Distributed policy store

Patent metadata

Field	Value
Publication number	US-10250446-B2
Application number	US-201715470499-A
Country	US
Kind code	B2
Filing date	Mar 27, 2017
Priority date	Mar 27, 2017
Publication date	Apr 2, 2019
Grant date	Apr 2, 2019

Abstract

The disclosed technology relates to a distributed policy store. A system is configured to locate, in an index, an entry for a network entity, determine, based on the entry, a file identifier for a file containing a record for the network entity and an offset indicating a location of the record in the file. The system is further configured to locate the file in a distributed file system using the file identifier, locate the record in the file using the offset, and retrieve the record.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
generating a plurality of policies based on a user intent statement;
identifying, among the plurality of policies, a set of policies applicable to a network entity;
storing the set of policies applicable to the network entity in a record for the network entity;
storing the record in a file in a distributed file system, wherein the file is associated with a file identifier and the record is stored at a location indicated by an offset; and
storing the file identifier and the offset in an entry for the network entity, wherein the entry is located in an index database separate from the distributed file system.

2. The computer-implemented method of claim 1 , further comprising:
determining a size of the record; and
storing the size of the record in a header of the record.

3. The computer-implemented method of claim 1 , wherein the distributed file system is a hadoop distributed file system (HDFS) and wherein a size of the file is smaller than a block size for the HDFS.

4. The computer-implemented method of claim 1 , wherein the index database is implemented as a NoSQL database.

5. The computer-implemented method of claim 1 , wherein the file identifier is a filename.

6. The computer-implemented method of claim 1 , wherein the offset indicates a location in the file where the record begins.

7. The computer-implemented method of claim 1 , further comprising:
receiving the user intent statement, the user intent statement including a filter and an action; and
querying, based on the filter, an inventory store to identify the network entity to which the user intent statement applies.

8. A non-transitory computer-readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
receive instructions to update policies for a network entity;
locate an entry for the network entity in an index database;
determine, based on the entry in the index database, a file identifier for a file containing a record for the network entity and an offset indicating a location of the record in the file, wherein the record includes policies for the network entity;
locate the file in a distributed file system using the file identifier, wherein the distributed file system is separate from the index database;
retrieve the record in the file using the offset; and
updating the policies for the network entity.

9. The non-transitory computer-readable medium of claim 8 , wherein retrieving the record using the offset comprises accessing a header of the record to determine a size of the record and retrieving a portion of the file starting from the offset and incorporating the size of the record.

10. The non-transitory computer-readable medium of claim 8 , wherein the instructions further cause the computing system to generate a policy update for the network entity based on a user intent statement, and wherein the updating of the policies for the network entity is based on the policy update.

11. The non-transitory computer-readable medium of claim 10 , wherein the instructions further cause the computing system to:
generate an updated record for the network entity based on the policy update; and
store the updated record in the file.

12. The non-transitory computer-readable medium of claim 11 , wherein the instructions further cause the computing system to determine a size of the updated record and store the size of the record in a header of the record.

13. The non-transitory computer-readable medium of claim 11 , wherein the distributed file system is a hadoop distributed file system (HDFS) and wherein a size of the file is smaller than a block size for the HDFS.

14. The non-transitory computer-readable medium of claim 11 , wherein the index database is implemented as a NoSQL database.

15. The non-transitory computer-readable medium of claim 11 , wherein the file identifier is a filename.

16. A system comprising:
a processor; and
a non-transitory computer-readable medium storing instructions that, when executed by the system, cause the system to:
locate, in an index, an entry for a network entity;
determine, based on the entry, a file identifier for a file containing a record for the network entity, wherein the record includes policies for the network entity;
determine, based on the entry, an offset indicating a location of the record in the file;
locate the file in a distributed file system using the file identifier;
locate the record in the file using the offset; and
retrieve the record.

17. The system of claim 16 , wherein the instructions further cause the system to generate an updated record based on a policy update and store the updated record in the file.

18. The system of claim 17 , wherein the instructions further cause the system to determine a size of the updated record and store the size of the updated record in a header portion of the updated record.

19. The system of claim 16 , wherein the distributed file system is a hadoop distributed file system (HDFS) and wherein a size of the file is smaller than a block size for the HDFS.

20. The system of claim 16 , wherein the index is implemented as a NoSQL database.

Assignees

• Cisco Tech Inc

Inventors

• Prasad Rohit
• Gandham Shashi
• Vu Hai
• Malhotra Varun
• Gupta Sunil
• Singh Abhishek
• Yadav Navindra
• Parandehgheibi Ali
• Prasad Ravi
• Vallem Praneeth
• Lesiak Paul
• Nguyen Hoang

Classifications

• H04L41/0893 Primary

  Assignment of logical groups to network elements · CPC title

• G06F17/30194

  Physics · mapped topic

• G06F17/30094

  Physics · mapped topic

• H04L41/044

  comprising hierarchical management structures · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title