US6327618B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Recognizing and processing conflicts in network management policies
Assignee: Cisco Technology Inc
•
Filing: 1998-12-03
•
Granted: 2001-12-04
•
Expires: 2018-12-03
Abstract
Abstract A method and apparatus are provided for recognizing and processing conflicts in policies that govern a policy-based system. The method and apparatus may be implemented as a policy verifier that acts upon one or more policies. Each policy is formally defined and comprises a condition and a consequent, each of which are further formally defined in terms of component elements. A conflict among two or more policies is formally defined to occur when the condition of a first policy and the condition of a second policy may be simultaneously true, and when the consequent of the first policy and the consequent of the second policy may not be carried out simultaneously. When a policy conflict is detected, the conflict is resolved by bringing it to the attention of a user or external system, and receiving information that corrects one of the policies or specifies a precedence relationship among the policies.
Inventors
- 👤 John K. Ahlstrom
- 👤 Stephen I. Schleimer
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 19:48
CPC Classifications
H; H04; H04L; H04L41/00; H04L41/02; H04L41/0213; H04L41/08; H04L41/0893; H04L41/0894; Y; Y10; Y10S; Y10S707/00; Y10S707/99931; Y10S707/99933; Y10S707/99935
Claims Analysis
Total Claims: 45
Claim 1
Independent Claim
143 words
A method of recognizing and resolving a conflict among at least a first policy and a second policy that govern a policy-based system, comprising the computer-implemented steps of: receiving the first policy and the second policy, wherein the first policy and the second policy are defined according to a formal policy definition; verifying that the first policy and the second policy each conform to the formal policy definition by performing the steps of: verifying that the first policy and the second policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first policy and the second policy conflict, according to a set of conflict tests; and when the first policy and the second policy conflict, resolving the conflict among the policies.
Claim 2
Independent Claim
143 words
A method of recognizing and resolving a conflict among at least a first policy and a second policy that govern a policy-based system, comprising the computer-implemented steps of: receiving the first policy and the second policy, wherein the first policy and the second policy are defined according to a formal policy definition; verifying that the first policy and the second policy each conform to the formal policy definition by performing the steps of: verifying that the first policy and the second policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first policy and the second policy conflict, according to a set of conflict tests; and when the first policy and the second policy conflict, resolving the conflict among the policies.
Claim 3
Dependent Claim
18 words
The method recited in claim 1 , wherein each policy comprises at least one consequent for each condition.
Claim 4
Dependent Claim
49 words
The method recited in claim 2 , wherein the at least one consequent indicates one of the following: to allow information to pass through the policy-based system; to deny information from passing through the policy-based system; to mark information passing through the policy-based system; or to initiate a service.
Claim 5
Dependent Claim
26 words
The method recited in claim 2 , wherein the at least one consequent identifies a state that is to be established when the condition is satisfied.
Claim 6
Dependent Claim
28 words
The method recited in claim 2 , wherein the at least one consequent identifies an action that is to be taken or attempted when the condition is satisfied.
Claim 7
Dependent Claim
23 words
The method recited in claim 1 , wherein at least one condition element identifies a service type, a user type, or a time.
Claim 8
Dependent Claim
23 words
The method recited in claim 1 , wherein at least one condition element identifies a source address, a destination address or a port.
Claim 9
Dependent Claim
62 words
The method recited in claim 1 , wherein the step of testing comprises the steps of: identifying the conflict when a first condition of the first policy and a second condition of the second policy may be simultaneously true and when a first consequent of the first policy and a second consequent of the second policy may not be carried out simultaneously.
Claim 10
Dependent Claim
41 words
The method recited in claim 1 , wherein the step of resolving comprises the steps of: displaying information that describes the conflict; and receiving modification information that modifies the first policy or the second policy so as to eliminate the conflict.
Claim 11
Dependent Claim
42 words
The method recited in claim 1 , wherein the step of resolving comprises the steps of: displaying information that describes the conflict; and receiving precedence information that identifies whether the first policy or the second policy shall take precedence over the other.
Claim 12
Dependent Claim
33 words
The method recited in claim 1 , further comprising the steps of: when either the first policy or the second policy is not defined according to the formal policy definition, generating an error.
Claim 13
Dependent Claim
179 words
In a network management system, a method of recognizing and resolving a conflict among at least a first network management policy and a second network management policy that govern operation of a network, comprising the computer-implemented steps of: receiving the first network management policy and the second network management policy, wherein the first network management policy and the second network management policy are defined according to a formal policy definition; verifying that the first network management policy and the second network management policy each conform to the formal policy definition by performing the steps of: verifying that the first network management policy and the second network management policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first network management policy and the second network management policy conflict, according to a set of conflict tests; and when the first network management policy and the second network management policy conflict, resolving the conflict among the network management policies.
Claim 14
Dependent Claim
179 words
In a network management system, a method of recognizing and resolving a conflict among at least a first network management policy and a second network management policy that govern operation of a network, comprising the computer-implemented steps of: receiving the first network management policy and the second network management policy, wherein the first network management policy and the second network management policy are defined according to a formal policy definition; verifying that the first network management policy and the second network management policy each conform to the formal policy definition by performing the steps of: verifying that the first network management policy and the second network management policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first network management policy and the second network management policy conflict, according to a set of conflict tests; and when the first network management policy and the second network management policy conflict, resolving the conflict among the network management policies.
Claim 15
Dependent Claim
61 words
The method recited in claim 12 , wherein each network management policy comprises at least one consequent for each condition, and wherein the at least one consequent indicates one of the following: to allow information to pass through the network; to deny information from passing through the network; to mark information passing through the network; or to initiate a network service.
Claim 16
Dependent Claim
70 words
The method recited in claim 12 , wherein the step of testing comprises the steps of: identifying the conflict when a first condition of the first network management policy and a second condition of the second network management policy may be simultaneously true and when a first consequent of the first network management policy and a second consequent of the second network management policy may not be carried out simultaneously.
Claim 17
Dependent Claim
69 words
The method recited in claim 12 , wherein the step of resolving comprises the steps of: displaying information that describes the conflict; and receiving modification information that modifies the first network management policy or the second network management policy so as to eliminate the conflict, or receiving precedence information that identifies whether the first network management policy or the second network management policy shall take precedence over the other.
Claim 18
Dependent Claim
172 words
A computer-readable medium carrying one or more sequences of instructions for recognizing and resolving a conflict among at least a first policy and a second policy that govern a policy-based system, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of: receiving the first policy and the second policy, wherein the first policy and the second policy are defined according to a formal policy definition; verifying that the first policy and the second policy each conform to the formal policy definition by performing the steps of: verifying that the first policy and the second policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first policy and the second policy conflict, according to a set of conflict tests; and when the first policy and the second policy conflict, resolving the conflict among the policies.
Claim 19
Dependent Claim
172 words
A computer-readable medium carrying one or more sequences of instructions for recognizing and resolving a conflict among at least a first policy and a second policy that govern a policy-based system, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of: receiving the first policy and the second policy, wherein the first policy and the second policy are defined according to a formal policy definition; verifying that the first policy and the second policy each conform to the formal policy definition by performing the steps of: verifying that the first policy and the second policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first policy and the second policy conflict, according to a set of conflict tests; and when the first policy and the second policy conflict, resolving the conflict among the policies.
Claim 20
Dependent Claim
19 words
The computer-readable medium recited in claim 16 , wherein each policy comprises at least one consequent for each condition.
Claim 21
Dependent Claim
50 words
The computer-readable medium recited in claim 17 , wherein the at least one consequent indicates one of the following: to allow information to pass through the policy-based system; to deny information from passing through the policy-based system; to mark information passing through the policy-based system; or to initiate a service.
Claim 22
Dependent Claim
27 words
The computer-readable medium recited in claim 17 , wherein the at least one consequent identifies a state that is to be established when the condition is satisfied.
Claim 23
Dependent Claim
29 words
The computer-readable medium recited in claim 17 , wherein the at least one consequent identifies an action that is to be taken or attempted when the condition is satisfied.
Claim 24
Dependent Claim
81 words
The computer-readable medium recited in claim 16 , wherein the step of testing comprises instructions which, when executed by one or more processors, cause the one or more processors to carry out the steps of: identifying the conflict when a first condition of the first policy and a second condition of the second policy may be simultaneously true and when a first consequent of the first policy and a second consequent of the second policy may not be carried out simultaneously.
Claim 25
Dependent Claim
60 words
The computer-readable medium recited in claim 16 , wherein the step of resolving comprises instructions which, when executed by one or more processors, cause the one or more processors to carry out the steps of: displaying information that describes the conflict; and receiving modification information that modifies the first policy or the second policy so as to eliminate the conflict.
Claim 26
Dependent Claim
61 words
The computer-readable medium recited in claim 16 , wherein the step of resolving comprises instructions which, when executed by one or more processors, cause the one or more processors to carry out the steps of: displaying information that describes the conflict; and receiving precedence information that identifies whether the first policy or the second policy shall take precedence over the other.
Claim 27
Independent Claim
152 words
An apparatus for recognizing and resolving a conflict among at least a first policy and a second policy that govern a policy-based system, comprising: means for receiving the first policy and the second policy, wherein the first policy and the second policy are defined according to a formal policy definition; means for verifying that the first policy and the second policy each conform to the formal policy definition, wherein the means for verifying comprise: means for verifying that the first policy and the second policy each contain exactly one condition; and means for verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; means for testing whether the first policy and the second policy conflict, according to a set of conflict tests; and means for resolving the conflict among the policies, when the first policy and the second policy conflict.
Claim 28
Independent Claim
152 words
An apparatus for recognizing and resolving a conflict among at least a first policy and a second policy that govern a policy-based system, comprising: means for receiving the first policy and the second policy, wherein the first policy and the second policy are defined according to a formal policy definition; means for verifying that the first policy and the second policy each conform to the formal policy definition, wherein the means for verifying comprise: means for verifying that the first policy and the second policy each contain exactly one condition; and means for verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; means for testing whether the first policy and the second policy conflict, according to a set of conflict tests; and means for resolving the conflict among the policies, when the first policy and the second policy conflict.
Claim 29
Dependent Claim
18 words
The apparatus recited in claim 24 , wherein each policy comprises at least one consequent for each condition.
Claim 30
Dependent Claim
49 words
The apparatus recited in claim 25 , wherein the at least one consequent indicates one of the following: to allow information to pass through the policy-based system; to deny information from passing through the policy-based system; to mark information passing through the policy-based system; or to initiate a service.
Claim 31
Dependent Claim
26 words
The apparatus recited in claim 25 , wherein the at least one consequent identifies a state that is to be established when the condition is satisfied.
Claim 32
Dependent Claim
28 words
The apparatus recited in claim 25 , wherein the at least one consequent identifies an action that is to be taken or attempted when the condition is satisfied.
Claim 33
Dependent Claim
61 words
The apparatus recited in claim 24 , wherein the means for testing comprises: means for identifying the conflict when a first condition of the first policy and a second condition of the second policy may be simultaneously true and when a first consequent of the first policy and a second consequent of the second policy may not be carried out simultaneously.
Claim 34
Dependent Claim
42 words
The apparatus recited in claim 24 , wherein the means for resolving comprises: means for displaying information that describes the conflict; and means for receiving modification information that modifies the first policy or the second policy so as to eliminate the conflict.
Claim 35
Dependent Claim
43 words
The apparatus recited in claim 24 , wherein the means for resolving comprises: means for displaying information that describes the conflict; and means for receiving precedence information that identifies whether the first policy or the second policy shall take precedence over the other.
Claim 36
Independent Claim
192 words
An apparatus for recognizing and resolving a conflict in a network management system among at least a first network management policy and a second network management policy that govern operation of a network, comprising the computer-implemented steps of: means for receiving the first network management policy and the second network management policy, wherein the first network management policy and the second network management policy are defined according to a formal policy definition; means for verifying that the first network management policy and the second network management policy each conform to the formal policy definition, wherein the means for verifying comprises: means for verifying that the first network management policy and the second network management policy each contain exactly one condition; and means for verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; means for testing whether the first network management policy and the second network management policy conflict, according to a set of conflict tests; and means for resolving the conflict among the network management policies, when the first network management policy and the second network management policy conflict.
Claim 37
Independent Claim
192 words
An apparatus for recognizing and resolving a conflict in a network management system among at least a first network management policy and a second network management policy that govern operation of a network, comprising the computer-implemented steps of: means for receiving the first network management policy and the second network management policy, wherein the first network management policy and the second network management policy are defined according to a formal policy definition; means for verifying that the first network management policy and the second network management policy each conform to the formal policy definition, wherein the means for verifying comprises: means for verifying that the first network management policy and the second network management policy each contain exactly one condition; and means for verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; means for testing whether the first network management policy and the second network management policy conflict, according to a set of conflict tests; and means for resolving the conflict among the network management policies, when the first network management policy and the second network management policy conflict.
Claim 38
Dependent Claim
61 words
The apparatus recited in claim 32 , wherein each network management policy comprises at least one consequent for each condition, and wherein the at least one consequent indicates one of the following: to allow information to pass through the network; to deny information from passing through the network; to mark information passing through the network; or to initiate a network service.
Claim 39
Dependent Claim
69 words
The apparatus recited in claim 32 , wherein the means for testing comprises: means for identifying the conflict when a first condition of the first network management policy and a second condition of the second network management policy may be simultaneously true and when a first consequent of the first network management policy and a second consequent of the second network management policy may not be carried out simultaneously.
Claim 40
Dependent Claim
70 words
The apparatus recited in claim 32 , wherein the means for resolving comprises: means for displaying information that describes the conflict; and means for receiving modification information that modifies the first network management policy or the second network management policy so as to eliminate the conflict, or receiving precedence information that identifies whether the first network management policy or the second network management policy shall take precedence over the other.
Claim 41
Independent Claim
218 words
An apparatus for recognizing and resolving a conflict in a network management system among at least a first network management policy and a second network management policy that govern operation of a network, comprising the computer-implemented steps of: a network interface; a processor coupled to the network interface and receiving information from the network interface; one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: receiving the first network management policy and the second network management policy, wherein the first network management policy and the second network management policy are defined according to a formal policy definition; verifying that the first network management policy and the second network management policy each conform to the formal policy definition by performing the steps of: verifying that the first network management policy and the second network management policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first network management policy and the second network management policy conflict, according to a set of conflict tests; and when the first network management policy and the second network management policy conflict, resolving the conflict among the network management policies.
Claim 42
Independent Claim
218 words
An apparatus for recognizing and resolving a conflict in a network management system among at least a first network management policy and a second network management policy that govern operation of a network, comprising the computer-implemented steps of: a network interface; a processor coupled to the network interface and receiving information from the network interface; one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: receiving the first network management policy and the second network management policy, wherein the first network management policy and the second network management policy are defined according to a formal policy definition; verifying that the first network management policy and the second network management policy each conform to the formal policy definition by performing the steps of: verifying that the first network management policy and the second network management policy each contain exactly one condition; and verifying that each condition expresses one or more Boolean relations among one or more condition categories and one or more condition elements; testing whether the first network management policy and the second network management policy conflict, according to a set of conflict tests; and when the first network management policy and the second network management policy conflict, resolving the conflict among the network management policies.
Claim 43
Dependent Claim
58 words
The apparatus recited in claim 36 , wherein each network management policy comprises at least one consequent for each condition, and wherein the consequent indicates one of the following: to allow information to pass through the network; to deny information from passing through the network; to mark information passing through the network; or to initiate a network service.
Claim 44
Dependent Claim
84 words
The apparatus recited in claim 36 , wherein the instructions for testing further comprise instructions which, when executed by the processor, cause the processor to carry out the steps of: identifying the conflict when a first condition of the first network management policy and a second condition of the second network management policy may be simultaneously true and when a first consequent of the first network management policy and a second consequent of the second network management policy may not be carried out simultaneously.
Claim 45
Dependent Claim
83 words
The apparatus recited in claim 36 , wherein the instructions for resolving further comprise instructions which, when executed by the processor, cause the processor to carry out the steps of: displaying information that describes the conflict; and receiving modification information that modifies the first network management policy or the second network management policy so as to eliminate the conflict, or receiving precedence information that identifies whether the first network management policy or the second network management policy shall take precedence over the other.
References Cited (Backward Citations)
US5557747A
Cited
US5872928A
Cited
US5889953A
Cited
US5797128A
Cited
US6009274A
Cited
US6064656A
Cited
US6167445A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-12-03 | 2005-06-04 | 2005-12-04 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-12-03 | 2009-06-04 | 2009-12-04 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-12-03 | 2013-06-04 | 2013-12-04 | $7700.00 | Window Closed / Lapsed |