Patent Application
20060106919
This invention relates generally to communication equipment and, in particular, to generating communication traffic control rules for communication equipment.
Access Control Lists (ACLs) are widely used in communication equipment to filter Internet Protocol (IP) traffic. ACLs include a list of rules which are applied to packets based on fields in the packet header such as source address, destination address, protocol ID, port ID, etc. ACLs are typically applied in a data path at line cards which provide an interface between communication equipment and a communication medium, and can be implemented either in hardware, for relatively simple rules, or software, for more complex rules. ACLs can also be applied at a control card for traffic that terminates on the communication equipment.
For communication equipment such as routers in a communication network, various configuration settings may also be established. Configuration settings may be used, for example, to enable or disable processing of particular types of communication traffic. Although configuration settings may thereby be used to control communication traffic, configuration settings are normally applied at higher architecture levels than ACLs. Thus, communication traffic which corresponds to a particular protocol which has not been enabled in configuration settings may be admitted into communication equipment and discarded only after further processing. ACLs are therefore often provided in addition to configuration settings to effectively block communication traffic before it is processed by higher-level communication equipment components.
According to conventional techniques, both configuration settings and ACLs are manually established or provisioned, using a command line interface (CLI) for instance. As those skilled in the art will appreciate, manual data entry is time consuming, prone to error, and often results in discrepancies between configuration settings and ACLs. For example, an operator of communication equipment might forget to establish an ACL for some configuration settings or make incorrect entries to block communication traffic for a protocol which has been enabled in configuration settings for the same communication equipment.
ACL provisioning is simplified to some extent by one known ACL solution which provides a predetermined type of ACL. However, the predetermined ACL is very basic, and provides for only complete blocking or allowing of communication traffic based on source address. More complex ACL functions such as rate limiting are not supported. The predetermined ACL also lacks the granularity to permit only certain protocols on a port.
Another known ACL product provides templates to aid in the creation of ACLs and supports ACL management functions. Although the templates may facilitate ACL creation by a user, user inputs are required to create ACLs. Similarly, the ACL management functions may provide some time savings in deployment of ACLs, but do not actually generate the ACLs.
In view of the foregoing, methods and systems for automatically generating custom ACLs may be desirable. The custom ACLs may be specific to the configuration of a particular piece of communication equipment, for example, and automatically generated from existing configuration information.
According to one broad aspect of the invention, there is provided a machine-implemented method of generating a communication traffic control rule for communication equipment. The method includes accessing configuration information for communication equipment, determining from the configuration information a parameter which affects processing of communication traffic by the communication equipment, building, based on the parameter, a communication traffic control rule to be applied to communication traffic at the communication equipment, and applying the communication traffic control rule at interfaces of the communication equipment to communication traffic being terminated by the communication equipment.
The operation of determining may involve parsing a configuration file. In some embodiments, multiple parameters which affect processing of communication traffic by the communication equipment are determined. Building may then include building multiple communication traffic control rules, with each communication traffic control rule being based on at least one of the determined parameters.
Additional communication traffic control parameters may be determined from default information stored for the communication equipment and used to building the communication traffic control rules. Generated communication traffic control rules may be updated or replaced when changes in the configuration information are detected.
A system for generating a communication traffic control rule for communication equipment is also provided, and includes a parameter determination module and a rule builder, either or both of which may be implemented in a processor. The parameter determination module is configured to access configuration information for communication equipment and to determine from the configuration information a parameter which affects processing of communication traffic by the communication equipment, and the rule builder configured to build, based on the parameter, a communication traffic control rule to be applied to communication traffic at the communication equipment.
Further functions may also be performed by the parameter determination module, the rule builder, or other components in conjunction with which the system operates.
In accordance with another aspect of the invention, a machine-implemented method of generating a communication traffic control rule for communication equipment includes accessing default information stored for communication equipment, determining a default communication traffic control parameter from the stored default information, and building, based on the default parameter, a communication traffic control rule to be applied to communication traffic at the communication equipment.
A related system for generating a communication traffic control rule for communication equipment is also provided. A parameter determination module is configured to access default information stored for communication equipment and to determine a default communication traffic control parameter from the stored default information, and a rule builder is configured to build, based on the default parameter, a communication traffic control rule to be applied to communication traffic at the communication equipment.
Other aspects and features of embodiments of the present invention will become apparent to those ordinarily skilled in the art upon review of the following description of specific illustrative embodiments of the invention.
Examples of embodiments of the invention will now be described in greater detail with reference to the accompanying drawings, in which:
The method begins at 10 with an operation of accessing configuration information for the communication equipment. From the configuration information, one or more parameters which affect processing of communication traffic by the communication equipment are determined at 12. At 14, one or more communication traffic control rules are built based on the parameter or parameters determined at 12.
As will be apparent to those skilled in the art, any communication traffic control rules which are built at 14 establish conditions which control communication traffic at the communication equipment. ACLs, for example, control access to the communication equipment by communication traffic. The rule or rules which are built at 14 are preferably automatically applied at 16 to interfaces and to control traffic terminated at the communication equipment.
The operation of accessing configuration information at 10 may include accessing information stored in a local memory of the communication equipment, information stored at a remote location, or both. Although remote configuration information storage is contemplated, configuration information for communication equipment is typically stored in a local memory device at the communication equipment, in a configuration file for instance.
In the case of a configuration file, the operation of determining at 12 may include parsing the configuration file to detect, for example, protocols and functions that are enabled on the communication equipment. Some common protocols which may be enabled, or alternatively disabled, in a configuration file for communication equipment such as a router include Border Gateway Protocol (BGP), Open Shortest Path First (OSPF), and IP Group Management Protocol (IGMP).
The above list of example protocols is in no way intended to be exhaustive, and other protocols and functions which may be enabled or disabled at communication equipment will be apparent to those skilled in the art. In addition, other types of parameters than protocols and functions may also be specified in configuration information, such as addresses of communication traffic sources for which communication traffic is to be blocked or passed.
The determining operation at 12 may involve configuration file or information parsing, as described above, to detect parameters which are specified in configuration information. For example, enabled protocols may be detected by parsing a configuration file. However, it should be appreciated that configuration information may be further processed at 12 during the determination of parameters for communication traffic control. Address resolution represents one example of such further processing, although other types of processing may also be apparent.
Protocols, functions, and addresses, or more specifically whether the protocols and functions are enabled or disabled and whether communication traffic from the addresses is to be blocked or passed at communication equipment, are thus examples of parameters which affect processing of communication traffic by communication equipment. If BGP has not been enabled for communication equipment for instance, then the equipment will not be capable of properly processing BGP communication traffic. In this situation, it may be desirable to apply an ACL to block BGP traffic from entering the communication equipment for processing.
In some embodiments, communication traffic control parameters are determined at 12 from stored default information other than configuration information. As described above with reference to the configuration information, this default information may be stored locally at communication equipment or at a remote location. The operation at 14 may then involve building communication traffic control rules based on parameters determined from configuration information, default parameters determined default information, or a combination of both types of parameters. Thus, in some embodiments, the accessing operation at 10 may also, or instead, involve accessing stored default communication traffic control information for the communication equipment.
Many different types of default information are contemplated. For example, an owner or operator of the communication equipment or a provider of service which is supported by the communication equipment may wish to have certain parameters applied to communication traffic at the communication equipment. In some cases, these parameters may be of a type which is suitable for inclusion in or implementation using ACLs but cannot be specified in configuration information. Default information in the form of a service provider profile, for instance, including the default parameters or information from which these parameters can be determined, may be stored in a local or remote store for the communication equipment. As for configuration information, the determination of parameters from default information may involve parsing the default information and/or possibly further processing the default information to determine default parameters. Communication traffic control rules are then built based on the default parameters.
Rate limiting is one example of a parameter which might be implemented in ACLs but not specified in configuration information. Other examples include commonly used protocols such as IGMP which are often to be enabled by default, service-specific parameters or information intended to control communication traffic associated with a particular service to thereby provide increased granularity for communication traffic control by a provider of multiple services or for communication equipment which supports multiple services, equipment-specific parameters, and parameters associated with a communication traffic control rule template.
Service- or provider-specific parameters might include rate limiting for communication traffic control rules which are to be applied at certain locations within communication equipment, at control interfaces for instance. Equipment-specific default information or parameters may relate to characteristics or capabilities which vary between different types of communication equipment. A certain model of router, for example, might only use ACLs at physical interfaces. Communication traffic control rule templates may be used in the building function at 14 for customization according to determined configuration or default parameters instead of generating each communication traffic control rule from scratch.
It should be appreciated, however, that embodiments of the invention are in no way dependent upon or limited to these or any other particular parameters.
A communication control rule which is built at 14 may be an ACL which includes, for example, instructions to permit access and optionally rate limit the access for protocols and functions enabled for communication equipment. For address-based communication traffic control rules, source addresses or possibly address ranges determined at 12 are used in the permit and rate limiting instructions. An ACL generated in this manner may instead include instructions for denying access. Thus, more generally, a communication traffic control rule may be a blocking rule to block communication traffic, a permissive rule to permit or pass communication traffic, and a rate limiting rule to permit or pass communication traffic up to a predetermined rate. In the case of a rate limiting rule, once a predetermined rate is reached or exceeded, communication traffic is blocked, preferably temporarily.
The present invention is in no way limited to the particular operations shown in
For example, communication traffic control rules may be automatically kept up to date by detecting changes in configuration information and repeating the operations of determining and building for configuration information affected by the detected change. Communication traffic control rules may be modified or replaced with new rules which are built on the basis of any configuration information which has been changed. The entire method of
Communication traffic control rules which were generated on the basis of default parameters may be updated in a similar manner by replacement or modification when a change in configuration information is detected.
The foregoing description relates to methods for generating communication traffic control rules, illustratively ACLs, based on configuration information, default information, or both.
The system of
The parameter determination module 20, the rule builder 22, and the rule loader 21 may be implemented as separate hardware components configured to provide the functions disclosed herein, or using a processor 28 as shown in
The memory 24 represents one or more memory devices which may include solid state memory devices, disk drives, and/or other types of memory device adapted for operation with fixed or removable storage media. Configuration information and default information, and possibly software for execution by the processor 28, are stored in the memory 24, preferably in at least distinct files or memory locations or areas and possibly in different memory devices. As described above, configuration information and/or default information may be stored locally or remotely, and accordingly the memory 24 may or may not be co-located with other components of the system of
Communication equipment may include one or more datapath processors 23 by which generated traffic control rules are applied. In some embodiments, as shown in
In operation, the parameter determination module 20 accesses configuration information, default information, or both, in the memory 24 and determines one or more parameters to be used in building communication traffic control rules for a particular piece of communication equipment. Where configuration information is stored in a configuration file, the parameter determination module 20 may incorporate a configuration file parser 26. Although not explicitly shown in
Parameters which have been determined by the parameter determination module 20 may be either stored in the memory 24 for subsequent access by the rule builder 22 or passed to the rule builder 22 directly. The rule builder 22 then builds one or more communication traffic control rules based on the parameters.
Implementation of the actual rules may be handled in several ways. In the embodiment shown in
The parameter determination module 20 and the rule builder 22 may perform additional functions, illustratively configuration information change detection and communication traffic control rule updating for instance, which will be apparent from the foregoing description of
Communication equipment may include further, fewer, or different components with different interconnections than shown in
A physical interface to a communication medium is represented by the communication interfaces 32, which may be line cards for instance. Physical interfaces to different types of communication media or components may also be provided, as line cards and adapter cards, for example. Basic functions and operations of these interfaces are often controlled by a controller 34, illustratively a control card.
The processor 36 and the memory 38 are preferably used to implement the communication control traffic functions as described in detail above. The processor 36 may be dedicated to communication control rule generation, or be configured to perform other control functions or possibly communication traffic processing functions.
The user interface 39 represents one or more devices which receive inputs from and possibly also provide outputs to a user or operator of the communication equipment 30. The user interface 39 may include such devices as a keyboard, a mouse, and a display, for example. Other types of interface, illustratively a transceiver, may also or instead be used to support user interaction with the communication equipment 30 from a remote location, through a network management system (NMS) for instance. Changes to configuration information, which may be detected in accordance with embodiments of the invention, may be entered by a user through the user interface 39.
Although all of the components in
Many different forms of communication equipment will be apparent to those skilled in the art. In a switch or router, for example, line cards may provide an interface between a communication medium and switching fabric which may be controlled by the controller 34. Routing of received communication traffic through the communication medium is generally accomplished by switching the traffic between line cards, whereas ingress and egress operations, to insert communication traffic onto or to remove communication traffic from the communication medium, involve switching communication traffic between adapter cards or other components and line cards. Particular operations performed by other types of communication equipment will be apparent to those skilled in the art.
In accordance with an aspect of the invention, the processor 36 generates communication traffic control rules to be applied at the communication equipment 30. The generated communication traffic control rules may be applied at any of the interfaces 32, for example, to control the communication traffic which is allowed to pass between the communication equipment 30 and the communication medium. Communication traffic control rules may also or instead be applied at interfaces to the controller 34 or other components of the communication equipment 30 to control communication traffic in a similar manner.
The processor 36 may thus be configured to build different types of communication traffic control rule to be applied at different interfaces. For example, the processor 36 may build any of so-called per-interface ACLs to protect physical interfaces and control loopback ACLs to protect the controller 34.
Other types of communication control rules are also contemplated. The communication equipment 30 may support the grouping of multiple interfaces 32 into a secure group, illustratively a Virtual Private Network (VPN). A VPN loopback ACL, which is applied at all of the physical interfaces in a VPN, is therefore a further example of a type of communication traffic control rule which may be generated according to embodiments of the present invention.
The communication system of
Those skilled in the art will be familiar with the particular structure and operation of various communication systems of the general type shown in
Using the NMS 48 or another local or remote operator terminal or computer system (not shown), the network elements 42, 44 may be configured by a service provider, owner, or operator. Communication traffic control rule generation may also be implemented locally at the network elements 42, 44 or remotely at other systems or devices. Communication traffic control rule generation may also involve cooperation between multiple systems or devices, such as in the case where a remote communication traffic control generation tool accesses configuration information or default information which is stored locally at the network elements 42, 44.
Various embodiments of the invention have been described in detail above. In order to further illustrate an aspect of the invention, the following example of a configuration file and ACLs which may be generated therefrom is provided. Of course, different configuration information may result in different ACLs, and the present invention is not limited to the following or any other particular type or format of configuration information or ACLs.
From the following configuration information:
the following ACLs may be generated. One way of doing this is to access an interface configuration mode and type in a command such as “generate-access-list”. An access list is then automatically generated and attached to that interface.
According to embodiments of the present invention, the above ACLs would be automatically generated from the configuration information, significantly reducing the time, effort, and likelihood of error in manually entering the ACLs.
Communication traffic control rule generation in accordance with aspects of the invention may have additional benefits in the form of lower operational costs. Automatically-generated communication traffic control rules may lower operational cost in running a communication system by reducing operator training requirements, for ACL creation for instance, and reducing operator effort spent on creating ACLs.
Embodiments of the invention may also improve security in that automatically generated ACLs will generally be substantially fault-free, more consistent, and have fewer security holes than manually entered ACLs. Automatically generated ACLs are also much more easily customized to communication equipment, illustratively each router in a service provider's communication network.
Furthermore, as configurations change, existing ACLs can be modified or new ACLs can be generated relatively easily in order to keep access control current, which maintains security at a high level.
What has been described is merely illustrative of the application of the principles of the invention. Other arrangements and methods can be implemented by those skilled in the art without departing from the scope of the present invention.
For example, it should be appreciated that the invention may be implemented in core network elements in a communication network, even though the network elements 42, 44 are shown in
In addition, although described primarily in the context of methods and systems, other implementations of the invention are also contemplated, as instructions stored on a machine-readable medium, for example.
