# US 9,882,783 B2 · Distributed network management using a logical multi-dimensional label-based policy model > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,783 B2 - Document ID: US9882783B2 - Status: Granted - Kind: B2 - Application number: 14/249,128 - Filed: 2014-04-09 - Published: 2014-10-16 - Granted: 2018-01-30 - Earliest claimed: 2013-04-10 - Assignees: Illumio, Inc. - Applicants: Illumio, Inc. - Inventors: Paul J. Kirner; Daniel R. Cook; Juraj G. Fandli; Matthew K. Glenn; Mukesh Gupta; Andrew S. Rubin; Jerry B. Scott; Sehyo Chang; Alan B. Stokol - Web page: https://patentgrep.com/patent/US9882783B2 ## CPC - H04L 41/082: the condition being updates or upgrades of network functionality - H04L 41/0869: Validating the configuration within one network element - H04L 41/0894: Policy-based network configuration management - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 47/22: Traffic shaping - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range - G06F 9/50: Allocation of resources, e.g. of the central processing unit [CPU] - G06F 11/3624: {by performing operations on the source code, e.g. via a compiler} - G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling - G06Q 20/1235: {with control of digital rights management [DRM]} - G06Q 20/322: {Aspects of commerce using mobile devices [M-devices]} - G06Q 20/405: {Establishing or using transaction specific rules} - G06Q 30/02: Marketing; Price estimation or determination; Fundraising - G06Q 30/0222: {During e-commerce, i.e. online transactions} - G06Q 30/0601: Electronic shopping [e-shopping] - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/101: {Access control lists [ACL]} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 67/125: involving control of end-device applications over a network - H04L 67/306: User profiles - H04L 67/53: using third party service providers - H04W 48/02: Access restriction performed under specific conditions - H04W 48/04: based on user or terminal location or mobility data, e.g. moving direction, speed - H04W 48/08: Access restriction or access information delivery, e.g. discovery data delivery (signalling during connection H04W76/00) - H04W 48/16: Discovering, processing access restriction or access information - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Management instructions for a particular managed server within an administrative domain are generated according to an administrative domain-wide management policy that comprises a set of one or more rules. The administrative domain includes a plurality of managed servers. A determination is made regarding which rules within the set of rules are relevant to the particular managed server. Function-level instructions are generated based on the rules that were determined to be relevant. A determination is made regarding which managed servers within the plurality of managed servers are relevant to the particular managed server. The function-level instructions and information regarding the managed servers that were determined to be relevant are sent to the particular managed server. The particular managed server uses the function-level instructions and information regarding the managed servers to configure a management module so that the configured management module implements the administrative domain-wide management policy. ## Claims ### Claim 1 A method of generating management instructions for a particular managed server within an administrative domain according to a set of one or more rules, wherein the administrative domain includes a plurality of managed servers, the method comprising: storing label sets for each of the plurality of managed servers, each of the label sets having one or more labels identifying a high-level characteristic of a corresponding one of the plurality of managed servers; storing the set of one or more rules, each rule specifying a service, labels in a provided-by portion of the rule, and labels in a used-by portion of the rule, wherein each rule controls providing of the service by managed servers having one of the labels in the provided-by portion of the rule and controls use of the service by managed servers having one of the labels in the used-by portion of the rule; determining which of the set of rules specify a label within a label set of the particular managed server to determine relevant rules; enumerating a plurality of actor-sets each associated with a different possible combination of labels, each actor-set comprising actor-set records identifying managed servers having a label associated with the actor-set; filtering the enumerated plurality of actor-sets to determine which of the plurality of actor-sets have at least one label corresponding to at least one of the relevant rules to determine relevant actor-sets; generating function-level instructions for the particular managed server based on the relevant rules, each of the function-level instructions referencing a single label in the provided-by portion of a corresponding relevant rule and a single label in the used-by portion of the corresponding relevant rule; and sending, to the particular managed server, the function-level instructions and actor-set records included in the relevant actor-sets, wherein the particular managed server uses the function-level instructions and the actor-set records to configure the particular managed server to implement the relevant rules. ### Claim 2 (depends on 1) The method of claim 1, wherein the labels each comprise a dimension comprising one element of a group containing Role, Environment, Application, Line of Business, and Location. ### Claim 3 (depends on 1) The method of claim 1, wherein the actor-set records included in the relevant actor-sets include network exposure information of the relevant managed servers, wherein the actor-set records include a first actor-set record indicating a first internet protocol address of one of the relevant managed servers and a second actor-set record indicating a second internet protocol address of the one of the relevant managed servers. ### Claim 4 (depends on 1) The method of claim 1, wherein generating the function-level instructions and filtering the enumerated plurality of actor-sets comprises generating the function-level instructions in parallel with filtering the enumerated plurality of actor-sets. ### Claim 5 (depends on 1) The method of claim 1, wherein each of the actor-set records comprises at least one of: a unique identifier of a respective managed server of the plurality of managed servers, an identifier of an operating system of the respective managed server, or an IP address of the respective managed server. ### Claim 6 (depends on 1) The method of claim 1, wherein at least one of the rules in the set of rules includes multiple labels in the each of the provided-by portion and the used-by portion. ### Claim 7 (depends on 1) The method of claim 1, wherein at least one of the actor-sets corresponds to a single label and at least one of the actor-sets corresponds to a combination of multiple labels. ### Claim 8 A non-transitory computer-readable storage medium storing computer program instructions for generating management instructions for a particular managed server within an administrative domain according to a set of one or more rules, wherein the administrative domain includes a plurality of managed servers, the computer program instructions executable to perform steps comprising: storing label sets for each of the plurality of managed servers, each of the label sets having one or more labels identifying a high-level characteristic of a corresponding one of the plurality of managed servers; storing the set of one or more rules, each rule specifying a service, labels in a provided-by portion of the rule, and labels in a used-by portion of the rule, wherein each rule controls providing of the service by managed servers having one of the labels in the provided-by portion of the rule and controls use of the service by managed servers having one of the labels in the used-by portion of the rule; determining which of the set of rules specify a label within a label set of the particular managed server to determine relevant rules; enumerating a plurality of actor-sets each associated with a different possible combination of labels, each actor-set comprising actor-set records identifying managed servers having a label associated with the actor-set; filtering the enumerated plurality of actor-sets to determine which of the plurality of actor-sets have at least one label corresponding to at least one of the relevant rules to determine relevant actor-sets; generating function-level instructions for the particular managed server based on the relevant rules, each of the function-level instructions referencing a single label in the provided-by portion of a corresponding relevant rule and a single label in the used-by portion of the corresponding relevant rule; and sending, to the particular managed server, the function-level instructions and actor-set records included in the relevant actor-sets, wherein the particular managed server uses the function-level instructions and the actor-set records to configure the particular managed server to implement the relevant rules. ### Claim 9 (depends on 8) The computer-readable storage medium of claim 8, wherein the labels each comprise a dimension comprising one element of a group containing Role, Environment, Application, Line of Business, and Location. ### Claim 10 (depends on 8) The computer-readable storage medium of claim 8, wherein the actor-set records included in the relevant actor-sets include network exposure information of the relevant managed servers, wherein the actor-set records include a first actor-set record indicating a first internet protocol address of one of the relevant managed servers and a second actor-set record indicating a second internet protocol address of the one of the relevant managed servers. ### Claim 11 (depends on 8) The computer-readable storage medium of claim 8, wherein generating the function-level instructions and filtering the enumerated plurality of actor-sets comprises generating the function-level instructions in parallel with filtering the enumerated plurality of actor-sets. ### Claim 12 (depends on 8) The computer-readable storage medium of claim 8, wherein each of the actor-set records comprises at least one of: a unique identifier of a respective managed server of the plurality of managed servers, an identifier of an operating system of the respective managed server, or an IP address of the respective managed server. ### Claim 13 (depends on 8) The computer-readable storage medium of claim 8, wherein at least one of the rules in the set of rules includes multiple labels in the each of the provided-by portion and the used-by portion. ### Claim 14 (depends on 8) The computer-readable storage medium of claim 8, wherein at least one of the actor-sets corresponds to a single label and at least one of the actor-sets corresponds to a combination of multiple labels. ### Claim 15 A system for generating management instructions for a particular managed server within an administrative domain according to a set of one or more rules, wherein the administrative domain includes a plurality of managed servers, the system comprising: a non-transitory computer-readable storage medium storing computer program instructions executable to perform steps comprising: storing label sets for each of the plurality of managed servers, each of the label sets having one or more labels identifying a high-level characteristic of a corresponding one of the plurality of managed servers; storing the set of one or more rules, each rule specifying a service, labels in a provided-by portion of the rule, and labels in a used-by portion of the rule, wherein each rule controls providing of the service by managed servers having one of the labels in the provided-by portion of the rule and controls use of the service by managed servers having one of the labels in the used-by portion of the rule; determining which of the set of rules specify a label within a label set of the particular managed server to determine relevant rules; enumerating a plurality of actor-sets each associated with a different possible combination of labels, each actor-set comprising actor-set records identifying managed servers having a label associated with the actor-set; filtering the enumerated plurality of actor-sets to determine which of the plurality of actor-sets have at least one label corresponding to at least one of the relevant rules to determine relevant actor-sets; generating function-level instructions for the particular managed server based on the relevant rules, each of the function-level instructions referencing a single label in the provided-by portion of a corresponding relevant rule and a single label in the used-by portion of the corresponding relevant rule; and sending, to the particular managed server, the function-level instructions and actor-set records included in the relevant actor-sets, wherein the particular managed server uses the function-level instructions and the actor-set records to configure the particular managed server to implement the relevant rules; and a computer processor for executing the computer program modules. ### Claim 16 (depends on 15) The system of claim 15, wherein the labels each comprise a dimension comprising one element of a group containing Role, Environment, Application, Line of Business, and Location. ### Claim 17 (depends on 15) The system of claim 15, wherein the actor-set records included in the relevant actor-sets include network exposure information of the relevant managed servers, wherein the actor-set records include a first actor-set record indicating a first internet protocol address of one of the relevant managed servers and a second actor-set record indicating a second internet protocol address of the one of the relevant managed servers. ### Claim 18 (depends on 15) The system of claim 15, wherein each of the actor-set records comprises at least one of: a unique identifier of a respective managed server of the plurality of managed servers, an identifier of an operating system of the respective managed server, or an IP address of the respective managed server. ### Claim 19 (depends on 15) The system of claim 15, wherein at least one of the rules in the set of rules includes multiple labels in the each of the provided-by portion and the used-by portion. ### Claim 20 (depends on 15) The system of claim 15, wherein at least one of the actor-sets corresponds to a single label and at least one of the actor-sets corresponds to a combination of multiple labels.