WO2001019031A1 - Extensible policy-based network management architecture - Google Patents

Extensible policy-based network management architecture Download PDF

Info

Publication number
WO2001019031A1
WO2001019031A1 PCT/US2000/022792 US0022792W WO0119031A1 WO 2001019031 A1 WO2001019031 A1 WO 2001019031A1 US 0022792 W US0022792 W US 0022792W WO 0119031 A1 WO0119031 A1 WO 0119031A1
Authority
WO
WIPO (PCT)
Prior art keywords
pep
message
policy
sending
pdp
Prior art date
Application number
PCT/US2000/022792
Other languages
French (fr)
Inventor
David M. Putzolu
Rajendra Yavatkar
Original Assignee
Intel Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Intel Corporation filed Critical Intel Corporation
Priority to EP00957591A priority Critical patent/EP1214814A1/en
Priority to AU69188/00A priority patent/AU6918800A/en
Publication of WO2001019031A1 publication Critical patent/WO2001019031A1/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0893Assignment of logical groups to network elements
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0803Configuration setting
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08Configuration management of networks or network elements
    • H04L41/0894Policy-based network configuration management

Definitions

  • the present invention relates generally to management of networks of computer systems and, more specifically, to policy-based network management (PBNM).
  • PBNM policy-based network management
  • PBNM Policy-based network management
  • PBNM Policy-based network management
  • Policies are human-readable, simple to express propositions that dictate what actions and behaviors are permitted on a computer network.
  • a network administrator can express a set of policies governing the network. For example, one policy might be "allow members of the engineering department to reserve 100 Kbits/s of network bandwidth between the hours of 9:00 AM and
  • IP Internet Protocol
  • COPS Common Open Policy Service
  • IETF Internet Engineering Task Force
  • the COPS protocol describes a client/server model for supporting policy control over Quality of Service (QoS) signaling protocols and provisioned QoS resource management.
  • QoS Quality of Service
  • policies In the COPS protocol, clients, called policy enforcement points (PEPs), relay information about network resource requests to policy decision points (PDPs), which interpret policies so as to determine whether a request for network service should be honored or not. More generally, policies consist of sets of conditions that must be met before certain actions can be taken.
  • PBNM provides a powerful means of managing computer networks
  • its static definition of the mechanisms that can be managed and the actions that can be decided on makes it slow to respond to the rapid evolution of network services and capabilities that is taking place.
  • the local scope of PBNM conditions and actions tend to limit the network-wide utility of PBNM to solving those problems which do not require access to the global state of the network.
  • An embodiment of the present invention is a method of extending the capabilities of a network with a policy-based network management (PBNM) architecture.
  • the method includes sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) in response to an external action, and sending a Java object in a second message from the PDP to the PEP in response to receiving the first message.
  • PEP policy enforcement point
  • PDP policy decision point
  • Another embodiment of the present invention includes sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) requesting configuration of conditions, sending a Java object in a second message from the PDP to the PEP in response to receiving the first message, and executing the Java object on the PEP to configure conditions controlling the sending of messages from the PEP to the PDP.
  • PEP policy enforcement point
  • PDP policy decision point
  • Figure 1 is a diagram of a policy enforcement point interacting with a policy decision point for dynamic policy actions according to an embodiment of the present invention
  • Figure 2 is a diagram illustrating dynamic policy conditions according to an embodiment of the present invention
  • Figure 3 is a diagram illustrating dynamic policy conditions taking into account network-wide state information according to an embodiment of the present invention.
  • Figure 4 is a diagram illustrating a sample processing system capable of being operated as a policy decision point according to an embodiment of the present invention.
  • JVMs Java Virtual Machines
  • An embodiment of the present invention extends the current policy- based network management (PBNM) architecture by utilizing the benefits afforded by the Java programming language and JVMs.
  • An embodiment of the present invention allows network administrators and PBNM vendors to programmatically extend the set of conditions and actions that may be incorporated into policies in a PBNM system. In one embodiment, this extension may be accomplished using the Common Open Policy Service (COPS) protocol, although other embodiments may use other protocols.
  • COPS Common Open Policy Service
  • One embodiment of the present invention uses the COPS protocol to carry Java objects (e.g., self-contained programs) between policy decision points (PDPs) and policy enforcement points (PEPs). This usage of the COPS protocol to carry dynamic, executable programs rather than static configuration and decision information is a powerful extension to the concept of PBNM.
  • the Java objects communicated by this architecture are fully programmable, network aware applications, the objects have the ability to contact and coordinate with other instances of such applications (executing on other nodes within the network), thereby providing a greater degree of inter-PEP communication than before.
  • the PEPs may use a richer set of conditions for policy evaluation and implement a more powerful set of actions for manipulating the state of the network.
  • FIG. 1 is a diagram of a policy enforcement point interacting with a policy decision point for dynamic policy actions according to an embodiment of the present invention.
  • a policy enforcement point (PEP) 10 may be a dedicated device for providing network functionality that implements a policy in a PBNM system architecture.
  • the PEP may comprise a network router, a switch, or a firewall.
  • a PEP may be a client in a client/server model, such as is used in the COPS protocol.
  • a policy decision point (PDP) 12 correlates policy information to instruct one or more PEPs in handling network packets or otherwise providing network services.
  • a PDP may be a server in the client/server model.
  • the PDP may be a general purpose computer system. There may be one or more PDPs and one or more PEPs in this network architecture. Multiple PDPs may be linked in a hierarchical fashion.
  • a PEP sends request, update, and delete messages to a PDP, and the PDP returns decision messages back to the PEP.
  • the PEP communicates with the PDP to obtain policy decisions or directives for network management.
  • the protocol uses the well-known transmission control protocol (TCP) as its transport protocol for reliable exchange of messages between the PDP and the PEPs.
  • TCP transmission control protocol
  • the protocol relies on the well-known Internet Protocol Security (IPSEC) protocol for authentication and security of the communications path between the PDP and the PEPs.
  • IPSEC Internet Protocol Security
  • the protocol is stateful in that it allows the PDP to push configuration information to a PEP, and then allows the PDP to remove such state from the PEP when it is no longer applicable.
  • the PEP is responsible for initiating a persistent TCP connection to a PDP.
  • the PEP uses this TCP connection to send requests to and receive decisions from the remote PDP.
  • Communication between the PDP and the PEP is primarily in the form of stateful request/decision message exchanges, although the PDP may occasionally send unsolicited decision messages to the PEP to force changes in previously approved request states.
  • the policy protocol is designed to communicate self-identifying objects which contain the data necessary for identifying request states, establishing the context for a request, identifying the type of request, referencing previously installed requests, relaying policy decisions, reporting errors, and transferring client specific/name space information.
  • PEP 10 sends a COPS request message 14 at run-time to PDP 12 in response to some external action within the network, such as a set of conditions requiring evaluation by the PDP.
  • the request message may include such items as common header information, a client handle, a context object containing data, and other parameters.
  • the context object may be used to determine the context within which all other message objects are to be interpreted. It also may be used to determine the kind of decision to be returned from the PDP.
  • the context object specifies the type of event(s) that triggered a query.
  • the decision may be a directive or instruction to the PEP related to admission control, resource allocation, object forwarding and substitution, or configuration.
  • PDP 12 returns a decision message 16 to the PEP.
  • the PDP downloads a Java object to the PEP to be executed on the PEP for implementation of the desired policy.
  • the Java object may contain any program written in the Java programming language to effect the desired result at the PEP.
  • the PEP must include a Java Virtual Machine (JVM) for supporting execution of the Java object received from the PDP.
  • JVM Java Virtual Machine
  • a COPS configuration request object (carried in a context object within a request message sent by the PDP to a PEP at initialization time) may be used to download a set of Java programs from a PDP to a PEP such that the conditions used to trigger issuance of request messages by the PEP are programmable as well.
  • the Java application programs installed at the PEPs are able to interact both with each other and with other devices (PEPs or other devices) in the network to evaluate conditions and implement actions.
  • Figure 2 is a diagram illustrating dynamic policy conditions according to an embodiment of the present invention.
  • a PEP 10 sends a COPS request message 18 to a PDP 12 requesting configuration within a context object.
  • a PEP may request to receive named configuration information from the PDP in this way.
  • This named configuration data may be in a form useful for setting system attributes on a PEP, or it may be in the form of policy rules that are to be directly verified by the PEP.
  • the PDP sends a Java object to the PEP in a decision message 20.
  • the Java object when executed at the PEP, configures the conditions for subsequent policy evaluation. In one embodiment, these actions may be performed at network initialization time. In alternate embodiments, the Java object sent to the PEP may perform any desired processing and not be limited to configuration functions.
  • FIG. 3 is a diagram illustrating dynamic policy conditions taking into account network-wide state information according to an embodiment of the present invention.
  • a PEP 10 sends a COPS request message 22 at initialization time to PDP 12 requesting configuration within a context object.
  • the PDP sends a Java object to the PEP in a decision message 24. This first Java object configures conditions for policy evaluation by the PEP.
  • an event occurs at PEP 10 triggering run-time evaluation of policy conditions.
  • the PEP then sends another request message to the PDP.
  • the PDP sends another Java object to the PEP.
  • This second Java object then executes on this PEP.
  • the second Java object is able to examine and manipulate network state information at another PEP 26 or other node in the network as part of evaluating policy conditions.
  • the first and second Java objects may be sent to the PEP together at initialization time, or may be the same object.
  • embodiments of the present invention use delivery of Java programs from a PDP to a PEP to allow dynamic extension of both the actions taken in execution of policies, as well as the conditions used to evaluate whether an action should be taken or not. This allows PEPs to be more flexible both in actions and conditions they support and the classes of problems that can be addressed.
  • a monitoring system may be designed which employs a PBNM system along with the extensions defined in the present invention.
  • the monitoring system may allow policies to be created which specify the maximum latency that a particular data flow will experience between two endpoints in a network.
  • An example of the use of such a configuration may be a person who accepts telephone orders and enters the orders into an order entry system, where the network latency between the person's personal computer (PC) system or order entry terminal and the server system that executes the order entry system should be kept low in order to ensure prompt customer order entry.
  • a Java object may be installed on each PEP to monitor the latency of packets from the indicated flow experience as the packets traverse the PEP.
  • the Java object may also communicate with the objects of other PEPs in a transmission path (e.g., its neighbor objects) in order to determine total end-to-end latency.
  • the objects at the PEPs with the higher latency may communicate with their neighbor objects, asking the neighbors to divert non-critical traffic to other routes to reduce latency.
  • Embodiments of the present invention may be implemented in hardware or software, or a combination of both. However, embodiments of the invention may be implemented as computer programs executing on programmable systems comprising at least one processor, a data storage system (including volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device. Program code may be applied to input data to perform the functions described herein and generate output information. The output information may be applied to one or more output devices, in known fashion.
  • a processing system embodying the PDP or PEP includes any system that has a processor, such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • the programs may be implemented in a high level procedural or object oriented programming language to communicate with a processing system.
  • the programs may also be implemented in assembly or machine language, if desired. In fact, the invention is not limited in scope to any particular programming language. In any case, the language may be a compiled or interpreted language.
  • the programs may be stored on a storage media or device (e.g., hard disk drive, floppy disk drive, read only memory (ROM), CD-ROM device, flash memory device, digital versatile disk (DVD), or other storage device) readable by a general or special purpose programmable processing system, for configuring and operating the processing system when the storage media or device is read by the processing system to perform the procedures desc ⁇ bed herein.
  • Embodiments of the invention may also be considered to be implemented as a machine-readable storage medium, configured for use with a processing system, where the storage medium so configured causes the processing system to operate in a specific and predefined manner to perform the functions described herein.
  • Sample system 400 may be used, for example, to execute the processing for embodiments of the extensible policy-based network management system, in accordance with the present invention, such as the embodiment described herein.
  • One or more of the PDP and PEP may be implemented on a sample system.
  • Sample system 400 is representative of processing systems based on the PENTIUM®II, PENTIUM® III, and CELERONTM microprocessors available from Intel Corporation, although other systems (including personal computers (PCs) having other microprocessors, engineering workstations, other set-top boxes, switches, routers, and the like) and architectures may also be used.
  • sample system 400 may be executing a version of the WINDOWS® operating system available from Microsoft Corporation, although other operating systems and graphical user interfaces, for example, may also be used.
  • FIG. 4 is a block diagram of a system 400 of one embodiment of the present invention.
  • the system 400 includes a processor 402 that processes data signals.
  • the processor 402 may be a complex instruction set computer (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, a processor implementing a combination of instruction sets, or other processor device, such as a digital signal processor, for example.
  • CISC complex instruction set computer
  • RISC reduced instruction set computing
  • VLIW very long instruction word
  • Processor 402 may be coupled to a processor bus 404 that transmits data signals between processor 402 and other components in the system 400.
  • System 400 includes a memory 406.
  • Memory 406 may be a dynamic random access memory (DRAM) device, a static random access memory (SRAM) device, or other memory device.
  • Memory 406 may store instructions and/or data represented by data signals that may be executed by processor 402. The instructions and/or data may comprise code for performing any and/or all of the techniques of the present invention.
  • Memory 406 may also contain additional software and/or data (not shown).
  • a cache memory 408 may reside inside processor 402 that stores data signals stored in memory 406. Cache memory 408 in this embodiment speeds up memory accesses by the processor by taking advantage of its locality of access. Alternatively, in another embodiment, the cache memory may reside external to the processor.
  • a bridge/memory controller 410 may be coupled to the processor bus 404 and memory 406.
  • the bridge/memory controller 410 directs data signals between processor 402, memory 406, and other components in the system 400 and bridges the data signals between processor bus 404, memory 406, and a first input/output (I/O) bus 412.
  • the bridge/memory controller provides a graphics port for coupling to a graphics controller 413.
  • graphics controller 413 interfaces to a display device (not shown) for displaying images rendered or otherwise processed by the graphics controller 413 to a user.
  • First I/O bus 412 may comprise a single bus or a combination of multiple buses. First I/O bus 412 provides communication links between components in system 400.
  • a network controller 414 may be coupled to the first I/O bus 412.
  • the network controller links system 400 to a network that may include a plurality of processing systems (not shown in Figure 4) and supports communication among various systems.
  • the network of processing systems may comprise a local area network (LAN), a wide area network (WAN), the Internet, or other network.
  • a display device controller 416 may be coupled to the first I/O bus 412.
  • the display device controller 416 allows coupling of a display device to system 400 and acts as an interface between a display device (not shown) and the system.
  • the display device receives data signals from processor 402 through display device controller 416 and displays information contained in the data signals to a user of system 400.
  • a second I/O bus 420 may comprise a single bus or a combination of multiple buses.
  • the second I/O bus 420 provides communication links between components in system 400.
  • a data storage device 422 may be coupled to the second I/O bus 420.
  • the data storage device 422 may comprise a hard disk drive, a floppy disk drive, a CD-ROM device, a flash memory device, or other mass storage device.
  • Data storage device 422 may comprise one or a plurality of the described data storage devices.
  • a keyboard interface 424 may be coupled to the second I/O bus 420.
  • Keyboard interface 424 may comprise a keyboard controller or other keyboard interface device.
  • Keyboard interface 424 may comprise a dedicated device or may reside in another device such as a bus controller or other controller device.
  • Keyboard interface 424 allows coupling of a keyboard to system 400 and transmits data signals from a keyboard to system 400.
  • a user input interface 425 may be coupled to the second I/O bus 420.
  • the user input interface may be coupled to a user input device, such as a remote control, mouse, joystick, or trackball, for example, to provide input data to the computer system.
  • a bus bridge 428 couples first I/O bridge 412 to second I/O bridge 420. The bus bridge operates to buffer and bridge data signals between the first I/O bus 412 and the second I/O bus 420.
  • Embodiments of the present invention are related to the use of the system 400 as a PDP or PEP. According to one embodiment, such processing may be performed by the system 400 in response to processor 402 executing sequences of instructions in memory 404. Such instructions may be read into memory 404 from another computer-readable medium, such as data storage device 422, or from another source via the network controller 414, for example. Execution of the sequences of instructions causes processor 402 to execute PDP or PEP processing according to embodiments of the present invention. In an alternative embodiment, hardware circuitry may be used in place of or in combination with software instructions to implement embodiments of the present invention. Thus, the present invention is not limited to any specific combination of hardware circuitry and software.
  • data storage device 422 may be used to provide long-term storage for the executable instructions and data structures for embodiments of PDPs and PEPs in accordance with the present invention
  • memory 406 is used to store on a shorter term basis the executable instructions of embodiments of PDPs and PEPs in accordance with the present invention during execution by processor 402.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Extending network capabilities for a network with a policy-based network management (PBNM) architecture. The method includes sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) in response to an external action, and sending a Java object in a second message from the PDP to the PEP in response to receiving the first message. The Java object may be executed on the PEP to implement a policy.

Description

EXTENSIBLE POLICY-BASED NETWORK MANAGEMENT ARCHITECTURE
BACKGROUND
1. FIELD
The present invention relates generally to management of networks of computer systems and, more specifically, to policy-based network management (PBNM).
2. DESCRIPTION
Computer network management is growing increasingly more complex and difficult due in part to the unrelenting expansion of today's enterprise networks. New applications such as intranets, priority business applications, multicast-based applications, and multimedia require a network that is capable of supporting traffic level monitoring, self-reconfiguration, multi-point communication, software distribution, security, and of adjusting to changing application requirements through deployment of new services. Policy-based network management (PBNM) is a recent approach to network management that attempts to provide a higher level interface to network management than has been previously available. PBNM hides the low-level mechanisms of network management behind a high level abstraction called policies. Policies are human-readable, simple to express propositions that dictate what actions and behaviors are permitted on a computer network. Using PBNM, a network administrator can express a set of policies governing the network. For example, one policy might be "allow members of the engineering department to reserve 100 Kbits/s of network bandwidth between the hours of 9:00 AM and
5:00 PM." The underlying PBNM architecture handles the resolution of technical issues such as the association of the user's Internet Protocol (IP) addresses to group membership, detection and permission/refusal of bandwidth reservations, time of day that a bandwidth request is to be active, and so on.
This abstraction of network management and the associated hiding of the specific mechanisms used to implement policies allow for a richer, more powerful set of services to be managed and deployed on computer networks.
Current PBNM architectures use a static, localized set of mechanisms for controlling the behavior of computer networks. One known PBNM protocol is the Common Open Policy Service (COPS) protocol. The COPS protocol is a "work in progress" or draft protocol of the Internet Engineering Task Force (IETF) dated August 16, 1999, which may be found on the Internet at http://www.ietf.org/internet-drafts/draft-ietf-rap-cops-07.txt. The COPS protocol describes a client/server model for supporting policy control over Quality of Service (QoS) signaling protocols and provisioned QoS resource management. In the COPS protocol, clients, called policy enforcement points (PEPs), relay information about network resource requests to policy decision points (PDPs), which interpret policies so as to determine whether a request for network service should be honored or not. More generally, policies consist of sets of conditions that must be met before certain actions can be taken.
For each new type of managed network resource, an extension must be defined for the COPS protocol (through the IETF procedures). In addition, changes must be made in the PEPs to allow outsourcing of decisions via the newly extended COPS protocol. The conditions and actions taken as a result of an evaluation by a PDP are fairly static as well. Typically, the actions consist of allowing or rejecting access to some resource (e.g., network bandwidth, multicast groups, etc.), along with a small set of predefined conditions such as group membership and time of day. In addition to these requirements, the conditions used in PEPs to trigger requests for policy evaluation, as well as actions taken by PEPs in response to such evaluation, tend to be strictly local in scope (that is, focused on a single network node). Thus, the policy evaluation conditions used in PEPs typically do not take into account the state of other devices in the network.
While PBNM provides a powerful means of managing computer networks, its static definition of the mechanisms that can be managed and the actions that can be decided on makes it slow to respond to the rapid evolution of network services and capabilities that is taking place. Furthermore, the local scope of PBNM conditions and actions tend to limit the network-wide utility of PBNM to solving those problems which do not require access to the global state of the network.
SUMMARY
An embodiment of the present invention is a method of extending the capabilities of a network with a policy-based network management (PBNM) architecture. The method includes sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) in response to an external action, and sending a Java object in a second message from the PDP to the PEP in response to receiving the first message.
Another embodiment of the present invention includes sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) requesting configuration of conditions, sending a Java object in a second message from the PDP to the PEP in response to receiving the first message, and executing the Java object on the PEP to configure conditions controlling the sending of messages from the PEP to the PDP.
Other embodiments are described and claimed.
BRIEF DESCRIPTION OF THE DRAWINGS
The features and advantages of the present invention will become apparent from the following detailed description of the present invention in which:
Figure 1 is a diagram of a policy enforcement point interacting with a policy decision point for dynamic policy actions according to an embodiment of the present invention; Figure 2 is a diagram illustrating dynamic policy conditions according to an embodiment of the present invention;
Figure 3 is a diagram illustrating dynamic policy conditions taking into account network-wide state information according to an embodiment of the present invention; and
Figure 4 is a diagram illustrating a sample processing system capable of being operated as a policy decision point according to an embodiment of the present invention.
DETAILED DESCRIPTION
As enterprise network and computing devices such as routers and servers have become more computationally powerful, new features have been added to these devices which leverage the available processing power to enable greater extensibility. In particular, the use of Java Virtual Machines (JVMs) has appeared in computer industry applications and academic research as a flexible, secure method of running programs to extend the functionality of devices that previously only supported a fixed set of features.
An embodiment of the present invention extends the current policy- based network management (PBNM) architecture by utilizing the benefits afforded by the Java programming language and JVMs. An embodiment of the present invention allows network administrators and PBNM vendors to programmatically extend the set of conditions and actions that may be incorporated into policies in a PBNM system. In one embodiment, this extension may be accomplished using the Common Open Policy Service (COPS) protocol, although other embodiments may use other protocols. One embodiment of the present invention uses the COPS protocol to carry Java objects (e.g., self-contained programs) between policy decision points (PDPs) and policy enforcement points (PEPs). This usage of the COPS protocol to carry dynamic, executable programs rather than static configuration and decision information is a powerful extension to the concept of PBNM. Since the Java objects communicated by this architecture are fully programmable, network aware applications, the objects have the ability to contact and coordinate with other instances of such applications (executing on other nodes within the network), thereby providing a greater degree of inter-PEP communication than before. In general, by sending Java objects to PEPs, the PEPs may use a richer set of conditions for policy evaluation and implement a more powerful set of actions for manipulating the state of the network.
Reference in the specification to "one embodiment" or "an embodiment" of the present invention means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, the appearances of the phrase "in one embodiment" appearing in various places throughout the specification are not necessarily all referring to the same embodiment.
Figure 1 is a diagram of a policy enforcement point interacting with a policy decision point for dynamic policy actions according to an embodiment of the present invention. A policy enforcement point (PEP) 10 may be a dedicated device for providing network functionality that implements a policy in a PBNM system architecture. For example, the PEP may comprise a network router, a switch, or a firewall. A PEP may be a client in a client/server model, such as is used in the COPS protocol. A policy decision point (PDP) 12 correlates policy information to instruct one or more PEPs in handling network packets or otherwise providing network services. A PDP may be a server in the client/server model. In one embodiment, the PDP may be a general purpose computer system. There may be one or more PDPs and one or more PEPs in this network architecture. Multiple PDPs may be linked in a hierarchical fashion.
In this protocol, a PEP sends request, update, and delete messages to a PDP, and the PDP returns decision messages back to the PEP. Hence, the PEP communicates with the PDP to obtain policy decisions or directives for network management. The protocol uses the well-known transmission control protocol (TCP) as its transport protocol for reliable exchange of messages between the PDP and the PEPs. The protocol relies on the well-known Internet Protocol Security (IPSEC) protocol for authentication and security of the communications path between the PDP and the PEPs. The protocol is stateful in that it allows the PDP to push configuration information to a PEP, and then allows the PDP to remove such state from the PEP when it is no longer applicable. The PEP is responsible for initiating a persistent TCP connection to a PDP. The PEP uses this TCP connection to send requests to and receive decisions from the remote PDP. Communication between the PDP and the PEP is primarily in the form of stateful request/decision message exchanges, although the PDP may occasionally send unsolicited decision messages to the PEP to force changes in previously approved request states.
The policy protocol is designed to communicate self-identifying objects which contain the data necessary for identifying request states, establishing the context for a request, identifying the type of request, referencing previously installed requests, relaying policy decisions, reporting errors, and transferring client specific/name space information.
In Figure 1 , PEP 10 sends a COPS request message 14 at run-time to PDP 12 in response to some external action within the network, such as a set of conditions requiring evaluation by the PDP. The request message may include such items as common header information, a client handle, a context object containing data, and other parameters. The context object may be used to determine the context within which all other message objects are to be interpreted. It also may be used to determine the kind of decision to be returned from the PDP. The context object specifies the type of event(s) that triggered a query. The decision may be a directive or instruction to the PEP related to admission control, resource allocation, object forwarding and substitution, or configuration. In response to the request message, PDP 12 returns a decision message 16 to the PEP. Rather than delivering a static decision, in one embodiment of the present invention the PDP downloads a Java object to the PEP to be executed on the PEP for implementation of the desired policy. The Java object may contain any program written in the Java programming language to effect the desired result at the PEP. Of course, the PEP must include a Java Virtual Machine (JVM) for supporting execution of the Java object received from the PDP. Thus, this mechanism is dynamic and easily extensible.
In another embodiment, a COPS configuration request object (carried in a context object within a request message sent by the PDP to a PEP at initialization time) may be used to download a set of Java programs from a PDP to a PEP such that the conditions used to trigger issuance of request messages by the PEP are programmable as well. In both cases, the Java application programs installed at the PEPs are able to interact both with each other and with other devices (PEPs or other devices) in the network to evaluate conditions and implement actions. Figure 2 is a diagram illustrating dynamic policy conditions according to an embodiment of the present invention. In this embodiment, a PEP 10 sends a COPS request message 18 to a PDP 12 requesting configuration within a context object. A PEP may request to receive named configuration information from the PDP in this way. This named configuration data may be in a form useful for setting system attributes on a PEP, or it may be in the form of policy rules that are to be directly verified by the PEP. In response, the PDP sends a Java object to the PEP in a decision message 20. The Java object, when executed at the PEP, configures the conditions for subsequent policy evaluation. In one embodiment, these actions may be performed at network initialization time. In alternate embodiments, the Java object sent to the PEP may perform any desired processing and not be limited to configuration functions.
In another embodiment, the Java applications installed and executed in the PEPs as part of actions taken in response to fulfillment of policy conditions may be used to affect or update the state at other network nodes (e.g., other PEPs). This feature allows for policies that both detect and manipulate distributed network (e.g., global) state information. Figure 3 is a diagram illustrating dynamic policy conditions taking into account network-wide state information according to an embodiment of the present invention. A PEP 10 sends a COPS request message 22 at initialization time to PDP 12 requesting configuration within a context object. In response, the PDP sends a Java object to the PEP in a decision message 24. This first Java object configures conditions for policy evaluation by the PEP. At some later point in time, an event occurs at PEP 10 triggering run-time evaluation of policy conditions. The PEP then sends another request message to the PDP. In response, the PDP sends another Java object to the PEP. This second Java object then executes on this PEP. The second Java object is able to examine and manipulate network state information at another PEP 26 or other node in the network as part of evaluating policy conditions. In alternate embodiments, the first and second Java objects may be sent to the PEP together at initialization time, or may be the same object.
In order to allow PBNM functionality to better support rapidly changing network capabilities, embodiments of the present invention use delivery of Java programs from a PDP to a PEP to allow dynamic extension of both the actions taken in execution of policies, as well as the conditions used to evaluate whether an action should be taken or not. This allows PEPs to be more flexible both in actions and conditions they support and the classes of problems that can be addressed.
In one example of using embodiments of the present invention, a monitoring system may be designed which employs a PBNM system along with the extensions defined in the present invention. The monitoring system may allow policies to be created which specify the maximum latency that a particular data flow will experience between two endpoints in a network. An example of the use of such a configuration may be a person who accepts telephone orders and enters the orders into an order entry system, where the network latency between the person's personal computer (PC) system or order entry terminal and the server system that executes the order entry system should be kept low in order to ensure prompt customer order entry. In this case, a Java object may be installed on each PEP to monitor the latency of packets from the indicated flow experience as the packets traverse the PEP. The Java object may also communicate with the objects of other PEPs in a transmission path (e.g., its neighbor objects) in order to determine total end-to-end latency. When the end- to-end latency reaches a predetermined amount, the objects at the PEPs with the higher latency may communicate with their neighbor objects, asking the neighbors to divert non-critical traffic to other routes to reduce latency.ln the preceding description, various aspects of the present invention have been described. For purposes of explanation, specific numbers, systems and configurations were set forth in order to provide a thorough understanding of the present invention. However, it is apparent to one skilled in the art having the benefit of this disclosure that the present invention may be practiced without the specific details. In other instances, well-known features were omitted or simplified in order not to obscure the present invention.
Embodiments of the present invention may be implemented in hardware or software, or a combination of both. However, embodiments of the invention may be implemented as computer programs executing on programmable systems comprising at least one processor, a data storage system (including volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device. Program code may be applied to input data to perform the functions described herein and generate output information. The output information may be applied to one or more output devices, in known fashion. For purposes of this application, a processing system embodying the PDP or PEP includes any system that has a processor, such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.
The programs may be implemented in a high level procedural or object oriented programming language to communicate with a processing system. The programs may also be implemented in assembly or machine language, if desired. In fact, the invention is not limited in scope to any particular programming language. In any case, the language may be a compiled or interpreted language. The programs may be stored on a storage media or device (e.g., hard disk drive, floppy disk drive, read only memory (ROM), CD-ROM device, flash memory device, digital versatile disk (DVD), or other storage device) readable by a general or special purpose programmable processing system, for configuring and operating the processing system when the storage media or device is read by the processing system to perform the procedures descπbed herein. Embodiments of the invention may also be considered to be implemented as a machine-readable storage medium, configured for use with a processing system, where the storage medium so configured causes the processing system to operate in a specific and predefined manner to perform the functions described herein.
An example of one such type of processing system is shown in Figure 4, however, other systems may also be used and not all components of the system shown are required for the present invention. Sample system 400 may be used, for example, to execute the processing for embodiments of the extensible policy-based network management system, in accordance with the present invention, such as the embodiment described herein. One or more of the PDP and PEP may be implemented on a sample system. Sample system 400 is representative of processing systems based on the PENTIUM®II, PENTIUM® III, and CELERON™ microprocessors available from Intel Corporation, although other systems (including personal computers (PCs) having other microprocessors, engineering workstations, other set-top boxes, switches, routers, and the like) and architectures may also be used. In one embodiment, sample system 400 may be executing a version of the WINDOWS® operating system available from Microsoft Corporation, although other operating systems and graphical user interfaces, for example, may also be used.
Figure 4 is a block diagram of a system 400 of one embodiment of the present invention. The system 400 includes a processor 402 that processes data signals. The processor 402 may be a complex instruction set computer (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, a processor implementing a combination of instruction sets, or other processor device, such as a digital signal processor, for example. Processor 402 may be coupled to a processor bus 404 that transmits data signals between processor 402 and other components in the system 400.
System 400 includes a memory 406. Memory 406 may be a dynamic random access memory (DRAM) device, a static random access memory (SRAM) device, or other memory device. Memory 406 may store instructions and/or data represented by data signals that may be executed by processor 402. The instructions and/or data may comprise code for performing any and/or all of the techniques of the present invention. Memory 406 may also contain additional software and/or data (not shown). A cache memory 408 may reside inside processor 402 that stores data signals stored in memory 406. Cache memory 408 in this embodiment speeds up memory accesses by the processor by taking advantage of its locality of access. Alternatively, in another embodiment, the cache memory may reside external to the processor.
A bridge/memory controller 410 may be coupled to the processor bus 404 and memory 406. The bridge/memory controller 410 directs data signals between processor 402, memory 406, and other components in the system 400 and bridges the data signals between processor bus 404, memory 406, and a first input/output (I/O) bus 412. In some embodiments, the bridge/memory controller provides a graphics port for coupling to a graphics controller 413. In this embodiment, graphics controller 413 interfaces to a display device (not shown) for displaying images rendered or otherwise processed by the graphics controller 413 to a user.
First I/O bus 412 may comprise a single bus or a combination of multiple buses. First I/O bus 412 provides communication links between components in system 400. A network controller 414 may be coupled to the first I/O bus 412. The network controller links system 400 to a network that may include a plurality of processing systems (not shown in Figure 4) and supports communication among various systems. The network of processing systems may comprise a local area network (LAN), a wide area network (WAN), the Internet, or other network. In some embodiments, a display device controller 416 may be coupled to the first I/O bus 412. The display device controller 416 allows coupling of a display device to system 400 and acts as an interface between a display device (not shown) and the system. The display device receives data signals from processor 402 through display device controller 416 and displays information contained in the data signals to a user of system 400.
A second I/O bus 420 may comprise a single bus or a combination of multiple buses. The second I/O bus 420 provides communication links between components in system 400. A data storage device 422 may be coupled to the second I/O bus 420. The data storage device 422 may comprise a hard disk drive, a floppy disk drive, a CD-ROM device, a flash memory device, or other mass storage device. Data storage device 422 may comprise one or a plurality of the described data storage devices.
A keyboard interface 424 may be coupled to the second I/O bus 420. Keyboard interface 424 may comprise a keyboard controller or other keyboard interface device. Keyboard interface 424 may comprise a dedicated device or may reside in another device such as a bus controller or other controller device. Keyboard interface 424 allows coupling of a keyboard to system 400 and transmits data signals from a keyboard to system 400. A user input interface 425 may be coupled to the second I/O bus 420. The user input interface may be coupled to a user input device, such as a remote control, mouse, joystick, or trackball, for example, to provide input data to the computer system. A bus bridge 428 couples first I/O bridge 412 to second I/O bridge 420. The bus bridge operates to buffer and bridge data signals between the first I/O bus 412 and the second I/O bus 420.
Embodiments of the present invention are related to the use of the system 400 as a PDP or PEP. According to one embodiment, such processing may be performed by the system 400 in response to processor 402 executing sequences of instructions in memory 404. Such instructions may be read into memory 404 from another computer-readable medium, such as data storage device 422, or from another source via the network controller 414, for example. Execution of the sequences of instructions causes processor 402 to execute PDP or PEP processing according to embodiments of the present invention. In an alternative embodiment, hardware circuitry may be used in place of or in combination with software instructions to implement embodiments of the present invention. Thus, the present invention is not limited to any specific combination of hardware circuitry and software.
The manner in which elements of system 400 perform their conventional functions is well-known in the art. In particular, data storage device 422 may be used to provide long-term storage for the executable instructions and data structures for embodiments of PDPs and PEPs in accordance with the present invention, whereas memory 406 is used to store on a shorter term basis the executable instructions of embodiments of PDPs and PEPs in accordance with the present invention during execution by processor 402.
While this invention has been described with reference to illustrative embodiments, this description is not intended to be construed in a limiting sense. Various modifications of the illustrative embodiments, as well as other embodiments of the invention, which are apparent to persons skilled in the art to which the inventions pertains are deemed to lie within the spirit and scope of the invention.

Claims

CLAIMSWhat is claimed is:
1. A method of extending network capabilities for a network with a policy-based network management (PBNM) architecture comprising: sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) in response to an external action; and sending a Java object in a second message from the PDP to the PEP in response to receiving the first message.
2. The method of claim 1 , further comprising executing the Java object on the PEP to implement a policy.
3. The method of claim 2, wherein the Java object interacts with another PEP in the network in evaluating conditions and implementing actions.
4. The method of claim 1 , wherein the PBNM architecture operates according to a Common Open Policy Service (COPS) protocol, the first message comprises a request message, and the second message comprises a decision message.
5. The method of claim 1 , wherein the Java object comprises an executable program.
6. A method of extending network capabilities for a network with a policy-based network management (PBNM) architecture comprising: sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) requesting configuration of conditions; sending a Java object in a second message from the PDP to the PEP in response to receiving the first message; and executing the Java object on the PEP to configure conditions controlling the sending of messages from the PEP to the PDP.
7. The method of claim 6, wherein the PBNM architecture operates according to a Common Open Policy Service (COPS) protocol, the first message comprises a request message, and the second message comprises a decision message.
8. The method of claim 6, wherein sending the first message, sending the second message, and executing the Java object are performed at network initialization time.
9. A method of extending network capabilities for a network with a policy-based network management (PBNM) architecture comprising: sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) requesting configuration of conditions; sending a first Java object in a second message from the PDP to the PEP in response to receiving the first message; executing the first Java object on the PEP to configure conditions controlling the sending of messages from the PEP to the PDP; sending a third message from the PEP to the PDP in response to an external event; sending a second Java object in a fourth message from the PDP to the PEP in response to receiving the fourth message; and executing the second Java object on the PEP, wherein the second Java object evaluates a policy condition and examines a state of another PEP in the network.
The method of claim 9, wherein the second Java object, when executing, changes the state of another PEP in the network.
10. The method of claim 9, wherein the PBNM architecture operates according to a Common Open Policy Service (COPS) protocol, the first and third messages comprise request messages, and the second and fourth messages comprise decision messages.
11. The method of claim 9, wherein sending the first message, sending the second message, and executing the first Java object are performed at network initialization time.
12. A policy-based network management (PBNM) system for a network comprising: at least one policy enforcement point (PEP) to send a first message in response to an external action; and at least one policy decision point (PDP), coupled to the at least one PEP, to send a Java object in a second message to the at least one PEP in response to receiving the first message.
13. The system of claim 13, wherein the at least one PEP executes the Java object to implement a policy.
14. The system of claim 13, wherein the Java object executing on the at least one PEP interacts with another PEP in the network in evaluating conditions and implementing actions.
15. The system of claim 13, wherein the system operates according to a Common Open Policy Service (COPS) protocol, the first message comprises a request message, and the second message comprises a decision message.
16. The system of claim 13, wherein the first message comprises a request for configuration of conditions, and the at least one PEP executes the Java object to configure conditions controlling the sending of messages from the PEP to the PDP.
17. A policy-based network management (PBNM) system for a network comprising: at least one policy enforcement point (PEP) to send a first message requesting configuration of conditions; and at least one policy decision point (PDP) to send at least first and second Java objects to the at least one PEP in response to receiving the first message, wherein the at least one PEP executes the first Java object to configure conditions controlling the sending of messages from the at least one PEP to the at least one PDP, and executes the second Java object in response to an event occurring at the at least one PEP, the second Java object evaluating a policy condition and examining a state of another PEP in the network.
18. The system of claim 18, wherein the second Java object, when executing, changes the state of another PEP in the network.
19. The system of claim 18, wherein sending the first message, sending the second message, and executing the first Java object are performed at network initialization time.
20. The system of claim 18, wherein sending the first message, sending the second message, and executing the first Java object are performed at network initialization time.
21. An article comprising: a machine readable medium having a plurality of machine readable instructions, wherein when the instructions are executed by at least one processor, the instructions implement a policy- based network management (PBNM) system by sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) in response to an external action; and sending a Java object in a second message from the PDP to the PEP in response to receiving the first message.
22. An article comprising: a machine readable medium having a plurality of machine readable instructions, wherein when the instructions are executed by at least one processor, the instructions implement a policy-based network management (PBNM) system by sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) requesting configuration of conditions; sending a Java object in a second message from the PDP to the PEP in response to receiving the first message; and configuring conditions controlling the sending of messages from the PEP to the PDP.
23. An article comprising: a machine readable medium having a plurality of machine readable instructions, wherein when the instructions are executed by at least one processor, the instructions implement a policy-based network management (PBNM) system for a network by sending a first message from a policy enforcement point (PEP) to a policy decision point (PDP) requesting configuration of conditions; sending at least first and second Java objects from the PDP to the PEP in response to receiving the first message; configuring conditions controlling the sending of messages from the PEP to the PDP; and in response to an event occurring at the PEP, evaluating a policy condition and examining a state of another PEP in the network.
PCT/US2000/022792 1999-09-10 2000-08-18 Extensible policy-based network management architecture WO2001019031A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP00957591A EP1214814A1 (en) 1999-09-10 2000-08-18 Extensible policy-based network management architecture
AU69188/00A AU6918800A (en) 1999-09-10 2000-08-18 Extensible policy-based network management architecture

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US09/393,138 1999-09-10
US09/393,138 US6611864B2 (en) 1999-09-10 1999-09-10 Extensible policy-based network management architecture

Publications (1)

Publication Number Publication Date
WO2001019031A1 true WO2001019031A1 (en) 2001-03-15

Family

ID=41404303

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2000/022792 WO2001019031A1 (en) 1999-09-10 2000-08-18 Extensible policy-based network management architecture

Country Status (4)

Country Link
US (1) US6611864B2 (en)
EP (1) EP1214814A1 (en)
AU (1) AU6918800A (en)
WO (1) WO2001019031A1 (en)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2004040843A2 (en) * 2002-11-01 2004-05-13 Telefonaktiebolaget Lm Ericsson (Publ) A method and system for policy-based control in a distributed network
EP1550329A2 (en) * 2002-10-09 2005-07-06 Nokia Corporation System and method with policy control function for multimedia broadcast/multicast system services
US7072958B2 (en) 2001-07-30 2006-07-04 Intel Corporation Identifying network management policies
WO2007002875A1 (en) * 2005-06-29 2007-01-04 Intel Corporation Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control
WO2007064477A2 (en) 2005-11-29 2007-06-07 Intel Corporation Network access control for many-core systems
US7650396B2 (en) 2000-12-06 2010-01-19 Intelliden, Inc. System and method for defining a policy enabled network
WO2010060466A1 (en) * 2008-11-26 2010-06-03 Nokia Siemens Networks Oy Method and device for the processing of policy rule data
US8219662B2 (en) 2000-12-06 2012-07-10 International Business Machines Corporation Redirecting data generated by network devices
US8296400B2 (en) 2001-08-29 2012-10-23 International Business Machines Corporation System and method for generating a configuration schema

Families Citing this family (57)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8060656B2 (en) * 1998-10-09 2011-11-15 Netmotion Wireless, Inc. Method and apparatus for providing mobile and other intermittent connectivity in a computing environment
US8078727B2 (en) 1998-10-09 2011-12-13 Netmotion Wireless, Inc. Method and apparatus for providing mobile and other intermittent connectivity in a computing environment
US7778260B2 (en) 1998-10-09 2010-08-17 Netmotion Wireless, Inc. Method and apparatus for providing mobile and other intermittent connectivity in a computing environment
US7293107B1 (en) 1998-10-09 2007-11-06 Netmotion Wireless, Inc. Method and apparatus for providing mobile and other intermittent connectivity in a computing environment
US7882247B2 (en) 1999-06-11 2011-02-01 Netmotion Wireless, Inc. Method and apparatus for providing secure connectivity in mobile and other intermittent computing environments
US7346677B1 (en) 1999-07-02 2008-03-18 Cisco Technology, Inc. Method and apparatus for creating policies for policy-based management of quality of service treatments of network data traffic flows
US6970930B1 (en) * 1999-11-05 2005-11-29 Mci, Inc. Method and system of providing differentiated services
JP3751783B2 (en) * 1999-11-12 2006-03-01 富士通株式会社 Communication network management system
US6788647B1 (en) 1999-11-19 2004-09-07 Cisco Technology, Inc. Automatically applying bi-directional quality of service treatment to network data flows
US6839766B1 (en) * 2000-01-14 2005-01-04 Cisco Technology, Inc. Method and apparatus for communicating cops protocol policies to non-cops-enabled network devices
EP1117265A1 (en) * 2000-01-15 2001-07-18 Telefonaktiebolaget Lm Ericsson Method and apparatus for global roaming
US6871233B1 (en) * 2000-07-05 2005-03-22 Lucent Technologies Inc. Method and apparatus for use in specifying and insuring service-level quality of service in computer networks
US6959332B1 (en) 2000-07-12 2005-10-25 Cisco Technology, Inc. Basic command representation of quality of service policies
US7099932B1 (en) 2000-08-16 2006-08-29 Cisco Technology, Inc. Method and apparatus for retrieving network quality of service policy information from a directory in a quality of service policy management system
US7254832B1 (en) * 2000-08-28 2007-08-07 Nortel Networks Limited Firewall control for secure private networks with public VoIP access
US8370507B1 (en) * 2000-09-13 2013-02-05 Rockstar Bidco Lp System, device, and method for receiver access control in an internet television
US6963573B1 (en) * 2000-09-13 2005-11-08 Nortel Networks Limited System, device, and method for receiver access control in a multicast communication system
JP2002108813A (en) * 2000-09-28 2002-04-12 Toshiba Corp Method and system for providing network environment
US6822940B1 (en) 2000-09-29 2004-11-23 Cisco Technology, Inc. Method and apparatus for adapting enforcement of network quality of service policies based on feedback about network conditions
US7096260B1 (en) 2000-09-29 2006-08-22 Cisco Technology, Inc. Marking network data packets with differentiated services codepoints based on network load
JP2002111729A (en) * 2000-09-29 2002-04-12 Kddi Corp Apparatus for managing policy base managing system and apparatus to be managed
US6988133B1 (en) * 2000-10-31 2006-01-17 Cisco Technology, Inc. Method and apparatus for communicating network quality of service policy information to a plurality of policy enforcement points
US7050396B1 (en) 2000-11-30 2006-05-23 Cisco Technology, Inc. Method and apparatus for automatically establishing bi-directional differentiated services treatment of flows in a network
US7353269B2 (en) * 2000-12-21 2008-04-01 Fujitsu Limited Network monitoring system
US7120156B2 (en) * 2001-07-16 2006-10-10 Telefonaktiebolaget Lm Ericsson (Publ) Policy information transfer in 3GPP networks
ATE383707T1 (en) * 2001-11-28 2008-01-15 Ericsson Telefon Ab L M POLICY COORDINATION IN A COMMUNICATIONS NETWORK
JP2003173301A (en) * 2001-12-07 2003-06-20 Hitachi Ltd Network, server and policy server of storage
US7477600B1 (en) 2002-02-12 2009-01-13 Cisco Technology, Inc. Method and apparatus for configuring network elements to support real time applications based on meta-templates
US7333432B1 (en) 2002-02-12 2008-02-19 Cisco Technology, Inc. Method and apparatus for configuring network elements to support real time applications
US9426178B1 (en) * 2002-03-25 2016-08-23 Dell Software Inc. Method and apparatus for centralized policy programming and distributive policy enforcement
US7236465B2 (en) * 2002-06-13 2007-06-26 International Business Machines Corporation System and method for gathering multicast content receiver data
US6957067B1 (en) * 2002-09-24 2005-10-18 Aruba Networks System and method for monitoring and enforcing policy within a wireless network
US7295524B1 (en) 2003-02-18 2007-11-13 Airwave Wireless, Inc Methods, apparatuses and systems facilitating management of airspace in wireless computer network environments
US9137670B2 (en) * 2003-02-18 2015-09-15 Hewlett-Packard Development Company, L.P. Method for detecting rogue devices operating in wireless and wired computer network environments
JP2006526359A (en) * 2003-04-07 2006-11-16 シネマティクス インコーポレイテッド System and method for providing scalable management in a general purpose router
US7526541B2 (en) * 2003-07-29 2009-04-28 Enterasys Networks, Inc. System and method for dynamic network policy management
US20050038887A1 (en) * 2003-08-13 2005-02-17 Fernando Cuervo Mechanism to allow dynamic trusted association between PEP partitions and PDPs
US7716314B1 (en) 2003-12-30 2010-05-11 Dinochip, Inc. Traffic management in digital signal processor
US7853676B1 (en) 2004-06-10 2010-12-14 Cisco Technology, Inc. Protocol for efficient exchange of XML documents with a network device
US7640317B2 (en) * 2004-06-10 2009-12-29 Cisco Technology, Inc. Configuration commit database approach and session locking approach in a two-stage network device configuration process
US7660882B2 (en) * 2004-06-10 2010-02-09 Cisco Technology, Inc. Deploying network element management system provisioning services
US7246205B2 (en) * 2004-12-22 2007-07-17 Intel Corporation Software controlled dynamic push cache
US8817813B2 (en) 2006-10-02 2014-08-26 Aruba Networks, Inc. System and method for adaptive channel scanning within a wireless network
US20080120264A1 (en) * 2006-11-20 2008-05-22 Motorola, Inc. Method and Apparatus for Efficient Spectrum Management in a Communications Network
US9124602B2 (en) * 2007-01-05 2015-09-01 International Business Machines Corporation Method and apparatus for creating custom access control hierarchies
CN101222482B (en) * 2007-01-11 2010-10-06 华为技术有限公司 Method and system for confirming policy regulation
US20090183225A1 (en) * 2008-01-10 2009-07-16 Microsoft Corporation Pluggable modules for terminal services
US8255972B2 (en) * 2008-06-06 2012-08-28 International Business Machines Corporation Method to automatically map business function level policies to it management policies
US9537717B2 (en) * 2009-04-20 2017-01-03 Hewlett Packard Enterprise Development Lp Policy enforcement point provisioning
GB2507941B (en) * 2010-02-22 2018-10-31 Avaya Inc Secure,policy-based communications security and file sharing across mixed media,mixed-communications modalities and extensible to cloud computing such as soa
US8549579B2 (en) 2011-07-06 2013-10-01 International Business Machines Corporation Dynamic data-protection policies within a request-reply message queuing environment
US10505818B1 (en) 2015-05-05 2019-12-10 F5 Networks. Inc. Methods for analyzing and load balancing based on server health and devices thereof
EP3169069A1 (en) * 2015-11-10 2017-05-17 FEI Company Systems and methods for imaging device interfaces
US10469394B1 (en) 2016-08-01 2019-11-05 F5 Networks, Inc. Methods for configuring adaptive rate limit based on server data and devices thereof
CA3058624A1 (en) 2017-03-31 2018-10-04 Dow Global Technologies Llc Wood preservatives
US11029948B1 (en) 2019-12-05 2021-06-08 Bank Of America Corporation System for normalizing data dependency effects across an electronic network environment
US11809839B2 (en) 2022-01-18 2023-11-07 Robert Lyden Computer language and code for application development and electronic and optical communication

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6255943B1 (en) * 1995-03-29 2001-07-03 Cabletron Systems, Inc. Method and apparatus for distributed object filtering
US5872966A (en) * 1996-05-10 1999-02-16 Apple Computer, Inc. System and method for logging and enabling further manipulation of system state information
US6131112A (en) * 1996-05-17 2000-10-10 Cabletron Systems, Inc. Method and apparatus for integrated network and systems management
US6260078B1 (en) * 1996-07-03 2001-07-10 Sun Microsystems, Inc. Using a distributed object system to find and download java-based applications
US6058482A (en) * 1998-05-22 2000-05-02 Sun Microsystems, Inc. Apparatus, method and system for providing network security for executable code in computer and communications networks
US6336139B1 (en) * 1998-06-03 2002-01-01 International Business Machines Corporation System, method and computer program product for event correlation in a distributed computing environment
US6308208B1 (en) * 1998-09-30 2001-10-23 International Business Machines Corporation Method for monitoring network distributed computing resources using distributed cellular agents
US6167445A (en) * 1998-10-26 2000-12-26 Cisco Technology, Inc. Method and apparatus for defining and implementing high-level quality of service policies in computer networks
US6327618B1 (en) * 1998-12-03 2001-12-04 Cisco Technology, Inc. Recognizing and processing conflicts in network management policies
US6301613B1 (en) * 1998-12-03 2001-10-09 Cisco Technology, Inc. Verifying that a network management policy used by a computer system can be satisfied and is feasible for use

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
D. HYDE: "Web Based Management", 3COM TECHNICAL PAPERS, March 1997 (1997-03-01), XP002158235, Retrieved from the Internet <URL:http://www.3com.com/nsc/500627.html> [retrieved on 20010123] *
J. BOYLE, R. COHEN, D. DURHAM, S. HERZOG, R. RAJAN, A. SASTRY: "The COPS (Common Open Policy Service) Protocol", IETF DRAFT VERSION 0.7, 16 August 1999 (1999-08-16), XP002158234, Retrieved from the Internet <URL:ftp://ftp.sonycsl.co.jp/mirror/ftp.iij.ad.jp/internet-drafts/draft-ietf-rap-cops-07.txt> [retrieved on 20010123] *
M. BALDI, S. GAI, G. PICCO: "Exploiting Code Mobility in Decentralized and Flexible Network management"", PRTOC. MOBILE AGENTS '97, April 1997 (1997-04-01), Berlin, Germany, XP002158236, Retrieved from the Internet <URL:http://citeseer.nj.nec.com/baldi-exploiting.html> [retrieved on 20010123] *
M. FERIDUN, W. KASTELEIJN, J. KRAUSE: "Distributed Management with Mobile Components", IBM RESEARCH REPORT RZ3102, IBM RESEARCH DIVISION, ZURICH RESEARCH LABORATORY, February 1999 (1999-02-01), pages 857 - 870, XP002158233 *

Cited By (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8219662B2 (en) 2000-12-06 2012-07-10 International Business Machines Corporation Redirecting data generated by network devices
US7650396B2 (en) 2000-12-06 2010-01-19 Intelliden, Inc. System and method for defining a policy enabled network
US7072958B2 (en) 2001-07-30 2006-07-04 Intel Corporation Identifying network management policies
US8296400B2 (en) 2001-08-29 2012-10-23 International Business Machines Corporation System and method for generating a configuration schema
EP1550329A2 (en) * 2002-10-09 2005-07-06 Nokia Corporation System and method with policy control function for multimedia broadcast/multicast system services
EP1550329A4 (en) * 2002-10-09 2007-06-27 Nokia Corp System and method with policy control function for multimedia broadcast/multicast system services
US7391724B2 (en) 2002-10-09 2008-06-24 Spyder Navigations, L.L.C. System and method with policy control function for multimedia broadcast/multicast system services
WO2004040843A3 (en) * 2002-11-01 2004-08-19 Ericsson Telefon Ab L M A method and system for policy-based control in a distributed network
WO2004040843A2 (en) * 2002-11-01 2004-05-13 Telefonaktiebolaget Lm Ericsson (Publ) A method and system for policy-based control in a distributed network
US9143405B2 (en) 2002-11-01 2015-09-22 Telefonaktiebolaget L M Ericsson (Publ) Method and system for policy-based control in a distributed network
CN100384141C (en) * 2002-11-01 2008-04-23 艾利森电话股份有限公司 A method and system for policy-based control in a distributed network
WO2007002875A1 (en) * 2005-06-29 2007-01-04 Intel Corporation Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control
US7827593B2 (en) 2005-06-29 2010-11-02 Intel Corporation Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control
US8180923B2 (en) 2005-11-29 2012-05-15 Intel Corporation Network access control for many-core systems
WO2007064477A3 (en) * 2005-11-29 2007-08-09 Intel Corp Network access control for many-core systems
CN101317417B (en) * 2005-11-29 2013-05-08 英特尔公司 Network access control for many-core systems
US8930580B2 (en) 2005-11-29 2015-01-06 Intel Corporation Network access control for many-core systems
WO2007064477A2 (en) 2005-11-29 2007-06-07 Intel Corporation Network access control for many-core systems
WO2010060466A1 (en) * 2008-11-26 2010-06-03 Nokia Siemens Networks Oy Method and device for the processing of policy rule data

Also Published As

Publication number Publication date
US6611864B2 (en) 2003-08-26
EP1214814A1 (en) 2002-06-19
AU6918800A (en) 2001-04-10
US20030018760A1 (en) 2003-01-23

Similar Documents

Publication Publication Date Title
US6611864B2 (en) Extensible policy-based network management architecture
US12003548B2 (en) Transmissions management rules for virtual machine communications
US8234361B2 (en) Computerized system and method for handling network traffic
US6950874B2 (en) Method and system for management of resource leases in an application framework system
US6154776A (en) Quality of service allocation on a network
US20040143662A1 (en) Load balancing for a server farm
WO2017067385A1 (en) Methods, systems, and apparatuses of service provisioning for resource management in a constrained environment
JP2008504776A (en) Method and system for dynamic device address management
US20060150243A1 (en) Management of network security domains
US10608932B2 (en) Refresh flow entry
US6272540B1 (en) Arrangement and method for providing flexible management of a network
JP2009246957A (en) Security policy control system, security policy control method, and program
CA2479651A1 (en) Policy based system management
US20200177509A1 (en) System and method for anycast load balancing for distribution system
Fernando et al. Dynamic network service installation in an active network
JP2006013891A (en) COMPUTER NETWORK SYSTEM AND ITS QoS SETTING METHOD
Zhuang An Open Congestion Control Architecture for high performance fabrics
KIRUBANAND NOVEL SECURITY IN HYBRID SERVER USING JOB SCHEDULING AND QUUEUING PETRINET
Meissner et al. QoS Support for Video Conferencing in the COSMOS System

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG US UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
WWE Wipo information: entry into national phase

Ref document number: 2000957591

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2000957591

Country of ref document: EP

REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

NENP Non-entry into the national phase

Ref country code: JP

WWW Wipo information: withdrawn in national office

Ref document number: 2000957591

Country of ref document: EP