Patent Application
20060031443
1. Technical Field
The invention relates generally to the administrative management of computer networks and more specifically to a system and method for describing configurations and policies in policy engines.
2. Description of Related Art
Network administrators are charged with managing the network of computers within a business or other entity. This management can involve seeing that data is backed up regularly, monitoring available file space, performing load balancing to keep server loads balanced, updating systems when new software becomes available, etc. Because of the complexity of many large systems and the possibility of human error involved, programs known as policy managers are installed to automate these processes. These policy managers are designed to receive desired policies expressed in Boolean relationships and to interact with a system to be sure that the desired policies are implemented.
When operating on large architectures such as storage networks, the policy manager must evaluate myriad devices, each with multiple attributes and multiple possible values for those attributes. The ability to evaluate a number of objects with their multiple attributes at the same time is very important. There are a number of limitations in the current Boolean approach.
Given the elements of a network, each having a number of different attributes, a policy manager can evaluate each element and determine whether or not that element fits the policy that govern it. However, the policy manager cannot evaluate a group of similar elements in the network and report how many elements fit the policy; nor can it report all elements that do not fit the policy.
An example using familiar objects, such as a basket of fruit, can help clarify. The basket contains a number of fruit, each fruit having a number of attributes, for example, a unique identifier (A, B, C, etc.), a fruit type (apples, oranges, bananas, and pears), a color (red, yellow, green, etc.), a skin type (edible, not edible), size (1, 2, 3, etc.), and weight (1, 2, 3, etc.). In the existing architectures, each piece of fruit would be submitted to the policy manager, which can evaluate the attributes of that piece and determine whether or not it fits a policy, such as whether or not the current piece is a red apple having a weight of at least 5. However, the policy manager is not capable of taking the basket of fruit and reporting the number of pieces of fruit that are red apples having a weight of at least 5; neither is it capable of providing a list of all of the pieces that fit this description.
Additionally, the expression of many policies often becomes cumbersome and hard to follow. For example, in a diverse collection of systems, one administrative policy can be simply that each system has an adequate level of software loaded. One of the rules following from this policy might be: if the system operating system (OS) is AIX, the software level must be Aix 5.2.G, Aix 5.2.Z, or Aix.5.3.B; if the system OS is Linux SuSe and the central processing unit (CPU) type is 0x86, the software level must be Suse1.2 or Suse1.4 and the system must have a RAM memory capacity between 512 MB and 1600 MB; if the system OS is Windows XP, the software level must be Win 1.5 and the system must have at least 2 CPUs. This policy is expressed by the following: [(System.OS=AIX) && [(System.OS.Level=Aix.5.2.G)∥(System.OS.Level=Aix.5.2.Z)∥(System.OS.Level=Aix.5.3.B)])]∥[(System.OS=LinuxSuSe) && (System.CPU.Type=0x86) && [(System.OS.Level=Suse 1.2)∥(System.OS.Level=Suse 1.4) && [System.Memory.Capacity=≧512) && (System.Memory.Capacity≦1600]]∥[(System.OS=WindowsXP) && (System.OS.Level=Win1.5) && (System.CPU.Number≧2)]. This expression is neither easy to follow nor easy to change.
Thus, it would be desirable to provide a method of evaluating groups of objects that can provide more information than it is possible to derive from the current applications and that can be expressed more simply and understandably.
The present invention uses set theory to provide a device, a method, and a system that can operate on a collection of elements, each having multiple attributes, and can evaluate not only their individual attributes, but also the similarities and differences between the elements.
Each element of a network is defined by its attributes and can be thought of as a point in a multi-dimensional space. Policy is then expressed as a set of allowable points in the same space and the determination of whether a network complies with a policy is a matter checking to see if the elements exist as members of the set of allowable possibilities. Using this methodology, entire networks can be checked against a policy by determining if the set of points comprising the elements of the network are a subset of the set of allowable points.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
Rather than evaluating objects one at a time, the present invention models the information that is required for a policy into a set and analyzes relationships between elements of the set and between sets. The elements of a network are simply its parts, e.g., server, memory, switch, port, operating system, etc. The attributes of each element are those things that define the element and will vary depending on the type of element. For example, a server can have the attributes of vendor, model, and processing speed, to name a few. Software can have the attributes of vendor and version.
The Internet, also referred to as an “internetwork”, is a set of computer networks, possibly dissimilar, joined together by means of gateways that handle data transfer and the conversion of messages from a protocol of the sending network to a protocol used by the receiving network. When capitalized, the term “Internet” refers to the collection of networks and gateways that use the TCP/IP suite of protocols.
With reference now to the figures,
In the depicted example, server 104 is connected to network 102 along with storage unit 106. In addition, clients 108, 110, and 112 are connected to network 102. These clients 108, 110, and 112 may be, for example, personal computers or network computers. In the depicted example, server 104 provides data, such as boot files, operating system images, and applications to clients 108-112. Clients 108, 110, and 112 are clients to server 104. Server 112 is also connected to private network 114, which connects server 112 to computers 116, 118, 120. Network data processing system 100 may include additional servers, clients, and other devices not shown. In the depicted example, network data processing system 100 is the Internet with network 102 representing a worldwide collection of networks and gateways that use the Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, consisting of thousands of commercial, government, educational and other computer systems that route data and messages. Of course, network data processing system 100 also may be implemented as a number of different types of networks, such as for example, an intranet, a local area network (LAN), or a wide area network (WAN).
Referring to
Peripheral component interconnect (PCI) bus bridge 214 connected to I/O bus 212 provides an interface to PCI local bus 216. A number of modems may be connected to PCI local bus 216. Typical PCI bus implementations will support four PCI expansion slots or add-in connectors. Communications links to clients 108-112 in
Additional PCI bus bridges 222 and 224 provide interfaces for additional PCI local buses 226 and 228, from which additional modems or network adapters may be supported. In this manner, data processing system 200 allows connections to multiple network computers. A memory-mapped graphics adapter 230 and hard disk 232 may also be connected to I/O bus 212 as depicted, either directly or indirectly.
Those of ordinary skill in the art will appreciate that the hardware depicted in
The data processing system depicted in
The disclosed illustrative embodiment includes a system and method designed for managing a Storage Area Network (SAN). Some of the terminology used refers to the parts of a SAN. However, the present invention is not limited to the disclosed illustrative embodiment, but can be used for managing any type of system.
Set Theory Notation
Prior to discussing the present invention itself, it is helpful to clarify the notation used. Some of this notation is used in set theory and will be familiar to those who work in this field, although not necessarily to others. A set is a collection of objects chosen from some universe, with the “universe” usually being understood from the context. In the present invention, the elements of a set will be pieces of hardware or software making up a network. Sets are denoted by bold, capital letters or by enclosing the elements of the set in curly brackets. Each element within the set can be shown as either a small letter or as a collection of attributes. For example, set A can be expressed as {a1, a2, a3}, where a1, a2, and a3 are the elements that make up set A. If it is desirable to show the elements as a list of their attributes, the elements can be enclosed inside parentheses within the set: {(a, b, c), (a, d, e), (d, e, f)}. For the purposes of this discussion, a set is considered a collection of points whose coordinates are expressed by their attributes. One example would be a small network consisting of a server and a set of client computers. Each client computer has its own attributes, e.g., identifier (ID), manufacturer or vendor (Vend), model number (model), and operating system (OS). The set of clients can be represented as C={(ID1, Vend1, model1, OS1), {(ID2, Vend2, model2, OS2), {(ID3, Vend3, model3, OS3), etc.}
The symbols used in discussing sets and their elements are:
Additionally, Boolean operators, such as ∥ (or) and && (and), as well as algebraic notation, such as = (equal), > (greater than), < (less than), ≦ (less than or equal to), and ≧ (greater than or equal to), are used.
Operations:
The illustrative embodiment of the present invention uses a number of operations on sets that allow the policy manager to evaluate the elements of the network that it serves. The operations that are defined in this application for the policy manager are as follows: Filter, Projection, Section, Diagonal, Union, Intersection, SubSet, SetMinus, and Cardinal. Each of these operations will be discussed in greater detail. Examples of these operations are again shown using a basket of fruit for an example. In this example, each fruit is described by the attributes of identifier, fruit type, color, skin type, size, and weight, e.g. (1, apple, green, edible, 4, 5). Basket of fruit B having eight elements is represented thus:
The operations described in the illustrative examples here can be combined in many ways to model the policy statements that are to be enforced. Some examples are shown with corresponding diagrams to highlight how the policies can be checked.
Policy 1: A host bus adapter (HBA) is an I/O adapter that sits between the host computer's bus and a fiber channel loop and manages the transfer of information between the two channels, performing many low-level interface functions. The policy exists that all HBAs of the type 8004 from vendor ABC must have a firmware level of 3.81a, 3.81b, or 3.82. This policy can be checked with a filter operation as is shown in
The process starts with the list of all monitored systems. The set G contains information on all HBAs and is the input set 302. The filter operation 304 is performed to provide as an output 306 the set H of all HBAs that do not comply with this policy. If we assume for this example that a record in set G contains the fields (a) system.id, (b) hba.id, (c) hba.vendor, (d) hba.model, and (e) hba.fw, the filter operation reads,
Policy 2: It is a policy that there should be no more than n ports in a zone (and no less than m, where m≦n). This policy can be checked using a combination of the Section, Projection, and Cardinal operations, shown in
Policy 3:
Policy 4: A switch in a storage area network (SAN) can have a number of ports, e.g., from 8-128, depending on the application. Zones are used to define groups of elements that need to be able to communicate with each other, e.g., storage devices and servers. Each port can be defined in one or more of these zones. Additionally, the zone state can be active or inactive; the port status can be good or offline. If a port is not defined in any zone, it is assigned to a default zone, whose state is inactive. To govern these, a policy has been established that all ports in good status must be assigned to an active zone. It is possible for a port to have an assignment to both an active zone and an inactive zone, in which case, this port meets the policy.
This policy is shown in
The first projection (step 608) is made onto the zone status with an accompanying test to determine whether the zone status is in the set {active}. All sets that meet this criterion, e.g., every record in the set has an active zone status, is dropped; only those sets that have at least one record that does not have an active status for the zone are passed on to the next operation. The second projection (step 610) is also onto the port.zone.status, but this time the size of the set is checked. If there are two values for zone status, then logically, at least one record in the set has an active zone status. These records are dropped; the output set H contains only those sets whose port has no active zone (step 612) and thus break the policy. Set H is reported for correction.
The examples given above show how operations using set theory can be used to manage large networks, especially networks for which many different elements, different attributes, and different values exist. The operations defined can be used to implement a large variety of policies regarding such a network and to report on the compliance or non-compliance of the elements and the relationships between elements.
It is important to note that while the present invention has been described in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer readable medium of instructions and a variety of forms and that the present invention applies equally regardless of the particular type of signal bearing media actually used to carry out the distribution. Examples of computer readable media include recordable-type media, such as a floppy disk, a hard disk drive, a RAM, CD-ROMs, DVD-ROMs, and transmission-type media, such as digital and analog communications links, wired or wireless communications links using transmission forms, such as, for example, radio frequency and light wave transmissions. The computer readable media may take the form of coded formats that are decoded for actual use in a particular data processing system.
The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
