Context-aware network service policy management

Patent metadata

Field	Value
Publication number	US-9667653-B2
Application number	US-201414569810-A
Country	US
Kind code	B2
Filing date	Dec 15, 2014
Priority date	Dec 15, 2014
Publication date	May 30, 2017
Grant date	May 30, 2017

Abstract

A method includes converting, by a computer, a set of context-aware data forwarding policies to a set of network configuration forwarding rules for one or more data forwarding devices in a network having a dynamic context, and conveying, to the data forwarding devices, the set of network configuration forwarding rules. Upon detecting a change in the dynamic context of the network, the set of network configuration forwarding rules ae updated based on the set of context-aware data forwarding policies and the change in the dynamic context, and the updated set of network configuration forwarding rules are conveyed to the data forwarding devices.

First claim

The invention claimed is:

1. A method, comprising:
configuring a computer with a set of context-aware data forwarding policies of a network having a dynamic context;
monitoring the dynamic context of the network;
determining a set of network configuration forwarding rules for one or more data forwarding devices of the network, responsively to the configured context-aware data forwarding policies and the dynamic context of the network;
operating by the computer, a first thread that detects changes in the dynamic context of the network, responsively to the monitoring and in response to detected changes, updates, based on the set of context-aware data forwarding policies and the detected changes in the dynamic context, the set of network configuration forwarding rules;
in parallel to operating the first thread, operating a second thread that receives rule requests and in response to the received rule requests conveys to the data forwarding devices, the updated set of network configuration forwarding rules; and
handling packets by the data forwarding devices according to the conveyed updated set of network configuration forwarding rules.

2. The method according to claim 1 , wherein the data forwarding devices are selected from a list consisting of gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

3. The method according to claim 1 , wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

4. The method according to claim 1 , wherein conveying a given data forwarding rule comprises receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

5. The method according to claim 1 , wherein multiple network configuration forwarding rules define a path between two endpoints on the network.

6. The method according to claim 5 , wherein each of the endpoints is selected from a list consisting of a virtual machine and a physical computing device.

7. The method according to claim 1 , wherein the dynamic context comprises a network attribute.

8. An apparatus, comprising:
a network adapter coupled to a network having a dynamic context and comprising one or more data forwarding devices;
a memory configured to store a set of context-aware data forwarding policies; and
a processor configured:
to monitor the dynamic context of the network,
to determine a set of network configuration forwarding rules for the one or more data forwarding devices, responsively to the configured context-aware data forwarding policies and the dynamic context of the network,
to operate a first thread that detects changes in the dynamic context of the network, responsively to the monitoring, and in response to detected changes, updates,
based on the set of context-aware data forwarding policies and the detected changes in the dynamic context, the set of network configuration forwarding rules, and
in parallel to operating the first thread, operates a second thread that receives rule requests and in response to the received rule conveys to the data forwarding devices, the updated set of network configuration forwarding rules.

9. The apparatus according to claim 8 , wherein the data forwarding devices are selected from a list consisting of gateways, firewalls, bridges, routers, switches, hubs, repeaters, protocol converters, proxy servers and network address translators.

10. The apparatus according to claim 8 , wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

11. The apparatus according to claim 8 , wherein the processor is configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

12. The apparatus according to claim 8 , wherein the dynamic context comprises a data attribute.

13. A computer program product, the computer program product comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured with a set of context-aware data forwarding policies of a network having a dynamic context;
computer readable program code configured to monitor the dynamic context of the network, and to determine a set of network configuration forwarding rules for one or more data forwarding devices of the network, responsively to the configured context-aware data forwarding policies and the dynamic context of the network;
computer readable program code configured to operate a first thread that detects changes in the dynamic context of the network, responsively to the monitoring and in response to detected changes, updates, based on the set of context-aware data forwarding policies and the detected changes in the dynamic context, the set of network configuration forwarding rules; and
computer readable program code configured to operate in parallel to the first thread, a second thread that receives rule requests and in response to the received rule requests conveys, to the data forwarding devices, the updated set of network configuration forwarding rules.

14. The computer program product according to claim 13 , wherein a given network configuration forwarding rule specifies handling data conveyed by the network.

15. The computer program product according to claim 13 , wherein a given network configuration forwarding rule defines a path between two endpoints on the network, and wherein each of the endpoints is selected from a list consisting of a virtual machine and a computing device.

16. The computer program product according to claim 13 , wherein the computer readable program code is configured to convey a given data forwarding rule by receiving, from a given data forwarding device, a rule request for a data packet, identifying a given data forwarding rule for the given data forwarding device and the data packet, and conveying the identified data forwarding rule to the data forwarding device.

17. The computer program product according to claim 13 , wherein the dynamic context comprises a network attribute.

18. The method according to claim 1 , wherein the set of context-aware data forwarding policies comprises a policy dependent on a measure of available bandwidth in the network and wherein monitoring the dynamic context of the network comprises monitoring the measure of the available bandwidth in the network.

19. The method according to claim 1 , wherein the set of context-aware data forwarding policies comprises policies dependent on network endpoint locations and wherein monitoring the dynamic context of the network comprises monitoring the endpoint locations.

20. The method according to claim 1 , wherein the set of context-aware data forwarding policies comprises policies dependent on a load on an element in the network and wherein monitoring the dynamic context of the network comprises monitoring the load on the element in the network.

21. The method according to claim 1 , wherein conveying, to the data forwarding devices, the updated set of network configuration forwarding r

Assignees

• IBM

Inventors

• Barabash Katherine
• Cohen Rami
• Levin Anna
• Raichstein Eran

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L41/0816

  the condition being an adaptation, e.g. in response to network events · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/342

  between virtual entities, e.g. orchestrators, SDN or NFV entities · CPC title