Granted Patent B2

US 9,825,759 · App. 13/937,182 · Granted Nov 21, 2017

Abstract

Claims (65)

1. A method comprising:

identifying a tunnel to be affected by configuration of a service in a network;

obtaining key information for the identified tunnel from a corresponding router;

assigning the tunnel to a key group based on the key information; and

updating provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service;

wherein obtaining key information comprises receiving one or more key identifiers from the router;

wherein assigning the tunnel to a key group based on the key information comprises:

identifying a plurality of key groups that each include at least one of the received key identifiers; and

assigning the tunnel to a selected one of the identified key groups;

wherein selection of a particular one of the identified key groups is based on a number of routers associated with that key group; and

wherein the tunnel comprises a pseudowire tunnel.

2. The method of claim 1 wherein identifying the tunnel comprises:

identifying a plurality of routers to be affected by configuration of the service in the network; and

identifying a plurality of tunnels associated with the identified routers that will be affected by configuration of the service in the network.

3. The method of claim 2 wherein the obtaining, assigning and updating are repeated for each of the identified tunnels.

4. The method of claim 1 wherein updating provisioning information comprises altering the key information on the router to include a key associated with the assigned key group.

5. The method of claim 4 further comprising deleting from the key information one or more keys not associated with the assigned key group.

6. The method of claim 1 wherein updating provisioning information comprises updating a service access point entry on the router to replace a key identifier with a key group identifier.

7. The method of claim 1 further comprising deleting from a management entity one or more keys not associated with any assigned key group.

8. The method of claim 1 wherein the plurality of key groups comprise a first key group associated with first set of enterprise resources having a first level of security and a second key group associated with a second set of enterprise resources having a second level of security different than the first level of security.

9. The method of claim 8 wherein the first key group comprises a control key group associated with one or more network operations centers of a utility and the second key group comprises one of a transmission key group associated with transmission infrastructure of the utility and a distribution key group associated with distribution infrastructure of the utility.

10. The method of claim 1 wherein the key group comprises a plurality of keys including at least one encryption key and at least one authentication key.

11. The method of claim 1 wherein the key information obtained for the identified tunnel from the corresponding router comprises at least one key identifier identifying a particular cryptographic key currently utilized by that tunnel.

12. The method of claim 1 wherein assigning the tunnel to a key group based on the key information permits at least a portion of the key information to be eliminated from the network.

13. An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by at least one processing device causes said at least one processing device to:

identify a tunnel to be affected by configuration of a service in a network;

obtain key information for the identified tunnel from a corresponding router;

assign the tunnel to a key group based on the key information; and

update provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service;

wherein obtaining key information comprises receiving one or more key identifiers from the router;

wherein assigning the tunnel to a key group based on the key information comprises:

identifying a plurality of key groups that each include at least one of the received key identifiers; and

assigning the tunnel to a selected one of the identified key groups;

wherein selection of a particular one of the identified key groups is based on a number of routers associated with that key group; and

wherein the tunnel comprises a pseudowire tunnel.

14. The article of manufacture of claim 13 wherein updating provisioning information comprises altering the key information on the router to include a key associated with the assigned key group.

15. A service platform comprising:

an interface for communicatively coupling to a network management entity; and

a service database for storing a plurality of key groups;

wherein the service platform is configured to execute at least one service application that in cooperation with the network management entity:

identifies a tunnel to be affected by configuration of a service;

obtains key information for the identified tunnel from a corresponding router;

assigns the tunnel to a key group based on the key information; and

updates provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service;

wherein obtaining key information comprises receiving one or more key identifiers from the router;

wherein assigning the tunnel to a key group based on the key information comprises:

identifying a plurality of key groups that each include at least one of the received key identifiers; and

assigning the tunnel to a selected one of the identified key groups;

wherein selection of a particular one of the identified key groups is based on a number of routers associated with that key group; and

wherein the tunnel comprises a pseudowire tunnel.

16. A communication network comprising the service platform of claim 15 .

17. The communication network of claim 16 wherein the network comprises a Multiple Protocol Label Switching (MPLS) network.

18. The communication network of claim 16 wherein the router comprises a provider edge router of the network.

19. The service platform of claim 15 wherein updating provisioning information comprises altering the key information on the router to include a key associated with the assigned key group.

20. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

wherein said at least one processing device is configured to identify a tunnel to be affected by configuration of a service in a network, to obtain key information for the identified tunnel from a corresponding router of the network, to assign the tunnel to a key group based on the key information, and to update provisioning information associated with the tunnel on the router based on the assigned key group in conjunction with configuration of the service;

wherein obtaining key information comprises receiving one or more key identifiers from the router;

wherein assigning the tunnel to a key group based on the key information comprises:

identifying a plurality of key groups that each include at least one of the received key identifiers; and

assigning the tunnel to a selected one of the identified key groups;

wherein selection of a particular one of the identified key groups is based on a number of routers associated with that key group; and

wherein the tunnel comprises a pseudowire tunnel.

21. The apparatus of claim 20 wherein said at least one processing device implements a service platform adapted for communication with a network management entity of the network.

22. The apparatus of claim 20 wherein updating provisioning information comprises altering the key information on the router to include a key associated with the assigned key group.

Assignments (14)