Network agent for reporting to a network policy system

Patent metadata

Field	Value
Publication number	US-10764141-B2
Application number	US-201715469737-A
Country	US
Kind code	B2
Filing date	Mar 27, 2017
Priority date	Mar 27, 2017
Publication date	Sep 1, 2020
Grant date	Sep 1, 2020

Abstract

The disclosed technology relates to a network agent for reporting to a network policy system. A network agent includes an agent enforcer and an agent controller. The agent enforcer is configured to implementing network policies on the system, access data associated with the implementation of the network policies on the system, and transmit, via an interprocess communication, the data to the agent controller. The agent controller is configured to generate a report including the data and transmit the report to a network policy system.

First claim

The invention claimed is:

1. A network entity comprising:
a processor; and
a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the processor to perform operations including:
registering with a network policy system;
receiving a network policy configuration message including network entity independent network policies;
converting the network entity independent network policies into network entity specific network policies;
implementing, by an agent enforcer with a privileged status running on the network entity, the network entity specific network policies on the network entity;
accessing, by the agent enforcer, policy enforcement data associated with the implementation of the network policies on the network entity, access to the policy enforcement data is based on the privileged status of the agent enforcer;
transmitting, by the agent enforcer via an interprocess communication, the policy enforcement data to an agent controller running on the network entity, the agent controller having an unprivileged status;
generating, by the agent controller, a report including the policy enforcement data; and
transmitting, by the agent controller, the report to the network policy system.

2. The network entity of claim 1 , further comprising:
one or more sensors configured to collect the policy enforcement data, the access to the policy enforcement data is via an Application Programming Interface associated with the one or more sensors.

3. The network entity of claim 1 , wherein the policy enforcement data includes a number of times each network policy is enforced.

4. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:
accessing, by the agent enforcer, performance data associated with operation of the network entity, access to the performance data based on the privileged status of the agent enforcer;
transmitting, via the interprocess communication, the performance data to the agent controller; and
wherein the report includes the performance data.

5. The network entity of claim 4 , wherein the performance data includes at least one of central processing unit (CPU) usage or memory usage.

6. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:
accessing, by the agent enforcer, entity data associated with the network entity, access to the entity data based on the privileged status of the agent enforcer;
transmitting, via the interprocess communication, the entity data to the agent controller; and
wherein the report includes the entity data.

7. The network entity of claim 6 , wherein the entity data includes at least one of an agent identifier, an operating system, or entity interface information.

8. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:
receiving, by the agent controller, an updated network entity independent network policy from the network policy system;
transmitting, via the interprocess communication, the updated network entity independent network policy to the agent enforcer; and
generating, by the agent enforcer, updated network policies based on the updated network entity independent network policy, wherein the updated network policies are network entity specific.

9. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:
collecting the policy enforcement data in a cache, and
periodically transmitting the policy enforcement data to the agent controller for reporting to the network policy system.

10. A computer-implemented method comprising:
registering, by a network entity, with a network policy system;
receiving a network policy configuration message including network entity independent network policies;
converting the network entity independent network policies into network entity specific network policies;
implementing, by an agent enforcer with a privileged status running on the network entity, the network entity specific network policies on the network entity;
accessing, by the agent enforcer, policy enforcement data associated with the implementation of the network policies on the network entity;
transmitting, by the agent enforcer via an interprocess communication, the policy enforcement data to an agent controller running on the network entity, the agent controller having an unprivileged status;
generating, by the agent controller, a report including the policy enforcement data; and
transmitting, by the agent controller, the report to the network policy system.

11. The computer-implemented method of claim 10 , wherein access to the policy enforcement data is based on the privileged status of the agent enforcer.

12. The computer-implemented method of claim 10 , wherein accessing the policy enforcement data comprises communicating with one or more sensors configured to collect the policy enforcement data via an Application Programming Interface associated with the one or more sensors.

13. The computer-implemented method of claim 10 , wherein the policy enforcement data includes a number of times each network policy is enforced.

14. The computer-implemented method of claim 10 , further comprising:
accessing, by the agent enforcer, performance data associated with operation of the network entity, access to the performance data based on the privileged status of the agent enforcer; and
transmitting, via the interprocess communication, the performance data to the agent controller,
wherein the report includes the performance data.

15. The computer-implemented method of claim 10 , further comprising:
accessing, by the agent enforcer, entity data associated with the network entity, access to the entity data based on the privileged status of the agent enforcer; and
transmitting, via the interprocess communication, the entity data to the agent controller,
wherein the report includes the entity data.

16. The computer-implemented method of claim 10 , further comprising:
receiving, by the agent controller, an updated network entity independent network policy from the network policy system;
transmitting, via the interprocess communication, the updated network entity independent network policy to the agent enforcer; and
generating, by the agent enforcer, updated network policies based on the network entity independent network policy, wherein the updated network policies are network entity specific.

17. A non-transitory computer-readable medium comprising instructions, the instructions, when executed by a network entity, cause the network entity to:
register with a network policy system;
receive a network policy configuration message including network entity independent network policies;
convert the network entity independent network policies into network entity specific network policies;
implement, by an agent enforcer with a privileged status running on the network entity, the network entity specific network policies on the network entity;
access, by the agent enforcer, performance data associated with operation of the network entityon which the network policies are implemented, access to the performance data based on the privileged status of the agent enforcer;
transmit, by the agent enforcer via an interprocess communication, the performance data to an agent controller running on the network entity, the agent controller having an unprivileged status;
generate, by the agent controller, a report includin

Assignees

• Cisco Tech Inc

Inventors

• Vu Hai
• Chang Shih-Chun
• Malhotra Varun
• Gandham Shashi
• Yadav Navindra
• Chen Allen
• Vallem Praneeth
• Prasad Rohit

Classifications

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/046 Primary

  comprising network management agents or mobile agents therefor · CPC title

• H04L41/0893 Primary

  Assignment of logical groups to network elements · CPC title

• H04L43/0817

  by checking functioning · CPC title