Techniques for secured partitioning of an optical transmission system to provide multi-client management access and a network management system implementing same
A system and method consistent with the present disclosure allows for a single NMS system to manage data access and control for N number of customer domains and associated users. In particular, an NMS consistent with the present disclosure may include a configuration that partitions the optical communication system by domain. For each domain, partitioning can further define per-user access constraints and privileges including access to specific equipment by, for instance, fiber pair designation, wavelength designation, specifically identified hardware elements, component categories, or any combination thereof. The NMS system may utilize a proxy server approach to authentication, e.g., using RADIUS, that allows for each party/customer to maintain separate authentication databases and equipment-specific constraints. The NMS may therefore validate users and enforce domain restrictions via the partitioning information such that each user has a secure ‘view’ of only those portions of the system associated with their particular domain.
1. A system for managing an optical communication system having an optical transmission path disposed between at least two cable landing stations and a plurality of network elements disposed along the optical transmission path, the system comprising:
a network element table, the network element table defining a plurality of network element definitions that each represent a different network element of the optical communication system;
a partition mapping table, the partition mapping table associating each of the plurality of network element definitions with at least one domain identifier corresponding to a customer domain,
a network management system (NMS) controller to:
receive a user request to access a network element from a user, the user request being associated with a first domain identifier and including an identifier of an operation to perform;
determine the user request is authorized to access the network element based on the partition mapping table indicating that the first domain identifier is associated with the network element of the user request; and
in response to determining the user request is authorized, performing the operation, and
wherein the partition mapping table includes a hierarchal structure that associates a plurality of customer domains with cable landing stations of the optical communication system.
2. The system of claim 1 , further comprising a plurality of authenticator servers for storing a plurality of user access credentials and associated user access attributes, and wherein the NMS includes an authentication interface to communicate with the plurality of authenticator servers to validate user credentials received within the user request.
3. The system of claim 2 , wherein each of the plurality of authenticator servers is associated with a different domain identifier.
4. The system of claim 2 , wherein each of the plurality of the authenticator servers implement an Authentication, Authorization, and Accounting (AAA) protocol to receive authentication requests from the NMS controller.
5. The system of claim 2 , wherein the user access attributes define a first type of equipment a user has access to and one or more privileges for accessing the first type of equipment.
6. The system of claim 1 , wherein the partition mapping table includes at least one partition mapping configuration file, the at least one partition mapping configuration file defining a plurality of rules that associate each domain identifier with one or more cable landing stations, and equipment access rights for network elements associated with each cable landing station.
7. The system of claim 1 , wherein the NMS controller generates an access token in a memory in response to determining the user request is authorized, the access token to allow the NMS controller to validate subsequent user requests without accessing the partition mapping table and/or the network element table.
8. The system of claim 1 , wherein the partition mapping table and the network element table are distributed across a plurality of NMS server computers disposed in different cable landing stations.
9. The system of claim 1 , wherein the operation identifier within the user request comprises at least one of a request to retrieve log data from the network element and/or adjust a setting of the network element.
10. The system of claim 1 , wherein the NMS controller is configured to send a negative acknowledgement (NAK) to the user in response to a user request that attempts to perform an operation on equipment not assigned or restricted to the user based on the partition mapping table and a domain identifier associated with the user request.
11. The system of claim 1 , wherein the plurality of network elements are undersea network elements, the undersea network elements including at least one of an optical repeater, branching unit, and/or optical equalizer.
12. The system of claim 1 , wherein the network element table is generated from element management system (EMS) data from at least each of the at least two cable landing stations of the optical communication system.
13. The system of claim 1 , wherein the partition mapping table defines associations between (i) the plurality of customer domains and (ii) system components, the system components including at least equipment or the network elements, optical cables, fiber pairs, and channel wavelengths corresponding to the optical communication system.
14. A computer-implemented method for managing an optical communication system having an optical transmission path disposed between at least two cable landing stations and a plurality of network elements disposed along the optical transmission path, the method comprising:
receiving, by a controller, a user request to access a network element of the plurality of network elements from a user, the user request being associated with a first domain identifier and including an identifier of an operation to perform;
determining, by the controller, the user request is authorized to access the network element based on a partition mapping table indicating that the first domain identifier is associated with the network element of the user request; and
in response to determining the user request is authorized, performing the operation,
wherein the partition mapping table includes a hierarchal structure that associates a plurality of customer domains with cable landing stations of the optical communication system.
15. The computer-implemented method of claim 14 , further comprising sending a message with topology information to a user device to cause a graphical user interface (GUI) of the user device to visually depict the topology information.
16. The computer-implemented method of claim 14 , wherein in response to determining the user request is not authorized, sending a negative acknowledgment to the user.
17. The computer-implemented method of claim 14 , further comprising generating the partition mapping table, the partition mapping table associating each domain with one or more authorized cable landing stations and authorized equipment within each cable landing station.
18. An optical communication system, comprising:
an optical transmission path disposed between at least a first and second cable landing stations;
a plurality of undersea optical components coupled to the optical transmission path;
a network management system (NMS) controller to:
receive a user request to access an undersea optical component, the user request being associated with a first domain identifier and including an identifier of an operation to perform;
determine the user request is authorized to access the undersea optical component based on a partition mapping table indicating that the first domain identifier is associated with the undersea optical component of the user request; and
in response to determining the user request is authorized, performing the operation, and
wherein the partition mapping table includes a hierarchal structure that associates a plurality of customer domains with cable landing stations of the optical communication system.