IP Library › Granted Patent US 11,233,742
Granted Patent B2
US 11,233,742 · App. 16/674,693 · Granted Jan 25, 2022

Network policy architecture

Inventors: Samir Dilipkumar Saklikar (Milpitas, CA); Jayaraman Iyer (Sunnyvale, CA); Robin Edgard Martherus (Gilbert, AZ); Morteza Ansari (Newark, CA); Jyoti Verma (Saratoga, CA)
Assignee: CISCO TECHNOLOGY, INC.
H04L47/20H04L41/0893H04L43/08H04L67/10
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,233,742
App. No.
16/674,693
Granted
Jan 25, 2022
Kind
B2
Abstract

One or more lower-level attributes of a first network policy are translated to one or more higher-level attributes of the first network policy, and one or more lower-level attributes of a second network policy are translated to one or more higher-level attributes of the second network policy. The first network policy controls how first network traffic is handled, and the second network policy controls how second network traffic is handled. The one or more higher-level attributes of the first network policy are compared with the one or more higher-level attributes of the second network policy. Based on the comparing, it is determined whether the first network traffic and the second network traffic are handled in a functionally equivalent manner. If not, the first network policy is dynamically updated to generate an updated first network policy that causes the first network traffic to be handled in the functionally equivalent manner.

Claims (74)

1. A method comprising:

translating one or more lower-level attributes of a first network policy to one or more higher-level attributes of the first network policy, wherein the first network policy controls how first network traffic is handled;

translating one or more lower-level attributes of a second network policy to one or more higher-level attributes of the second network policy, wherein the second network policy controls how second network traffic is handled;

comparing the one or more higher-level attributes of the first network policy with the one or more higher-level attributes of the second network policy;

based on the comparing, determining whether the first network traffic and the second network traffic are handled in a functionally equivalent manner;

if it is determined that the first network traffic and the second network traffic are not handled in the functionally equivalent manner, dynamically updating the first network policy to generate an updated first network policy that causes the first network traffic to be handled in the functionally equivalent manner;

obtaining an indication of how the first network traffic is being handled;

based on the indication of how the first network traffic is being handled, determining that one or more unknown network policies control how the first network traffic is handled; and

in response to determining that the one or more unknown network policies control how the first network traffic is handled, identifying the one or more unknown network policies.

2. The method of claim 1 , further comprising:

if it is determined that the first network traffic and the second network traffic are handled in the functionally equivalent manner, providing an indication of the first network policy to one or more network policy enforcement points that instantiate the first network policy.

3. The method of claim 2 , wherein providing the indication of the first network policy to the one or more network policy enforcement points includes providing the indication of the first network policy to one or more network nodes configured to enforce the first network policy.

4. The method of claim 1 , wherein:

translating the one or more lower-level attributes of the first network policy to the one or more higher-level attributes of the first network policy includes determining that the one or more higher-level attributes of the first network policy comprises a group including the one or more lower-level attributes of the first network policy; and

translating the one or more lower-level attributes of the second network policy to the one or more higher-level attributes of the second network policy includes determining that the one or more higher-level attributes of the second network policy comprises a group including the one or more lower-level attributes of the second network policy.

5. The method of claim 1 , wherein:

translating the one or more lower-level attributes of the first network policy to the one or more higher-level attributes of the first network policy includes determining that the one or more lower-level attributes of the first network policy are semantically mapped to the one or more higher-level attributes of the first network policy; and

translating the one or more lower-level attributes of the second network policy to the one or more higher-level attributes of the second network policy includes determining that the one or more lower-level attributes of the second network policy are semantically mapped to the one or more higher-level attributes of the second network policy.

6. The method of claim 1 , further comprising:

obtaining an indication of a global condition for the first network policy; and

generating the first network policy based on the indication of the global condition for the first network policy.

7. The method of claim 1 , further comprising:

obtaining an indication of a corrective action to be enforced by the first network policy; and

generating the first network policy based on the indication of the corrective action to be enforced by the first network policy.

8. An apparatus comprising:

a network interface configured to provide and/or obtain network communications; and

one or more processors coupled to the network interface, wherein the one or more processors are configured to:

translate one or more lower-level attributes of a first network policy to one or more higher-level attributes of the first network policy, wherein the first network policy controls how first network traffic is handled;

translate one or more lower-level attributes of a second network policy to one or more higher-level attributes of the second network policy, wherein the second network policy controls how second network traffic is handled;

compare the one or more higher-level attributes of the first network policy with the one or more higher-level attributes of the second network policy;

based on the compare, determine whether the first network traffic and the second network traffic are handled in a functionally equivalent manner;

if it is determined that the first network traffic and the second network traffic are not handled in the functionally equivalent manner, dynamically update the first network policy to generate an updated first network policy that causes the first network traffic to be handled in the functionally equivalent manner;

obtain an indication of how the first network traffic is being handled;

based on the indication of how the first network traffic is being handled, determine that one or more unknown network policies control how the first network traffic is handled; and

in response to determining that the one or more unknown network policies control how the first network traffic is handled, identify the one or more unknown network policies.

9. The apparatus of claim 8 , wherein the one or more processors are further configured to:

if it is determined that the first network traffic and the second network traffic are handled in the functionally equivalent manner, provide an indication of the first network policy to one or more network policy enforcement points that instantiate the first network policy.

10. The apparatus of claim 9 , wherein the one or more processors are configured to:

provide the indication of the first network policy to one or more network nodes configured to enforce the first network policy.

11. The apparatus of claim 8 , wherein the one or more processors are further configured to:

determine that the one or more higher-level attributes of the first network policy comprises a group including the one or more lower-level attributes of the first network policy; and

determine that the one or more higher-level attributes of the second network policy comprises a group including the one or more lower-level attributes of the second network policy.

12. The apparatus of claim 8 , wherein the one or more processors are further configured to:

determine that the one or more lower-level attributes of the first network policy are semantically mapped to the one or more higher-level attributes of the first network policy; and

determine that the one or more lower-level attributes of the second network policy are semantically mapped to the one or more higher-level attributes of the second network policy.

13. The apparatus of claim 8 , wherein the one or more processors are further configured to:

obtain an indication of a global condition for the first network policy; and

generate the first network policy based on the indication of the global condition for the first network policy.

14. The apparatus of claim 8 , wherein the one or more processors are further configured to:

obtain an indication of a corrective action to be enforced by the first network policy; and

generate the first network policy based on the indication of the corrective action to be enforced by the first network policy.

15. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:

translate one or more lower-level attributes of a first network policy to one or more higher-level attributes of the first network policy, wherein the first network policy controls how first network traffic is handled;

translate one or more lower-level attributes of a second network policy to one or more higher-level attributes of the second network policy, wherein the second network policy controls how second network traffic is handled;

compare the one or more higher-level attributes of the first network policy with the one or more higher-level attributes of the second network policy;

based on the comparison, determine whether the first network traffic and the second network traffic are handled in a functionally equivalent manner;

if it is determined that the first network traffic and the second network traffic are not handled in the functionally equivalent manner, dynamically update the first network policy to generate an updated first network policy that causes the first network traffic to be handled in the functionally equivalent manner;

obtain an indication of how the first network traffic is being handled;

based on the indication of how the first network traffic is being handled, determine that one or more unknown network policies control how the first network traffic is handled; and

in response to determining that the one or more unknown network policies control how the first network traffic is handled, identify the one or more unknown network policies.

16. The one or more non-transitory computer readable storage media of claim 15 , wherein the instructions further cause the processor to:

determine that the one or more higher-level attributes of the first network policy comprises a group including the one or more lower-level attributes of the first network policy; and

determine that the one or more higher-level attributes of the second network policy comprises a group including the one or more lower-level attributes of the second network policy.

17. The one or more non-transitory computer readable storage media of claim 15 , wherein the instructions further cause the processor to:

determine that the one or more lower-level attributes of the first network policy are semantically mapped to the one or more higher-level attributes of the first network policy; and

determine that the one or more lower-level attributes of the second network policy are semantically mapped to the one or more higher-level attributes of the second network policy.

18. The one or more non-transitory computer readable storage media of claim 15 , wherein the instructions further cause the processor to:

if it is determined that the first network traffic and the second network traffic are handled in the functionally equivalent manner, provide an indication of the first network policy to one or more network nodes configured to enforce the first network policy.

19. The one or more non-transitory computer readable storage media of claim 15 , wherein the instructions further cause the processor to:

obtain an indication of a global condition for the first network policy; and

generate the first network policy based on the indication of the global condition for the first network policy.

20. The one or more non-transitory computer readable storage media of claim 15 , wherein the instructions further cause the processor to:

obtain an indication of a corrective action to be enforced by the first network policy; and

generate the first network policy based on the indication of the corrective action to be enforced by the first network policy.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 6, 2019
From: SAKLIKAR, SAMIR DILIPKUMAR; IYER, JAYARAMAN; MARTHERUS, ROBIN EDGARD; ANSARI, MORTEZA; VERMA, JYOTI
To: CISCO TECHNOLOGY, INC.
Reel/Frame 050927/0070 →
Continuity (1)
Related Publication 20210135995A1 · May 6, 2021