Distributed network management using a logical multi-dimensional label-based policy model

A non-transitory computer-readable storage medium storing instructions executed by a processor for enforcing a management policy on a managed server, the instructions when executed causing the processor to perform steps including:

• receiving, by the managed server, function-level instructions each specifying a service, a label set for a provided-by portion, and a label set for a used-by portion, wherein the label set for the provided-by portion is associated with devices permitted to provide the service to devices associated with the label set for the used-by portion;
• receiving, by the managed server, actor-sets each associated with a corresponding label set, each actor-set including actor-set records identifying devices having the corresponding label set;
• generating, based on the function-level instructions and the actor-sets, a management module configuration for controlling communications to and from the managed server;
• configuring a management module of the managed server according to the management module configuration;
• and
• operating the management module to permit communications permitted by the function-level instructions and block communications not permitted by the function-level instructions.

A managed server for enforcing a management policy, the managed server comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium storing instructions executed by a processor for enforcing a management policy on the managed server, the instructions when executed causing the processor to perform steps including:
• receiving, by the managed server, function-level instructions each specifying a service, a label set for a provided-by portion, and a label set for a used-by portion, wherein the label set for the provided-by portion is associated with devices permitted to provide the service to devices associated with the label set for the used-by portion;
• receiving, by the managed server, actor-sets each associated with a corresponding label set, each actor-set including actor-set records identifying devices having the corresponding label set;
• generating, based on the function-level instructions and the actor-sets, a management module configuration for controlling communications to and from the managed server;
• configuring a management module of the managed server according to the management module configuration;
• and
• operating the management module to permit communications permitted by the function-level instructions and block communications not permitted by the function-level instructions.