KR20030075903A - Policy based network system for minimizing policy application loss and running method thereof - Google Patents

Abstract

PURPOSE: A policy-based network system for minimizing the loss of policy enforcement and a method for operating the same are provided to minimize the loss of policy enforcement by supplying policy data to a policy client using a caching technique, even though a policy server fails to access a policy cache. CONSTITUTION: A policy-based network system is comprised of a PDP(Policy Decision Point)(104), a policy warehouse(105), and a PEP(Policy Enforcement Point)(102). The PEP(102), a policy client, having two interfaces for a sending terminal(101) and a receiving terminal(103), transfers data from the sending terminal(101) to the receiving terminal(103). The PDP(104), a policy server, decides the policy of the PEP(102) through a continuous connection with the PEP(102). In response to a policy decision request from the PEP(102), the PDP(104) searches the policy warehouse(105) for suitable policy data using an LDAP(Lightweight Directory Access Protocol). The PDP(104) comprises a cache warehouse(114) storing high-priority policy data for policy decision.

Description

Policy based network system for minimizing policy application loss and running method

The present invention relates to a policy-based network system, and more particularly, to a policy-based network system and its operation method for minimizing the loss of policy application using a caching technique.

In general, the Common Open Policy Service (COPS) protocol is used to construct a policy-based network. Policy Enforcement Points (PEPs), which are policy clients, and Policy Decision Points (PDPs), which correspond to policy servers, make policy decisions through persistent connections. Check it. In addition, the policy server (PDP) uses the Lightweight Directory Access Protocol (LDAP), which is a directory service protocol, to search policy data in a policy store according to a query condition, and has a basic structure that responds to a request from a policy client (PEP).

However, in the following cases, there is a problem in guaranteeing the quality of service of a policy-based network. First, when the Transmission Control Protocol (TCP) connection between the Policy Server (PDP) and the Policy Client (PEP) is terminated or lost, a timeout occurs and the Policy Server (PDP) must disconnect the Policy Client (PEP). At this point, the Policy Server (PDP) must handle the request state associated with the request / decision exchange of the Policy Client, and must send a Client Exit message to the Policy Client (PEP) with an Error <Error> object indicating an error. In this case, the user cannot be guaranteed the quality of service while the connection between the policy client (PEP) and the policy server (PDP) is not established.

If the policy decision is delayed Before the policy server (PDP) decision arrives, the policy client (PEP) must make a policy decision based on the policy of its local PDP (LPDP). However, the relevant standard of the Internet Engineering Task Force (IETF) standardization organization (RFC 2748) does not precisely define the operation of the local policy server (LPDP), and related research is currently in progress.

On the other hand, communication between the policy store and the policy server is made through the LDAP protocol as described above. The policy server (PDP) sends a policy query to the policy store using the LDAP protocol, receives the query result from the policy store, and notifies the policy client of the content. In this case, even if there is no communication problem between the user, the policy client (PEP), and the policy server (PDP), if there is no response from the policy server (PDP), no policy decision is made, and client application loss may occur. Error handling procedures are not standardized. In addition, the result of the policy query between the policy store and the policy server (PDP) is delayed depending on the load of the network, or late, or even when communication is lost, the policy decision content cannot be delivered to the policy client (PEP). In this case, if the contents temporarily stored in the local policy server (LPDP) of the policy client (PEP) are not updated or the local policy server (LPDP) service is not provided, the policy request is not made and the service requested by the user is not made. The problem arises that it is not provided.

The first technical problem to be achieved by the present invention is to provide the policy client with policy data for policy decision of the policy client by referring to the cached policy data even if the policy server cannot access the policy store by using a caching technique. The present invention relates to a policy-based network system and a method of operating the same, which can minimize application loss.

The second technical problem to be achieved by the present invention is to provide a method for caching the policy data in a policy server of the policy-based network system.

A third technical problem to be achieved by the present invention is to provide a recording medium recorded with a program code executable on a computer for the policy-based network system operating method.

A fourth technical object of the present invention is to provide a recording medium in which the policy data caching method is recorded in a program code executable by a computer.

1 is a diagram schematically showing a policy based network system according to the present invention.

2 is a diagram illustrating an example of connection establishment between the policy server 104 and the client server 102 in the system shown in FIG. 1.

FIG. 3 is a diagram illustrating a structure according to a policy group of the policy store 105 illustrated in FIG. 1.

4 is a diagram illustrating a structure of a policy rule of the policy store 105 shown in FIG. 1.

5 is a diagram illustrating an operation for minimizing a policy application loss according to the present invention in the system shown in FIG.

FIG. 6 is a diagram for describing a process of updating data cached in the cache storage 114 illustrated in FIG. 1.

7 is a flowchart illustrating an operation process of FIG. 6 in more detail.

In order to achieve the first task, the policy-based network system according to the present invention includes a policy store storing policy data defining a method of allocating network resources. The policy-based network system according to the present invention provides policy data for setting a network environment for data transmission between a sender and a receiver. Requested policy data from the requesting policy client and the policy client are connected to the policy store to extract and send the requested policy data to the policy client, and cached policy data if the policy store is heavily loaded or unreachable. It is preferable to include a policy server for extracting the requested policy data from the policy client with reference to.

In order to achieve the first task, in the policy-based network system including a policy server and a policy server storing policy data defining a policy client, a method of allocating network resources to the policy clients, a policy server controlled by the policy server. In the policy-based network operation method according to the present invention for minimizing losses, when a policy decision request is made from a policy client, the policy store is accessed to extract policy data for policy decision of the policy client, and the extracted policy data is transmitted to the policy client. (B) caching the transmitted policy data when it is confirmed that the network environment of the policy client is succeeded according to the policy data transmitted in steps (a) and (a), and (b) Policy client with reference to the policy data cached in step (C) performing the policy decision requested from the client.

In order to accomplish the second task, in a policy-based network system including a policy client, a policy store storing policy data, and a policy server, the policy server searches for a policy store by referring to a policy store by a policy decision request from a policy client. The caching method according to the present invention of the policy data having a priority of is (a) determining whether the storage space to be cached is empty, and if the storage space to be cached is empty, caching the policy data to be cached to the empty storage space. step (b), if the storage space to be cached is not empty, comparing the priorities of the currently cached entries with the policy data to be cached, and (c) the priority of the policy information to be cached is currently cached. If lower than the entries, step (d) not caching the policy data to be cached and If the priority of the policy information is higher than the entries currently cached, selecting and deleting the entries to be deleted among the entries currently cached, and caching the policy data to be cached in the deleted space. desirable.

Hereinafter, a policy-based network system and an operation method thereof according to the present invention will be described with reference to the accompanying drawings.

1 is a diagram schematically illustrating a policy-based network system according to the present invention, and includes a policy server (PDP) 104, a policy store 105, and a policy client (PEP) 102. The sender terminal 101 and the receiver terminal 103 are shown together.

With reference to FIG. 1, policy client 102 and policy server 104 use COPS protocol 110, which operates over TCP and communicates using port number 3288. The COPS protocol includes various services such as Resource Reservation Protocol (RSVP), DiffServ, Session Initiation Protocol (SIP), Multi-Protocol Label Switch (MPLS), and Mobile according to the client-type of the policy client 102. Provide a protocol. The policy client 102 has two interfaces 112 and 113 for the sender terminal 101 and the receiver terminal 103, and transfers data from the sender terminal 101 to the receiver terminal 103.

The policy server 104 determines the policy of the policy client 102 through a persistent connection with the policy client 102. In addition, the Policy Server (PDP) has a basic structure of responsive to the policy decision request of the policy client 102 after retrieving the policy data from the policy store according to the query condition using the Lightweight Directory Access Protocol (LDAP), a directory service protocol. .

Meanwhile, the policy server 104 includes a cache store 114 as shown in FIG. 1. The cache store 114 stores policy data that has been recently used or has a high priority in policy making. The policy server 104 is one of the easiest ways to improve performance by using the cache store 114 when a server suddenly stops or a transmission delay occurs. If, when the communication between the policy server 104 and the policy store 105 is lost, the request data of the policy client 102 is in the cache store 114, the policy server 104 may reconnect with the policy store 105. This is because the request data of the policy client 102 can be read from the cache store 114.

On the other hand, the data retrieval in the cache storage 114 is made using a hash function (hash function). The policy server 104 uses a special queue, a hash queue, to retrieve data using a hash function, which consists of a dual link list structure and a hash map.

2 is a diagram illustrating an example of connection establishment between the policy server 104 and the client server 102 in the system shown in FIG. 1.

Referring to FIGS. 1 and 2, the policy client 102 delivers a <Client-Open> message to the policy server 104 with a predetermined client type (201). If the policy server 104 supports the client type of the policy client 102, it responds with a connection establishment confirmation <Client-Accept> message (202). However, if policy server 104 does not support the client type of policy client 102, it sends a <Client-Close> message to policy client 102.

The policy client 102 may make a policy request to the policy server 104 if a <Client-Accept> message is sent from the policy server 104. Accordingly, the policy client 102 sends a <Request> message including the current information to the policy server 104 to make a policy request (204). The policy server 104 requests the retrieval of policy queries to the policy store 105, and sends a retrieval of policy queries from the policy store 105 to send a policy decision message of approval or rejection to the request of the policy client 102. Receive the result. At this time, communication between the policy server 104 and the policy store 105 is performed by the LDAP protocol 111. The policy server 104 negates the current policy request from the policy client 104 if there is no client type option in the message sent from the policy client 104, or if there is no query result content from the policy store 105. Send a <Decision> message (205). On the other hand, when the policy client 102 receives an acknowledgment <Decision> message from the policy server 104, the policy client 102 sends a <Report> message to the policy server 104 as a result of a successful environment installation or decision. Transmit 206. However, if the configuration fails or requests for cancellation of the request, the message <Delete Request State> is transmitted to the policy server 207 (207).

FIG. 3 is a diagram illustrating a structure according to a policy group of the policy store 105 illustrated in FIG. 1.

1 and 3, the directory service of the policy store 105 is stored in one entry whether or not the directory is distributed. An entry consists of a set of attributes, each of which has a number of attribute types, such as country name, organization name, and department name. Each group has a policy group 301 that includes the entire group, and a small group 302, 303, and 304 that has each characteristic. It consists of a tree structure with the inclusion relationship of.

4 is a diagram illustrating a structure of a policy rule of the policy store 105 shown in FIG. 1.

Referring to FIGS. 1 and 4, the attribute entry for the policy group may include a policy condition corresponding to a policy rule 401, a policy action 402, a policy action 403, and a policy execution time. Policy Time period: 404). The policy-based network operates according to the policy rule criteria of the network basis. Therefore, the policy server 104 retrieves the policy requirements for the query in the policy store divided into a tree structure and a policy group, and delivers the search result values to the policy client 102.

5 is a diagram illustrating an operation for minimizing a policy application loss according to the present invention in the system shown in FIG.

Referring to FIG. 5, communication between the policy server 104 and the cache store 114 may operate without provision of a separate message protocol. The policy decision request 504 of the policy client 102 is forwarded to the policy server 104. If the communication between the policy server 104 and the policy store 105 is lost, the policy server 104 requests the policy store retrieval 506 from the cache store 114 to prevent the loss of policy requests, and the cache store ( 114 receives a policy query response 507 on behalf of policy store 105. The policy server 104 makes a policy decision on the policy client 102 based on the query response result of the cache store 114 (505). That is, if there is policy query data in the cache store 114, it sends an acknowledgment <Decision> message to the policy client 102. However, if there is no policy query data in the cache store 114, the policy server 104 may send a negative < Decision > message to the policy client 102 or attempt to connect with another policy server 104. 102).

Even though the result of the policy query between the policy store and the PDP is delayed depending on the load of the network, the policy data stored in the cache store 114 may not be delivered even if the policy decision for the policy client 102 cannot be delivered when communication is lost. By using this, it is possible to minimize the loss of policy application of the policy client 102.

FIG. 6 is a diagram for describing a process of updating data cached in the cache storage 114 illustrated in FIG. 1.

Referring to FIG. 6, when policy information is cached in the cache store 114 of the policy server 104, a policy <Report> message indicating that the policy client has successfully confirmed the policy decision and has been set is configured. Notifying 104, policy server 104 attempts to cache policy registration 704, that is, policy data, in cache store 115. As such, the policy server 104 checks the configuration of the policy client 102, and then registers the policy in the cache store 114. The success of the configuration of the policy client may have a high hit rate of the result of the next policy query. In addition, to reduce the load on the policy server 104 due to frequent information storage and updates to the cache store 114.

Meanwhile, the cache store 114 checks the stored entries and updates the cache information data. The policy server 104 caches the policy decision content requested by the policy client in the client information <ClientSI> message of the COPS protocol. Cache in the storage 115 in a predetermined manner. For example, policy data to be cached succeeds or fails to be cached depending on whether there is storage space in the cache store 114 or whether the policy data to be cached has a higher priority than entries currently cached. can do. The caching method of the policy server 104 is described in detail with reference to FIG.

7 is a flowchart illustrating an operation process of FIG. 6 in more detail.

Referring to FIGS. 6 and 7, the policy server 104 first retrieves data contents obtained from the policy store by referring to query contents in a client information <ClientSI> message of the policy client for caching in the cache store 114. At this time, if it is determined whether the policy execution time is the data before the current time (step 800), and if the policy execution time is the data before the current time, it does not belong to the policy decision and does not cache because the policy execution is over. That is, it can be determined by referring to the policy rule for the policy execution time with reference to FIG. If the policy execution time is not the data before the current time in step 800, it is determined whether there is a cacheable storage space in the cache storage 114 (step 810). If there is a storage space to be cached in operation 810, the policy policy data to be cached is stored in the cache storage station 114 (operation 860).

If it is determined in step 810 that there is no storage space to be cached, the priority of the policy data to be cached is compared with entries currently cached (step 830). If the priority of the policy data to be cached is lower than the current entry in operation 830, the policy data is not cached (operation 820).

If the priority of the policy data to be cached is higher than the current entry in operation 830, the policy server 104 searches for policy execution timed out data by comparing an entry with a lower priority or the current time in the cache table list (operation 840). ). In step 840, the policy server 104 deletes the retrieved low priority data or policy execution timed out data to provide a storage space (step 850). In operation 860, the policy data is stored in a storage space provided in operation 850.

The invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, which are also implemented in the form of a carrier wave (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

The best embodiments have been disclosed in the drawings and specification above. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, according to the policy-based network system and its operation method for minimizing the loss of policy application according to the present invention, it is possible to increase the reliability of the response by storing the policy application data for the policy query of each policy client in the cache store. Therefore, it is possible to guarantee quick query response and QoS of user and smooth network flow control between policy server and policy client.

Claims (8)

A policy-based network system including a policy store storing policy data defining a method of allocating network resources. A policy client for requesting policy data necessary for setting a network environment for data transmission between a sender and a receiver; And The policy data requested from the policy client is connected to the policy store to extract and transmit the requested policy data to the policy client, and the cache is stored. If the load of the policy store is large or impossible to access, the cached policy is stored. And a policy server for extracting the requested policy data from the policy client by referring to the data. The method of claim 1, wherein the policy server And transmit the requested policy data to the policy client and cache the requested policy data when a message indicating that the network environment setting based on the requested policy data is successful is transmitted from the policy client. Based network system. 3. The policy-based network system of claim 2, wherein the policy server caches the requested policy data according to a policy group priority and a predetermined policy rule defined by a policy manager. In a policy-based network system including a policy client, a policy store storing policy data defining a method of allocating network resources to the policy clients, and a policy server, a policy for minimizing the loss of policy application controlled by the policy server. In the method of operating the underlying network, (a) if a policy decision request is made from the policy client, accessing the policy repository to extract policy data for policy decision of the policy client, and transmitting the extracted policy data to the policy client; (b) caching the transmitted policy data when it is confirmed that network configuration of the policy client is successful according to the policy data transmitted in step (a); And (c) performing a policy decision requested from the policy client by referring to the policy data cached in the step (b) when not connected to the policy store. Based network operation method. The method of claim 4, wherein step (b) (b1) receiving a report message indicating that the configuration is successful from the policy client; And (b2) if the report message is received, caching according to a priority and a predetermined policy rule between the policy data transmitted in the step (a) and the already cached policy data, and minimizing the policy application loss. Policy-based network operation method for The method of claim 5, wherein step (b2) (b21) determining whether the storage space to be cached is empty; (b22) if the storage space to be cached is empty, caching the policy data to be cached in the empty storage space; (b23) if the storage space to be cached is not empty, comparing priorities of entries currently cached with the policy data to be cached; (b24) if the priority of the policy information to be cached is lower than entries currently cached, not caching the policy data to be cached; And (b25) If the priority of the policy information to be cached is higher than entries currently cached, select and delete an entry to be deleted among the currently cached entries, and cache the policy data to be cached in the deleted space. Policy-based network operating method for minimizing the loss of policy enforcement, comprising the steps of. The method of claim 6, wherein before step (b21) Determining whether the policy information to be stored has passed a specified policy execution time, and if the policy data has passed the specified policy execution time, not caching the policy information, further comprising: not caching. . 7. The method of claim 6, wherein the selection of the entry to delete is (e1) searching for and deleting an entry exceeding a policy execution time among entries currently cached, and caching the policy data to be cached in the deleted space; And (e2) if there is no entry exceeding policy execution time, searching for and deleting the lowest priority entry among the currently cached entries, and caching the policy data to be cached in the deleted space. Policy-based network operation to minimize the loss of policy enforcement.