# US 10,374,884 B2 · Automatically, dynamically generating augmentation extensions for network feature authorization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,884 B2 - Document ID: US10374884B2 - Status: Granted - Kind: B2 - Application number: 15/217,573 - Filed: 2016-07-22 - Published: 2018-01-25 - Granted: 2019-08-06 - Earliest claimed: 2016-07-22 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Wojciech Dec; Sanjay Agrawal; Yi Yang; Ruchir Gupta; Syed Basheeruddin Ahmed - Web page: https://patentgrep.com/patent/US10374884B2 ## CPC - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 41/5054: Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components - H04L 41/5096: {wherein the managed service relates to distributed or central networked applications} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are systems, methods, and computer-readable storage media for automatically, dynamically generating feature model augmentation statements for data nodes for a new network feature described in a data modeling language. A software-defined controller, or other network components, can detect the availability of a new network feature defined by a feature model in a data modeling language and process the feature model to create an authorization policy data defining access rules control rules for the new network feature. Based on the authorization policy, the controller or the authorization model generator can generate a set of augmentation statements for one or more data nodes in the feature model of the new network feature and augment the new feature model with the augmentation statements for controlling access to the new network feature. ## Claims ### Claim 1 A computer-implemented method comprising: detecting, in a cloud-based network, an availability of a new network feature defined by a feature model in a data modeling language; automatically requesting, upon detection of the availability of the new network feature, authorization data; processing the feature model using the authorization data to create a policy defining rules for the new network feature; generating, based on the policy, a set of augmentation statements for one or more data nodes in the feature model of the new network feature; augmenting the feature model with the set of augmentation statements to yield an augmented feature model; and deploying the augmented feature model with the set of augmentation statements to enforce the policy for the new network feature. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the data modeling language includes a YANG modeling language. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the new network feature is one or more of a new software service and a new network device. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the processing of the feature model includes applying one or more rules and heuristics to each of the one or more data nodes in the feature model. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: correlating the policy with a client profile; and wherein set of augmentation statements generated based on rule-based access controls described in the client profile. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: correlating the policy with a set of collected client data; and generating one or more rules from the set of collected client data, wherein generating the set of augmentation statements for one or more data nodes in the feature model of the new network feature is further based on the one or more rules generated from the set of collected client data. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: correlating the policy with a collection of business intelligence data; and generating one or more rules from the collection of business intelligence data, wherein the set of augmentation statements is generated based on the one or more rules. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the detecting of the availability of the new network feature and the deploying of the augmented feature model are performed by a cloud-based network controller. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the processing of the feature model, the generating of the set of augmentation statements, and the augmenting of the feature model are performed by an authorization augmentation engine in communication with the cloud-based network controller. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, wherein the processing of the feature model, the generating of the set of augmentation statements, and the augmenting of the feature model are performed by an authorization augmentation engine integral to the cloud-based network controller. ### Claim 11 A cloud controller on a network, the cloud controller comprising: a processor; and a computer-readable storage medium having stored therein instructions which, when executed by the processor, cause the processor to perform operations comprising: detecting, in a cloud-based network, an availability of a new network feature defined by a feature model in a data modeling language; automatically requesting, upon detection of the availability of the new network feature, authorization data; processing the feature model using the authorization data to create a policy defining rules for the new network feature; generating, based on the policy, a set of augmentation statements for one or more data nodes in the feature model of the new network feature; augmenting the feature model with the set of augmentation statements to yield an augmented feature model; and deploying the augmented feature model with the set of augmentation statements to enforce the policy for the new network feature. ### Claim 12 (depends on 11) The cloud controller of claim 11, wherein the processing of the feature model includes applying one or more rules and heuristics to each of the one or more data nodes in the feature model. ### Claim 13 (depends on 11) The cloud controller of claim 11, wherein the instructions further cause the processor to perform operations comprising: correlating the policy with a client profile, wherein the generating of the set of augmentation statements is based on rule-based access controls described in the client profile. ### Claim 14 (depends on 11) The cloud controller of claim 11, wherein the instructions further cause the processor to perform operations comprising: correlating the policy with a client profile; correlating the policy with a set of collected client data; generating one or more rules from the set of collected client data; correlating the policy with a collection of business intelligence data; and generating one or more rules from the collection of business intelligence data, wherein the set of augmentation statements is generated based on the one or more rules generated from the set of collected client data and the one or more rules generated from the collection of business intelligence data. ### Claim 15 A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor in a cloud controller associated with a network, cause the processor to perform operations comprising: detecting, in a cloud-based network, an availability of a new network feature defined by a feature model in a data modeling language; automatically requesting, upon detection of the availability of the new network feature, authorization data; processing the feature model using the authorization data to create a policy defining access control rules for the new network feature; generating, based on the policy, a set of augmentation statements for one or more data nodes in the feature model of the new network feature; augmenting the feature model with the set of augmentation statements to yield an augmented feature model; and deploying the augmented feature model with the set of augmentation statements to control access to the new network feature. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the data modeling language includes a YANG modeling language. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the processing of the feature model includes applying one or more rules and heuristics to each of the one or more data nodes in the feature model. ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processor to perform operations comprising: correlating the policy with a client profile, wherein the generating of the set of augmentation statements is based on rule-based access controls described in the client profile. ### Claim 19 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processor to perform operations comprising: correlating the policy with a set of collected client data; and generating one or more rules from the set of collected client data, wherein the set of augmentation statements is generated based on the one or more rules. ### Claim 20 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processor to perform operations comprising: correlating the access control rules with a collection of business intelligence data; and generating one or more rules from the collection of business intelligence data, wherein the set of augmentation statements is generated based on the one or more rules.