US5889953A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Policy management and conflict resolution in computer networks
Assignee: CA Inc
•
Filing: 1996-03-29
•
Granted: 1999-03-30
•
Expires: 2016-03-29
Abstract
Abstract Method and apparatus for determining an enforceable policy applicable to one or more network devices. The method includes attaching one or more rule elements to one or more domain elements to create policies, the domain elements representing network devices and groups of network devices, and the rule elements defining actions, a method for determining whether a conflict exists between the polices, and a method for resolving the conflicts to produce one or more enforceable policies.
Inventors
- 👤 Suzanne Thebaut
- 👤 Walter Scott
- 👤 Eric Rustici
- 👤 Prasan Kaikini
- 👤 Lundy Lewis
- 👤 Rajiv Malik
- 👤 Steve Sycamore
- 👤 Roger Dev
- 👤 Oliver Ibe
- 👤 Ajay Aggarwal
- 👤 Todd Wohlers
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 18:16
CPC Classifications
H; H04; H04L; H04L41/00; H04L41/50; H04L41/5003; H04L41/5019; G; G06; G06F; G06F21/00; G06F21/30; G06F21/50; G06F21/57; G06F21/60; G06F21/604; G06F21/606; G06F21/62; H04L41/08; H04L41/0866; H04L41/0869; H04L41/0873; H04L41/0876; H04L41/0879; H04L41/0883; H04L41/0893; H04L41/0894; H04L41/0895; H04L41/20
Claims Analysis
Total Claims: 59
Claim 1
Independent Claim
141 words
A system for determining an enforceable policy applicable to one or more network devices, comprising a computer-readable medium encoded with: a data structure comprising a policy space, the policy space including domain elements representing network devices and groups of network devices, and rule elements defining actions; and a plurality of executable methods for determining and resolving conflicts among multiple policies applied in real time including: a method for attaching one or more of the rule elements to one or more of the domain elements to create multiple policies; a method for determining whether conflicts exist between the multiple policies wherein a conflict exists when two or more of the multiple policies operate on the same or an intersecting set of domain elements and have overlapping enforcement schedules; and a method for resolving the conflicts to produce one or more enforceable policies.
Claim 2
Independent Claim
141 words
A system for determining an enforceable policy applicable to one or more network devices, comprising a computer-readable medium encoded with: a data structure comprising a policy space, the policy space including domain elements representing network devices and groups of network devices, and rule elements defining actions; and a plurality of executable methods for determining and resolving conflicts among multiple policies applied in real time including: a method for attaching one or more of the rule elements to one or more of the domain elements to create multiple policies; a method for determining whether conflicts exist between the multiple policies wherein a conflict exists when two or more of the multiple policies operate on the same or an intersecting set of domain elements and have overlapping enforcement schedules; and a method for resolving the conflicts to produce one or more enforceable policies.
Claim 3
Dependent Claim
23 words
The system of claim 1, wherein the method for resolving conflicts comprises resolving conflicts when any policy becomes active at a scheduled event.
Claim 4
Dependent Claim
16 words
The system of claim 1, wherein the domain elements include both location-based groups and nonlocation-based groups.
Claim 5
Dependent Claim
31 words
The system of claim 3, wherein the location-based groups are topological groups and the nonlocation-based groups are selected from the group consisting of logical end systems groups and logical user groups.
Claim 6
Dependent Claim
16 words
The system of claim 1, further comprising a method for executing one or more enforceable policies.
Claim 7
Dependent Claim
17 words
The system of claim 1, the domain elements include at least one of topological and logical domains.
Claim 8
Dependent Claim
30 words
The system of claim 1, wherein the method for determining whether a conflict exists comprises determining whether the policies have an overlap in attributes of the domain elements and scheduling.
Claim 9
Dependent Claim
36 words
The system of claim 1, wherein the domain elements include attributes and attribute values, the rules specify attribute values for the domain elements, and the method for determining whether conflicts exist includes comparing the attribute values.
Claim 10
Dependent Claim
32 words
The system of claim 8, wherein the rules are "if/then" rules having the attribute values on the "if" side of the rule and the actions on the "then" side of the rule.
Claim 11
Dependent Claim
36 words
The system of claim 1, wherein the actions include at least one of: permission or forbiddance of an operation on the network devices, modification of domain elements, display of a message, and entry in a log.
Claim 12
Dependent Claim
60 words
The system of claim 1, wherein the method for determining a conflict for a domain element E comprises: collecting all domain elements D of which E is a member; collecting the rules that apply to each domain element D, if any, and the rules that apply to E, if any; and determining whether any conflicts exist between the collected rules.
Claim 13
Dependent Claim
68 words
The system of claim 1, wherein the method of resolving conflicts includes at least one of: selecting the policy that issues from a pre-defined priority; selecting the policy that issues from the least specific domain element among the conflicting policies; selecting the policy that satisfies a largest number of conditions included in the conflicting policies; reporting the conflicting policies to a user and allowing the user to adjudicate.
Claim 14
Dependent Claim
16 words
The system of claim 1, wherein the method for resolving conflicts comprises determining one prevalent policy.
Claim 15
Dependent Claim
25 words
The system of claim 1, wherein the method for resolving conflicts comprises determining one prevalent policy made up of prevalent attributes of the domain elements.
Claim 16
Dependent Claim
33 words
The system of claim 1, wherein the domain elements are hierarchial and the method for resolving conflicts comprises resolving any conflicts at the highest level of the hierarchy at which the conflict arises.
Claim 17
Independent Claim
119 words
A method for determining and resolving conflicts among multiple policies applied in real time for determining an enforceable policy applicable to one or more network devices, the method comprising: creating a plurality of policy object sets, a policy object set being created by attaching at least one rule to one or more objects representing network devices or groups of network devices; determining whether a conflict exists among an intersection of policy object sets wherein a conflict exists when two or more of the policy object sets operate on the same or an intersecting set of objects and have overlapping enforcement schedules; and resolving any conflict at the specific point of set intersection to produce one or more enforceable policies.
Claim 18
Independent Claim
119 words
A method for determining and resolving conflicts among multiple policies applied in real time for determining an enforceable policy applicable to one or more network devices, the method comprising: creating a plurality of policy object sets, a policy object set being created by attaching at least one rule to one or more objects representing network devices or groups of network devices; determining whether a conflict exists among an intersection of policy object sets wherein a conflict exists when two or more of the policy object sets operate on the same or an intersecting set of objects and have overlapping enforcement schedules; and resolving any conflict at the specific point of set intersection to produce one or more enforceable policies.
Claim 19
Independent Claim
123 words
A method for determining and resolving conflicts among multiple policies applied in real time for determining an enforceable configuration policy applicable to one or more network devices, comprising the steps of: providing a data structure including configuration records and domain elements, the domain elements representing network devices and groups of network devices; attaching at least one of the configuration records to at least one domain element to produce multiple configuration policies; and determining whether any conflicts exist among the multiple configuration policies, wherein a conflict exists when two or more of the multiple configuration policies operate on the same or an intersecting set of domain elements and have overlapping enforcement schedules and resolving the conflicts to produce one or more enforceable configuration policies.
Claim 20
Independent Claim
123 words
A method for determining and resolving conflicts among multiple policies applied in real time for determining an enforceable configuration policy applicable to one or more network devices, comprising the steps of: providing a data structure including configuration records and domain elements, the domain elements representing network devices and groups of network devices; attaching at least one of the configuration records to at least one domain element to produce multiple configuration policies; and determining whether any conflicts exist among the multiple configuration policies, wherein a conflict exists when two or more of the multiple configuration policies operate on the same or an intersecting set of domain elements and have overlapping enforcement schedules and resolving the conflicts to produce one or more enforceable configuration policies.
Claim 21
Dependent Claim
22 words
The method of claim 17, further comprising: loading a configuration described by the enforceable configuration policies into one or more network devices.
Claim 22
Dependent Claim
71 words
The method of claim 17, wherein the determining step occurs in response to a trigger which includes at least one of: a device in the network has been activated; a device in the network has been deactivated; the network has been deactivated; the network has been deactivated; a device has been added to a network; a scheduler has determined a trigger event; and a user has manually triggered a trigger event.
Claim 23
Dependent Claim
54 words
The method of claim 17, wherein the step of determining whether any conflicts exist for a domain element E includes the steps of: determining applicable policies for the domain element E, the applicable policies each having attributes and associated attribute values; and determining whether any of the policies have different values for one attribute.
Claim 24
Dependent Claim
29 words
The method of claim 17, wherein the step of resolving includes the steps of: selecting a resolution strategy; and selecting one of the policies according to the resolution strategy.
Claim 25
Dependent Claim
66 words
The method of claim 21, wherein the step of selecting a resolution strategy includes selecting one of: a policy that more specifically defines a policy; a policy that less specifically defines a policy; an applicable policy that includes a largest number of satisfied conditions among conditions set forth in the applicable policies; and enabling a user to select a policy from the plurality of applicable policies.
Claim 26
Dependent Claim
43 words
The method of claim 17, further comprising the step of providing an output which includes at least one of: a configuration load; a notice of conflicting configuration policies; a notice that no action is required; and a report of the overall network configuration.
Claim 27
Dependent Claim
77 words
The method of claim 17, wherein the step of determining and resolving conflicts for a domain element E comprises: collecting all domain elements D of which E is a member; collecting the configuration records that attach to each domain element D, if any, and the configuration records for E, if any; for each collected configuration record, selecting those that attach to domain elements that are members of E; resolving any conflicting attachments, producing the enforceable configuration policies.
Claim 28
Dependent Claim
28 words
The method of claim 18, wherein the configuration records include an ordering index, and the step of loading includes loading according to the value of the ordering index.
Claim 29
Dependent Claim
26 words
The method of claim 17, wherein the configuration records include conditions, and the step of determining enforceable policies includes determining whether the conditions have been satisfied.
Claim 30
Dependent Claim
80 words
The method of claim 17, wherein the step of resolving conflicts for a domain element E includes selecting a conflict resolution strategy from one of: a) selecting a policy which is attached to the most specific network domain; b) selecting a policy which satisfies a greatest number of conditions; c) if the result of both (a) and (b) is a conflict, selecting the policy from (a); and d) reporting conflicting policies to a user and allowing the user to adjudicate.
Claim 31
Independent Claim
141 words
A method of determining connectivity in a communications network between a source and a destination, the method comprising: partitioning the network into a plurality of groups; providing policies applicable to at least one of the source, destination and select groups of network devices; for a desired connection between a source and a destination determining and resolving conflicts among multiple policies applied in real time for the desired connection including: collecting the policies applicable to the source and any groups associated with the source to determine an outbound policy term; collecting the policies applicable to the destination and any groups associated with the destination to determine an inbound policy term; resolving any conflicts between the inbound and outbound policy terms to determine an operating policy; and applying the operating policy for a duration of an allowed communication between the source and destination.
Claim 32
Independent Claim
141 words
A method of determining connectivity in a communications network between a source and a destination, the method comprising: partitioning the network into a plurality of groups; providing policies applicable to at least one of the source, destination and select groups of network devices; for a desired connection between a source and a destination determining and resolving conflicts among multiple policies applied in real time for the desired connection including: collecting the policies applicable to the source and any groups associated with the source to determine an outbound policy term; collecting the policies applicable to the destination and any groups associated with the destination to determine an inbound policy term; resolving any conflicts between the inbound and outbound policy terms to determine an operating policy; and applying the operating policy for a duration of an allowed communication between the source and destination.
Claim 33
Dependent Claim
35 words
The method of claim 28, wherein a child member of a group inherits all of the policies of ancestor members of the group, but the child member is allowed to override certain of these policies.
Claim 34
Dependent Claim
46 words
The method of claim 29, wherein the policies of the ancestors are inherited when the child policy is represented by a "don't care" entry, and the policies of the ancestors are not inherited when the child explicitly defines a policy different from that of the ancestors.
Claim 35
Dependent Claim
32 words
The method of claim 30, wherein the operating policy is determined by projecting the policy term towards the most distant ancestor until all "don't care" entries have been replaced by actual values.
Claim 36
Dependent Claim
14 words
The method of claim 28, wherein the operating policy includes a type of service.
Claim 37
Dependent Claim
14 words
The method of claim 28, wherein the policies include location-based policies and non-location-based policies.
Claim 38
Dependent Claim
15 words
The method of claim 33, wherein the non-location-based policies take precedence over the location-based policies.
Claim 39
Dependent Claim
50 words
The method of claim 28, wherein the groups include both of: a numbering-plan end station group comprising a group of end stations within a topological area of the network; a generic group comprising at least one of a non-location based group of end stations, and a non-location based user group.
Claim 40
Dependent Claim
22 words
The method of claim 35, wherein a user's policy is automatically attached to an end station at which the user is authenticated.
Claim 41
Dependent Claim
14 words
The method of claim 35, wherein a user's policy supplements an end station policy.
Claim 42
Dependent Claim
14 words
The method of claim 35, wherein an end station policy is a default policy.
Claim 43
Dependent Claim
19 words
The method of claim 38, wherein a user's policy is a specific policy having precedence over the default policy.
Claim 44
Dependent Claim
13 words
The method of claim 35, wherein a user's policy defines network access privileges.
Claim 45
Dependent Claim
17 words
The method of claim 35, wherein a user's policy defines the network resources allocated to the users.
Claim 46
Dependent Claim
38 words
The method of claim 35, wherein: a numbering plan end station policy is a base policy; a generic end station policy has a higher precedence than the base policy; and a generic user policy has the highest precedence.
Claim 47
Dependent Claim
26 words
The method of claim 28, wherein the outbound policy term includes one or more of: access policy, usage policy, routing policy, administrative policy and connectionless-access policy.
Claim 48
Dependent Claim
29 words
The method of claim 28, wherein the inbound policy term includes one or more of: access permission, maximum connection time, maximum connection count, audit trail flag, and connection priority.
Claim 49
Dependent Claim
65 words
The method of claim 28, wherein a conflict between the input and output policy terms is resolved by the following rules: 1. For routing, only outbound policy is considered; 2. Access is granted if both inbound and outbound policies allow it; 3. Audit trail is done if either the source or a destination policy say "yes"; 4. For other policies, liberal or conservative rules apply.
Claim 50
Dependent Claim
45 words
The method of claim 28, wherein a conflict between source peer work groups is resolved by selecting from the following rules: 1. A liberal policy that picks the highest among the conflicting values; 2. A conservative policy that picks the lowest among the conflicting values.
Claim 51
Dependent Claim
51 words
The method of claim 28, wherein a conflicts between destination peer work groups is resolved by selecting from the following rules: 1. A liberal policy that permits access or picks the highest among the conflicting values; 2. A conservative policy that denies access or picks the lowest among the conflicting values.
Claim 52
Independent Claim
173 words
A method of determining connectivity in a communications system between a first user at a source and a second user at a destination for one of a plurality of different types of communication service, the method comprising: providing a plurality of policy rules for different connections based on different users, sources, destinations and types of service, each policy rule having one or more attributes and at least one of the attributes specifying whether a connection is allowed, a plurality of policy rules being created by attaching one or more rule elements to one or more domain elements; selecting one or more policy rules based on a first user, second user, source, destination and service type for a desired connection and determining and resolving conflicts among the selected policy rules applied in real time for the desired connection to determine an enforceable operating policy from the combined attributes of the selected policy rules; wherein if the enforceable operating policy allows the desired connection, implementing the desired connection in accordance with the enforceable operating policy.
Claim 53
Independent Claim
173 words
A method of determining connectivity in a communications system between a first user at a source and a second user at a destination for one of a plurality of different types of communication service, the method comprising: providing a plurality of policy rules for different connections based on different users, sources, destinations and types of service, each policy rule having one or more attributes and at least one of the attributes specifying whether a connection is allowed, a plurality of policy rules being created by attaching one or more rule elements to one or more domain elements; selecting one or more policy rules based on a first user, second user, source, destination and service type for a desired connection and determining and resolving conflicts among the selected policy rules applied in real time for the desired connection to determine an enforceable operating policy from the combined attributes of the selected policy rules; wherein if the enforceable operating policy allows the desired connection, implementing the desired connection in accordance with the enforceable operating policy.
Claim 54
Dependent Claim
34 words
The method of claim 48, wherein the selecting step includes selecting, from among a rule set of more general to more specific policy rules, a more specific policy rule applicable to the desired connection.
Claim 55
Dependent Claim
44 words
The method of claim 49, wherein the selecting step includes selecting a plurality of policy rules applicable to the desired connection, and wherein a value for each one of the combined attributes is selected from the more specific policy rule defining that one attribute.
Claim 56
Dependent Claim
101 words
The method of claim 48, wherein the providing step includes providing a first set of outbound policy rules for the first user and the source, and providing a second set of inbound policy rules for the second user and the destination, and wherein the selecting step includes selecting at least one outbound policy rule from the outbound rule set and at least one inbound policy rule from the inbound policy rule set, and selecting from among the operating policy attributes of the selected outbound policy rule and selected inbound policy rule to provide the combined attributes of the enforceable operating policy.
Claim 57
Dependent Claim
72 words
The method of claim 51, wherein attribute values are selected from the group consisting of "allowed", "don't care", and "not allowed", and wherein a conflict between attribute values in the selected outbound policy rule and selected inbound policy rule is resolved by: (1) if either value is "not allowed", then the "not allowed" attribute value is chosen; and (2) if either value is "don't care", then the other attribute value is chosen.
Claim 58
Dependent Claim
77 words
The method of claim 51, wherein attribute values have a range of increasing to decreasing values, and wherein a conflict between attribute values in the selected outbound policy rule and selected inbound policy rule is resolved based on a preset bias level wherein: (1) if the bias level is "plus", then the greater of the two attribute values is chosen; (2) if the bias level is "minus", then the lesser of the two attribute values is chosen.
Claim 59
Dependent Claim
35 words
The method of claim 51, wherein a conflict between the attribute values of the selected inbound policy rule and selected outbound policy rule is resolved by choosing the attribute value of the outbound policy rule.
References Cited (Backward Citations)
US5193152A
Cited
EP0605106A1
Cited
EP0609990A2
Cited
US5557747A
Cited
WO1996026588A1
Cited
US5797128A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-03-29 | 2002-09-28 | 2003-03-30 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-03-29 | 2006-09-28 | 2007-03-30 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-03-29 | 2010-09-28 | 2011-03-30 | $7700.00 | Window Closed / Lapsed |