Deploying rules by policy management apparatus as a function of information concerning network equipment

Abstract

Policy management apparatus for deploying rules over a set of elements in a data network, in particular a telecommunications network, the rules enabling services to be implemented, wherein the apparatus has means giving it access to a database containing information about the set of network elements, and wherein deployment is performed as a function of said information.

Description

[0001] The present invention relates to managing data networks such as telecommunications networks, and to managing the services implemented on such networks. More particularly, the invention relates to managing services by means of policy rules and to apparatus and to a method for facilitating implementation of such policy rules (which are referred to below, for simplicity, merely as “rules”).

BACKGROUND OF THE INVENTION

[0002] Data networks can implement a very wide variety of services, requiring a very wide variety of capabilities from the elements of the network.

[0003] One network management function consists in determining which network elements can implement particular services, depending on the capabilities required by the services and the capabilities offered by each network element.

[0004] FIG. 1 shows a conventional situation.

[0005] A terminal X is connected to an access network NA and seeks to establish a service session with a terminal Y connected to a core network NC. Four routers, A, B, C, and D enable the access network NA to be connected to the core network NC.

[0006] Each router can implement a limited set of capabilities. Router A can implement capabilities F1 (e.g. quality of service), F2 (e.g. firewall type security), and F3 (e.g. encryption of transmitted data). Router B can implement capabilities F1 and F2. Router C can implement capabilities F1 and F4 (e.g. network address translation (NAT)). Finally, router D can implement capabilities F1 and F2.

[0007] In order to implement a service, it is therefore necessary to select which routers are going to be used for conveying the data stream between terminals X and Y. To make this selection, it is necessary to compare the capabilities required by the service (e.g., F1, F2, and F4) with the capabilities offered by the routers. In the situation illustrated by way of example, there are two possibilities: either routers C and B are selected, or else routers C and D.

[0008] In the state of the art, the selection is performed by an operator, by visually comparing the capabilities required by a service with a topological map of the network, which map includes the capabilities offered by the routers.

[0009] Once a selection has been made, it must be “provisioned”, i.e. the service manager apparatus must communicate the information necessary for implementing the service to the routers involved.

[0010] Thus, if routers C and B are selected, it is necessary to transmit the necessary information to these routers to enable them to implement the capabilities required by the service, i.e. F1, F2, and F4.

[0011] This “provisioning” stage must be performed by transmitting appropriate rules.

[0012] For example, required capability F2 can trigger the transmission to router B of a rule consisting in allowing data streams to pass only between 8h00 and 19h00.

[0013] In the prior art, service management apparatuses exist which are associated with databases storing information about the rules, about the capabilities of the network equipment and/or about the services to be implemented. This is the case of European patent application EP 1 026 867 filed by the company Nortel, for example.

[0014] However, at present, said service management apparatuses do not make it easy to match the capabilities offered by network equipment with the capabilities required by services. The manual comparison stage is penalizing insofar as firstly it is expensive in time, and secondly it is subject to operator error.

[0015] Similarly, there is no simple mechanism for matching the capabilities required by services with the rules to be implemented by network equipment.

OBJECT AND SUMMARY OF THE INVENTION

[0016] The object of the invention is to mitigate this deficiency in the state of the art.

[0017] More precisely, the invention provides policy management apparatus for deploying rules over a set of elements in a data network, in particular a telecommunications network, the rules enabling services to be implemented. The policy management apparatus having means giving it access to a database containing information about:

[0018] said set of network elements;

[0019] said services; and

[0020] said rules.

[0021] These various kinds of information are matched with one another, and deployment is performed as a function of the information.

[0022] In an implementation of the invention, the policy management apparatus further includes means for storing the information in the database on the basis of data contained in registration messages received from network elements.

[0023] The registration messages may be forwarded via a policy decision point, for example.

[0024] In this way, matching can be performed automatically by the policy manager. This therefore makes it possible to mask from the operator all information concerning the network, its topology, and the capabilities offered by each of its elements. The task of the operator is thus greatly facilitated and risks of error are minimized.

BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The invention and its advantages appear more clearly from the following description given with reference to the accompanying figures.

[0026] FIG. 1, described above, illustrates an example of a data network.

[0027] FIG. 2 is a diagram showing the context in which the service management apparatus of the invention can be inserted.

[0028] FIG. 3 is a UML diagram representing the model that can be used by the service management apparatus.

MORE DETAILED DESCRIPTION

[0029] FIG. 2 shows two terminals X and Y connected respectively to an access network NA and to a core network NC. The two networks NA and NC are themselves interconnected via four routers, A, B, C, and D which are mutually interconnected.

[0030] At least these four network elements are associated with a policy manager PM via a policy decision point PDP.

[0031] The policy manager PM can form part of some wider service management apparatus. In practice, the policy manager need be no more than one of the capabilities of the service management apparatus, or it can be an independent module which, in association with other independent modules, provide its own contribution to the service management apparatus.

[0032] Similarly, the policy manager PM can be connected directly to the network elements A, B, C, and D, i.e. without passing via the policy decision point PDP.

[0033] When the network is put into operation, or when at least one or more of the network elements making it up are put into operation, the network elements send registration messages to the policy decision point PDP.

[0034] In an implementation of the invention, these registration messages contain data about network equipment capabilities.

[0035] For example, this data can concern:

[0036] the version of the software installed in the equipment;

[0037] the hardware version of the equipment;

[0038] the number of interfaces of the equipment; etc.

[0039] The policy decision point PDP collects this data and forwards it to the policy manager PM together with information relating thereto, e.g. its Internet Protocol (IP) address.

[0040] The policy manager PM or the service management apparatus containing it then stores this data in a database DB.

[0041] One of the main functions of the policy manager PM is to deploy rules to the various elements of the network, usually via policy decision points.

[0042] In the invention, the policy manager has means giving it access to the database DB which contains the information about the network elements. This information can be stored using the above-described method consisting in causing the data to be sent upwards by registration messages from the elements of the network, or by any other means (in particular manually when the network is configured).

[0043] In the invention, rule deployment is a function of this information. Thus, in order to determine which rules should be transmitted to which elements of the network, the policy manager PM consults the information contained in the database DB.

[0044] Such determination can be implemented in particular by matching:

[0045] capabilities offered by network elements (i.e. information contained in the database DB);

[0046] capabilities required by a service to be implemented; and

[0047] capabilities required to implement the rules.

[0048] To perform this matching, the policy manager PM can automatically determine which rules are appropriate for implementing the service in question, and the way in which the rules should be deployed.

[0049] FIG. 3 is in the form of a unified modeling language (UML) diagram showing how this matching is implemented. Such a diagram can be understood by the person skilled in the art when writing a computer program for implementing the invention within the policy manager PM.

[0050] This UML diagram is made up of various boxes, each representing a class of objects.

[0051] The class “PolicyRule” represents the policy rules. They can be in accordance with RFC 3060 of the Internet Engineering Task Force (IETF) entitled “Policy Core Information Model” and published in February 2001.

[0052] These rules can be stored in a database (not shown in FIG. 2). Each rule is associated with a set of parameters: a flag indicates whether the rule is enabled, is a priority, is a list of conditions, is a list of actions to be triggered, . . . .

[0053] From these parameters, it is possible to extract the capabilities required for implementing each rule. These necessary capabilities are represented by the class “Needed Capability”.

[0054] Each rule is associated with at least one condition and at least one action. In order to implement the action, and even to determine the condition, the network element must possess the needed capabilities. Thus, for example, it is not possible to implement a network address translation rule on a router that does not possess Network Address Translation (NAT) functionality.

[0055] Furthermore, the “Required Capability” class represents the capabilities required for implementing services.

[0056] The class “Device Profile” presents the profiles of the various elements of the network. It can contain a step of parameters associated with these network elements. From these parameters it is possible to deduce the capabilities offered by the network elements. These capabilities on offer are represented by the class “Device Related Capability”.

[0057] The three classes “Device Related Capability”, “Required Capability”, and “Needed Capability” are interconnected in order to make it possible to implement the matching described above.

[0058] Thus, the relationship between the classes “Required Capability” and “Device Related Capability” can be used for a given service, for determining which network elements can implement them.

[0059] The relationship between “Device Related Capability” and “Needed Capability” can then be used to determine which rules need to be deployed towards these network elements.

Claims

1/ Policy management apparatus for deploying rules over a set of elements in a data network, in particular a telecommunications network, said rules enabling services to be implemented, wherein the apparatus has means giving it access to a database containing information about said set of network elements, about said services, and about said rules, these various kinds of information being matched with one another, and wherein deployment is performed as a function of said information.

2/ Policy management apparatus according to claim 1, further including means for storing said information in said database on the basis of data contained in registration messages received from network elements.

3/ Policy management apparatus according to claim 2, in which said registration messages are forwarded via a policy decision point.

4/ Policy management apparatus according to claim 1, in which matching is performed by means of a UML language diagram.