
Build under what is called object-oriented. Therefore, in the network management system shown in the figure, each network element (NE: Network Element) 10 is at least an agent processor 11 for each instance.
Also, it is decomposed in advance into managed objects 12 in units of instances that are directly managed by the agent processor 11, and access control is performed for each command issued to each managed object 12 from each agent processor. An object is an abstraction of the function to be managed, and is defined on this network management system.

The agent processor 11 mentioned here corresponds to the above-mentioned personal computer. The managed object 12 corresponds to the communication device corresponding to each subscriber described above. Further, the command corresponds to the command shown in the step of FIG. The above instance unit is one of the basic elements that make up the object-oriented world, and is a word for "class". A "class" is a group of objects that have common properties and is named as such, and each object is an instance of the class.

[0014]

The present invention enables the access control of the above command by the object-oriented model. That is, the conventional access control extends only to the network element itself as described in FIG. 6, but the present invention extends the access control to the command itself. In this way, each subscriber can only access his or her own objects and disable access to other subscribers' objects. The security problem described above is solved.

Referring to FIG. 1, for example, three subscribers are
Only the respective managed objects 12 can be touched, and the managed objects 12 of other subscribers cannot be touched. According to the example of the figure, the first subscriber is via the central office OS (Operating System), the second subscriber is via the controller CONT, and the third subscriber is the CID (Craft Interface Device). ) Via the agent processor 11 to access the corresponding managed object 12 in the network element 10 of a certain user.

FIG. 2 is a flowchart showing an example of access control for commands, which is shown in FIG.
The steps, steps, steps and steps in the flowchart are common. FIG. 3 is a diagram showing that steps (a), (b) and (c) in FIG. 2 add access control to each command.

However, in the present invention, only step (b) is established, but from the viewpoint of perfection of security, it is preferable that both step (b) and step (c) are present. Therefore, in this figure, step (a) includes both step (b) and step (c). The operation is as follows.

I) The agent processor 11 uses the user identification information and the managed object 1 for determining whether or not the managed object 12 is permitted to execute each command for access control.
When a correspondence map (for example, consisting of RAM) with 2 is stored in itself and referred to, and the correspondence between the inputted user identification information (see step) and the managed object is obtained. Only, the execution of the command is permitted (from step (b) in FIG. 2 directly to step).

Ii) The agent processor 11 further determines, for the above access control, whether or not the service provided by executing each of the commands is a service permitted to be provided to the user. In order to do this, the user has a correspondence map (for example, consisting of RAM) between the user identification information and the provided service, and refers to this map, and the input user identification information (see step) and the provision Execution of the command is permitted only when a correspondence is made with the service to be performed (step (c) to step).

Iii) Furthermore, by the agent processor 11 changing the contents of the above correspondence map,
The contents of the access control can be variable.

[0021]

FIG. 3 is a diagram showing an embodiment of a network management system modeled based on the management system of the present invention. In the figure, the network element 10, the agent processor (AP) 11, and the managed object (MO) 12 are as described above, and the plurality of network elements are connected by the data link 13.

In each network element 10,
The symbol MP represents a Managing Processor, and, for example, when an operator performs maintenance work, maintenance information is presented to the operator through this MP. Also,
NEF is a Network Element Functoin in which the object MO is located, and MSS is Managemen.
t Sub-System, in which AP 11 and MP are positioned, and MCS is Message Communication Sub-System
The data link 13 is connected therethrough, and is also connected to the workstation WS or the personal computer PC of the central office through the port indicated by F in the figure. Each network element 10 can be remotely operated through this WS / PC. Note that the line between Fs is omitted.

If these network elements 10 are located at the upper end of the hierarchy, there are, for example, three control nodes on the high side of the hierarchy and between these,
And between these and the network element Q1 /
Connected at 2/3. Q1 / 2/3 is the name of communication software defined in advance. There are practically many kinds of specific hardware that constitutes the above-mentioned network element in a communication network. For example:

FIG. 4 is a diagram showing a first specific example of the network element. The example in this figure shows a so-called gateway. For example, considering a case where a large number of subscribers 22 in a certain area share a high-speed digital line 28 through each subscriber line 23, the gateway 2 is provided between them.
1 is required. This gateway can be placed under the control of this central office by remote control from the central office already mentioned. As a result, the central office can provide services with even higher added value.

However, since the access by each subscriber must be permitted as described above, this gateway 2
A personal computer 27 corresponding to each subscriber is attached to the vehicle 1 via the bus 26. Each subscriber can access the multiplexer / demultiplexer (M / D: MUX / DMUX) device 24 through the personal computer 27. In this case, it is desirable to go through the MP (25 in the figure) described above.

If necessary, for example, subscribers in other regions within the same company can access each device 24 via a DSU (Digital Service Unit). When the hardware as shown in FIG. 4 is modeled as a network management system, the PC 27 is an agent processor (A
P), the multiplexer / demultiplexer 24 manages the managed object (M
O), the line 28 corresponds to the data link 13.

FIG. 5 is a diagram showing a second specific example of the network element. The example in this figure is a new synchronous network (North American S
One drop / insertion station 31 in ONET), which constitutes a network element. Among them, four managed objects (MO) are optical / electrical conversion interface 32, tertiary group interface 3
3, 34, and an electric / optical conversion interface 35. OC-12 is 12 Optical Carr as an example.
Indicates ier.

[0028]

As described above, according to the present invention, it is possible to realize a network management system capable of individually and exclusively accessing some functional blocks in a communication device. For example, regarding the maintenance and management of a communication device in a company,
The managed objects that can be accessed and the range of services that can be used can be individually limited for each group or each individual. Therefore, it is possible to achieve both the individual management and the remote management from the central office while ensuring the security.

Since the individual management described above can be performed by the above-mentioned map, simply by rewriting the contents of the map,
It is easy to change and update individual management. Also, by referring to the contents of the map, the service provided by each subscriber becomes clear, and it becomes easy to confirm the service charge.

[Brief description of drawings]

FIG. 1 is a system block diagram modeled based on a management system of the present invention.

FIG. 2 is a flowchart showing an example of access control for commands.

FIG. 3 is a diagram showing an embodiment of a network management system modeled based on the management system of the present invention.

FIG. 4 is a diagram showing a first specific example of a network element.

FIG. 5 is a diagram showing a second specific example of a network element.

FIG. 6 is a flowchart showing the basics of conventional access control.

[Explanation of symbols]

 10 ... Network element 11 ... Agent processor 12 ... Managed object 13 ... Data link

Claims (4)

[Claims] 1. A management method for individually managing each network element in a communication network comprising a plurality of network elements (10) connected to each other by a data link (13), wherein the management is performed. In order to construct a network management system in an object-oriented manner, each of the network elements is preliminarily divided into an instance-unit agent processor (11) and an instance-unit managed object (12) directly managed by the agent processor. A management method in a communication network characterized by disassembling and controlling access to each command issued from each agent processor to each managed object. 2. The agent processor (11)
Is a managed object (1 that is allowed to execute each of the commands for the access control.
2) In order to determine whether it is 2) or not, the user has a correspondence map between the user identification information and the managed object, and refers to this map to input the user identification information and the managed object. The management method according to claim 1, wherein execution of the command is permitted only when the correspondence between the command and the command is taken. 3. The agent processor (11)
Is provided with the user identification information for determining whether or not the service provided by the execution of each command is a service permitted to be provided to the user for the access control. It has its own correspondence map with the service to refer to, and only when the correspondence between the input user identification information and the provided service is taken, execution of the command is permitted. The management system according to claim 2. 4. The management method according to claim 3, wherein the agent processor changes the contents of the access map by changing the contents of the correspondence map.