# US 7,159,125 B2 · Policy engine for modular generation of policy for a flat, per-device database

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,159,125 B2
- Document ID: US7159125B2
- Status: Granted
- Kind: B2
- Application number: 10/219,236
- Filed: 2002-08-13
- Published: 2003-08-14
- Granted: 2007-01-02
- Earliest claimed: 2001-08-14
- Assignees: Endforce, Inc.
- Inventors: Mark A. Beadles; William S. Emerick; Kevin A. Russo; Kenneth E. Mulh; Raymond J. Bell
- Web page: https://patentgrep.com/patent/US7159125B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A policy engine in a policy-based, outsourced, network management system. In one embodiment, the management system is multi-layered, modular and stores device configuration data in non-device specific format, which are subsequently translated to device-specific format by lower layers of the management system. The non-device specific format is the same (e.g., XML) as that used to create the policies with the user GUI (e.g., browser) and transport them to the service center over the internet. A database stores a policy directory in a hierarchical format that is separate from a policy store (configuration store) for devices in a flat (non-hierarchical or parallel) format. In one embodiment, a policy engine develops policies in a hierarchical format, but then stores the device schema, or objects, in a low-level, flat database. Multiple hierarchical services which impact a single device have the characteristics related to that device knitted together, and then fed back to a policy store database as a flat file for that device, in a non-device specific format. Thus, instead of storing the policies separately, and in hierarchical linked format, the device descriptions are stored with the aspects of all policies that affect that device.

## Claims

### Claim 1

A method for generating network management policies for a network, comprising:
storing a hierarchical policy in a directory database;
transforming said hierarchical policy into a flat file format with device schema for devices comprising said network; and
storing said flat file format device schema in a configuration database.

### Claim 2 (depends on 1)

The method of claim 1 further comprising:
concatenating together device implementations of a plurality of policies for said devices.

### Claim 3 (depends on 1)

The method of claim 1 wherein said transforming comprises:
dividing a policy into a plurality of policy types; and
providing each of said policy types to a specialized process for one of said policy types, said specialized processes generating a flat file for each device corresponding to said policy.

### Claim 4 (depends on 3)

The method of claim 3 wherein said process is a COM server.

### Claim 5 (depends on 3)

The method of claim 3 wherein said policy types include a virtual private network (VPN), a network address translation (NAT), a firewall and application management services (AMS).

### Claim 6 (depends on 3)

The method of claim 3 wherein said dividing is performed by a policy generator, said policy generator further:
providing a flat file template to said processes for populating with data corresponding to said policy; and
providing to said processes a server address for a server containing said directory.

### Claim 7 (depends on 3)

The method of claim 3 wherein said dividing is performed by a policy generator, said policy generator further:
adding device attributes from said directory to said flat file.

### Claim 8 (depends on 3)

The method of claim 3 wherein said dividing is performed by a policy generator, said policy generator further:
providing a main thread; and
providing a policy generation thread pool comprised of threads generated by said main thread, each thread in said thread pool being responsible for policy for a particular policy object.

### Claim 9

A method for generating network management policies for a network, comprising:
storing a hierarchical policy in a directory database;
using a policy generator to transform said hierarchical policy into a flat file format with device schema for devices comprising said network by
dividing a policy into a plurality of policy types, and
providing each of said policy types to a COM server for one of said policy types, said COM server generating a flat file for each device corresponding to said policy, wherein said policy types include a virtual private network (VPM), a network address translation (NAT), a firewall and application management services (AMS);
providing a flat file template to said COM servers for populating with data corresponding to said policy; and
providing to said COM servers a server address for a server containing said directory;
concatenating together device implementations of a plurality of policies for said devices;
adding device attributes from said directory to said flat file; and
storing said flat file format device schema in a configuration database.

### Claim 10 (depends on 9)

The method of claim 9 further comprising:
managing passwords and encryption keys in an authorization/key manager separate from said COM servers, and responsive to calls from said COM servers, to provide consistent passwords and encryption keys.

### Claim 11 (depends on 9)

The method of claim 9 wherein said flat file format is XML, and said concatenating is performed using an XSL stylesheet.

### Claim 12 (depends on 9)

The method of claim 9 wherein said policy generator comprises multiple instantiations on multiple servers.

### Claim 13 (depends on 9)

The method of claim 9 further comprising:
providing said schema in XML format;
storing said schema in said configuration database using an ADO object pool in communication with an OLEDB provider.

### Claim 14

A method for creating a directory of a network, comprising:
providing a directory of device objects describing a plurality of devices in a network;
organizing said directory in hierarchical form; and
providing at least one policy object for application of a policy to a plurality of said devices.

### Claim 15 (depends on 14)

The method of claim 14 wherein said policy object is one of a plurality of policy objects including policy objects for security policy, firewall policy, network policy and router configuration.

### Claim 16

A method for generating network management policies for a network, comprising:
dividing a policy into a plurality of policy types; and
providing each of said policy types to a specialized process for one of said policy types, said specialized processes generating a flat file for each device corresponding to said policy.

### Claim 17 (depends on 16)

The method of claim 16 wherein each said specialized process is a COM server.

### Claim 18 (depends on 16)

The method of claim 16 wherein said policy types include a virtual private network (VPN), a network address translation (NAT), a firewall and application management services (AMS).

### Claim 19 (depends on 16)

The method of claim 16 wherein said dividing is performed by a policy generator, said policy generator further:
providing a flat file template to said processes for populating with data corresponding to said policy; and
providing to said processes a server address for a server containing said directory.

### Claim 20 (depends on 16)

The method of claim 16 wherein each of said specialized processes is a COM server, each of said COM servers performing the following:
accessing a directory for information needed to create a policy;
providing both synchronous and asynchronous implementations.

### Claim 21

A computer readable media having computer readable code embodied therein for providing a directory of network resources comprising:
a plurality of objects describing attributes of said network resources; and
a plurality of objects describing attributes of network policy.

### Claim 22 (depends on 21)

The media of claim 21 wherein said attributes of network policy include:
a virtual network policy;
a network address policy;
a firewall policy; and
an application management system policy.

### Claim 23 (depends on 21)

The media of claim 21 wherein at least one of said objects sets forth the connections in a network.

### Claim 24 (depends on 21)

The media of claim 21 wherein at least one of said objects is an actions object with a list of actions, and the type of action.

### Claim 25 (depends on 21)

The media of claim 21 wherein at least one of said objects is an interface object with an indication of type or location, and networking relevant information.

### Claim 26

A method for generating policy descriptions with a policy service agent responsive to a policy generator comprising:
receiving an XML template, a policy rule description and a directory address from said policy generator;
accessing a directory at said directory address for hierarchical data describing said policy rule;
populating said XML template with data pertaining to said policy rule for a device identified in said XML template;
returning a populated XML template to said policy generator.

### Claim 27 (depends on 26)

The method of claim 26 wherein said policy generator is a COM server.

### Claim 28 (depends on 26)

The method of claim 26 wherein said policy service agent includes an asynchronous COM interface with said policy generator.