Context-aware network service policy management

Patent metadata

Field	Value
Publication number	US-2016173535-A1
Application number	US-201414569810-A
Country	US
Kind code	A1
Filing date	Dec 15, 2014
Priority date	Dec 15, 2014
Publication date	Jun 16, 2016
Grant date	—

Abstract

A method includes converting, by a computer, a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context, and conveying, to the data forwarding devices, the set of network configuration forwarding rules. Upon detecting a change in the dynamic context of the network, the set of network configuration forwarding rules ae updated based on the set of context-aware data forwarding policies and the change in the dynamic context, and the updated set of network configuration forwarding rules are conveyed to the data forwarding devices.

First claim

1 . A method, comprising:
converting, by a computer, a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context; conveying, to the data forwarding devices, the set of network configuration forwarding rules; detecting a change in the dynamic context of the network; updating, based on the set of context-aware data forwarding policies and the change in the dynamic context, the set of network configuration forwarding rules; and conveying, to the data forwarding devices, the updated set of network configuration forwarding rules.

2 . The method according to claim 1 , wherein the data forwarding devices are selected from a list consisting of switches, gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

3 . The method according to claim 1 , wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

4 . The method according to claim 1 , wherein conveying a given data forwarding rule comprises receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

5 . The method according to claim 1 , wherein multiple network configuration forwarding rules define a path between two endpoints on the network.

6 . The method according to claim 5 , wherein each of the endpoints is selected from a list consisting of a virtual machine and a physical computing device.

7 . The method according to claim 1 , wherein the dynamic context is selected from a list consisting of a data attribute and a network attribute.

8 . An apparatus, comprising:
a network adapter coupled to a network having a dynamic context and comprising one or more data forwarding devices; a memory configured to store a set of context-aware data forwarding policies; and a processor configured:
to convert, the set of context-aware data forwarding policies to a set of network configuration forwarding rules for the one or more data forwarding devices,
to convey, to the data forwarding devices, the set of network configuration forwarding rules,
to detect a change in the dynamic context of the network,
to update, based on the set of context-aware data forwarding policies and the change in the dynamic context, the set of network configuration forwarding rules, and
to convey, to the data forwarding devices, the updated set of network configuration forwarding rules.

9 . The apparatus according to claim 8 , wherein the data forwarding devices are selected from a list consisting of switches, gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

10 . The apparatus according to claim 8 , wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

11 . The apparatus according to claim 8 , wherein the processor is configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device..

12 . The apparatus according to claim 8 , wherein multiple network configuration forwarding rules defines a path between two endpoints on the network.

13 . The apparatus according to claim 12 , wherein each of the endpoints is selected from a list consisting of a virtual machine and a computing device.

14 . The apparatus according to claim 8 , wherein the dynamic context is selected from a list consisting of a data attribute and a network attribute.

15 . A computer program product, the computer program product comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising: computer readable program code configured to convert a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context; computer readable program code configured to convey, to the data forwarding devices, the set of network configuration forwarding rules; computer readable program code configured to detect a change in the dynamic context of the network; computer readable program code configured to update, based on the set of context-aware data forwarding policies and the change in the dynamic context, the set of network configuration forwarding rules; and computer readable program code configured to convey, to the data forwarding devices, the updated set of network configuration forwarding rules.

16 . The computer program product according to claim 15 , wherein the data forwarding devices are selected from a list consisting of switches, gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

17 . The computer program product according to claim 15 , wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

18 . The computer program product according to claim 15 , wherein a given network configuration forwarding rule defines a path between two endpoints on the network, and wherein each of the endpoints is selected from a list consisting of a virtual machine and a computing device.

19 . The computer program product according to claim 15 , wherein the computer readable program code configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

20 . The computer program product according to claim 15 , wherein the dynamic context is selected from a list consisting of a data attribute and a network attribute.

Assignees

• IBM

Inventors

• Barabash Katherine
• Cohen Rami
• Levin Anna
• Raichstein Eran

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/342

  between virtual entities, e.g. orchestrators, SDN or NFV entities · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/08

  Configuration management of networks or network elements (address allocation H04L61/50) · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title