KR100730887B1 - How to Deploy and Manage Policies Using Delta Policies - Google Patents

Abstract

The present invention relates to a policy distribution and management method using a delta policy.

A policy management system system including a policy management server and a client according to the present invention, the method of distributing a policy using a delta policy includes: checking, by the policy management server, a last version policy of the client; Comparing, at the policy management server, the last version policy of the client with a next version policy to distribute; The policy management server generates a delta policy that is a difference between the last version policy and the next version policy, and when a plurality of delta policies exist between the two versions, the plurality of deltas. Concatenating and integrating the policies in sequence; And distributing the integrated delta policy to the client at the policy management server.

Policy, deployment, delta policy, rules

Description

How to deploy and manage policies using delta policy {POLICY DEPLOYMENT AND MANAGEMENT METHOD USING DELTA POLICY}

1 is a diagram illustrating definition, execution, and change of a policy in a policy management system according to an exemplary embodiment of the present invention.

2 is a diagram illustrating the distribution of a policy in a policy management system according to another embodiment of the present invention.

3 is a diagram illustrating a policy upgrade in a policy management system according to another embodiment of the present invention.

4 is a view for explaining a policy change method using a delta policy according to another embodiment of the present invention.

5 is a view for explaining a policy change method using a delta policy according to another embodiment of the present invention.

6 is a view for explaining a policy change method in which a plurality of delta policies are merged according to another embodiment of the present invention.

7 is a diagram illustrating a method for recovering a policy when a part of the policy is damaged according to another embodiment of the present invention.

The present invention relates to a policy management system (PMS), and more particularly, to a policy distribution and management method using a delta policy.

Policy Management defines management policies at the business and service level, and automatically manages networks and services based on them.

In general, policy management functions in the structure of a policy server, a policy client, and a policy repository for storing policy information. The Policy Server is a Policy Decision Point (PDP) that interprets rules included in a policy to be applied to each policy client. That is, the targets of the policy are selected and the scope of application is determined. The Policy Client reconfigures its Agent system to perform the functions reflecting the policy as a Policy Enforcement Point (PEP).

In the policy management system to which the present invention is applied, the PEP is a structure in a terminal device, for example, a handset. In other words, an agent for a client is separated. In other words, if the policy definition point (PDP) and the policy execution point (PEP) are separated into the structure of the server / client, rather than the structure where the server and client are physically together, the policy from the server with PDP to the client with PEP is This is the case when the distribution of.

On the other hand, in the policy management system as described above, the distribution and management of the policy checks the policy version of the client at a certain point in time, for example, when the policy is changed, or periodically, or when a specific event occurs. Distribute and synchronize. However, when distributing and managing a policy, not only does the policy change frequently, but in many cases only some rules are changed and the majority of the rules remain the same. In addition, there is a problem in that the distribution and management of the policy is sensitive to traffic, that is, the amount of data transmission, depending on the network channel used.

Accordingly, the present invention has been made to solve the above-described problems of the prior art, and provides a method for distributing and managing by changes, that is, delta policy, rather than the policy itself, for efficient policy distribution and management. There is a purpose.

In a policy management system including a policy management server and a client according to the present invention, a method for distributing a policy using a delta policy may include: checking, by the policy management server, a last version policy of the client; Comparing, at the policy management server, the last version policy of the client with a next version policy to distribute; The policy management server generates a delta policy that is a difference between the last version policy and the next version policy, and when a plurality of delta policies exist between the two versions, the plurality of deltas. Concatenating and integrating the policies in sequence; And distributing the integrated delta policy to the client at the policy management server.

delete

In a policy management system including a policy management server and a client according to the present invention, a method of recovering a damaged policy by using a delta policy when a policy of a client is damaged may include checking a hole version that needs to be repaired in the client. ; Requesting the policy management server for the compromised hole version at the client; Generating recovery data corresponding to the hole version at the policy management server; And transmitting, by the policy management server, the repair data to the client to recover a damaged policy of the client.

In a policy management system including a policy management server and a client according to the present invention, an initial policy transmitted from the policy management server to the client and the policy executed on the client is first transmitted from the policy management server to the client. Policy); And at least one delta policy that is a difference between a last version policy existing in the client and a next version policy to be distributed by the policy management server, and includes version interval information between the version policies. It includes.

In a policy management system including a policy management server and a client according to the present invention, a delta which is a difference between a last version policy existing in the client and a next version policy to be distributed by the policy management server. The policy may include version section information between the last version policy and the next version policy; And a rule to be changed in the policy to be distributed and a change form.

The policy management system according to the present invention checks the last policy version of the client, creates a delta policy that is the difference between the last version policy and the next version policy to distribute, and between the two versions. A policy management server for concatenating and integrating the plurality of delta policies in a sequence and distributing them to the client when a plurality of delta policies exist in the network; And a client receiving the delta policy from the policy management server and executing a next version policy.

Details and improvements of the invention are disclosed in the dependent claims.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating definition, execution, change, and the like of a policy according to an embodiment of the present invention.

Referring to FIG. 1, in a policy management system, a policy is a set of rules for managing and controlling network resources. When a specific condition occurs, a policy clarifies the purpose, order, and method of action. The rules are defined.

Also, a policy is a set of behaviors that have the best results, that is, a set of conditions and their corresponding behaviors, among the various operational management actions taken for each condition based on the knowledge data established through continuous operational management. Therefore, policy definition is key in policy-based management, and this policy can be managed more efficiently by analyzing the application result through future operation management and redefining the policy by reflecting it. These business-level policies must ultimately be able to translate into network-executable instructions for action.

In the figure, policy A and policy B are shown. Policy A is composed of Policy Information, Rule 1, Rule 2, etc. The policy information is composed of Version, Issue Date, and the like. Similarly, policy B consists of policy information, rules (rules a, b). A policy basically consists of a pair of conditions and their corresponding actions. The condition indicates a condition to which the policy is to be applied, and may include parameters such as a user name, an IP address, a port, and a protocol. An action defines what policy rule should be executed when a condition occurs. That is, one or more operations affecting or configuring network traffic or network resources.

A policy is defined at a Policy Definition Point (hereinafter referred to as "PDP") and executed at a Policy Enforcement Point (hereinafter referred to as "PEP").

To determine the appropriate policy for a policy request received from the PEP, the PDP analyzes the status from the information reported or requested by the PEP, finds the required policy in the policy repository, determines the policy, and returns it to the PEP. For this, PDP needs the following roles and functions. First, there should be a function to receive a policy request from the PEP including information on the interface or status. Second, there must be a function to retrieve the policy from the policy repository for the received state or request. At this time, if the system grows in size, there may be several PDPs, and there is a need for a function that can solve the inconsistency in the policy between PEPs. Third, it should be possible to interpret the meaning of the policy retrieved from the PIB (Policy Information Base). Fourth, it is necessary to convert the determined policy into a form that can be executed by the PEP and return it to the PEP.

The PEP monitors the status of device elements and policies, reports them to the PDP, interprets the policies received from the PDP, and executes commands on the target device.

A policy store is an abstract model that represents a logical container for reusable policy elements, and is a logical container that represents policy rules and related conditions and behaviors, management scope and naming of related policy data. In addition, as a data store for storing conditions, actions, policy rules, and related policy data, it may have a database or directory form.

2 is a diagram illustrating the distribution of a policy according to another embodiment of the present invention.

If the PDP and PEP are physically separated, the policy is distributed from the server with the PDP, that is, the policy management server to the client with the PEP.

Referring to FIG. 2, the policy management server defines policy A (1). Policy A is then distributed to clients (2). The client applies policy A (3). Here, the client is a concept including both wired and wireless terminals.

3 is a diagram illustrating a policy upgrade according to another embodiment of the present invention.

The policy is distributed at a certain point in time, for example, when a policy is changed, or periodically, or when a specific event occurs. The policy is checked by synchronizing with the latest version of the policy.

Referring to FIG. 3, first, a policy A 'changed in the policy management server is defined (1). Subsequently, the next version policy A 'is distributed to the client in the policy management server (2). The client replaces policy A with changed policy A '(3).

4 is a view for explaining a policy change method using a delta policy according to another embodiment of the present invention.

The delta policy is composed of a rule to be changed and a change type, and a last version and a next version.

The rule can be modified in three ways. It consists of Append, Delete, and Replace.

The Last Version indicates the current version of the policy or policy and the set of delta policies to upgrade using the delta policy.

The Next Version indicates a version after being upgraded due to the delta policy.

Referring to FIG. 4, the last version policy, that is, policy B is composed of version information (Version 1.0), rule 1, rule 2, rule 3, and rule 4, and the delta policy for policy B, which is to be changed, is the version information ( Last Version: 1.1, Next Version: 1.2), Rule 3: Delete, Rule 2 ': It consists of Replace of Rule 2. The combination of Policy B and Delta Policy for Policy B results in the next version policy, Policy B '. The policy B 'is composed of version information (Version 1.2), rule 1, rule 2' and rule 4.

5 is a view for explaining a policy change method using a delta policy according to another embodiment of the present invention.

Briefly, the method described above is that when a policy change is made and distributed as a delta policy, the same effect as the policy distribution of the next version can be obtained. A policy change is a change of a rule constituting a policy, and since the rules are independent of each other, a delta policy consists of information of rules to be actually changed.

Referring to FIG. 5, policy A, which is the last version policy, is composed of version information (Version 1.0), rule 1, rule 2, and rule 3, wherein the change, that is, the delta policy for policy A, is the version information (Last version). : 1.0, Next Version: 1.1), Rule 4: Append. When the last version policy and the delta policy are combined, it becomes the next version policy, that is, policy A '. In conclusion, policy A 'is composed of version information (Version 1.1), rule 1, rule 2, rule 3, rule 4.

6 is a view for explaining a policy change method in which a plurality of delta policies are merged according to another embodiment of the present invention.

Briefly, the method compares the policy version of the client with the latest version of the policy. Then, if there are multiple delta policies between the two versions, they can be merged into one delta policy. This process is called Delta Policy Integration.

Referring to FIG. 6, the current policy version of the client is 1.2. The current policy (Version 1.2) is composed of an initial policy (Policy A, Version 1.0), delta policy 1, and delta policy 2. Where the client's initial deployed policy, policy A, consists of version information (Version 1.0, Issue Date: 2006 ...), rule 1, rule 2, and rule 3, and delta policy 1 contains version information (Version 1.0 => Version 1.1), and rules, and delta policy 2 consists of version information (Version 1.1 => Version 1.2).

If there are a number of delta policies to be distributed here, delta policy 3, delta policy 4, and delta policy 5, these delta policies are merged into one delta policy.

Delta policy 3 consists of version information (Version 1.2 => Version 1.3) and rules, delta policy 4 consists of version information (Version 1.3 => Version 2.0) and rules, and delta policy 5 consists of version information (Version 2.0 => Version 2.1) and rules. By integrating these delta policies, one delta policy is created and distributed as a delta policy consisting of version information (Version 1.3 => Version 2.1) and rules.

The delta policy integration is to attach delta policies of adjacent intervals to form a delta policy. For example, a delta policy for the [1.1, 1.2] section can be created by integrating the delta policy for the [1.1, 1.2] section and the delta policy for the [1.2, 1.9] section. However, [1.1, 1.2] and [1.3, 1.4] cannot be integrated because they have holes.

Here, as a method of integrating the rules of the delta policies, there are a method of simply concatenating the rules constituting the delta policy in a sequence and a method of optimizing and integrating the minimal changes. For example, Rule 1: Append and Rule 1: Delete cancel, Rule 2: Append and Rule 3 (replaced by Rule 2) are simplified to Rule 3: Append. .

As a result, the latest, i.e., the latest, updated version of the client (Latest Version Policy) consists of version information (Version 2.1) and rule 1, rule 2, rule 3 and rule 4.

7 is a diagram illustrating a method for recovering a policy when a part of the policy is damaged according to another embodiment of the present invention.

Briefly, how to recover the policy, if some of the policy of the client is damaged, the version scan (Hole Version) to find the recovery needs to be found through the version scanning (Sole version), and the required version section is requested to the server side. The server uses the delta policy fragments and the initial policy to create a delta policy or policy for the required version interval. Here, when a plurality of sections are searched (that is, there are many holes), the server may recover at a time by using a recent policy (not a delta policy) according to the server's decision. Restore the client's policy repository with the created policy. Here, the Client Policy Repository stores the initial policy and the delta policy as they are received, and finds a rule to be applied when the policy is applied. In addition, whenever a delta policy is received, it is integrated with an existing policy and stored as a single policy.

Referring to FIG. 7, the client policy store includes Policy A, Policy B, ..., and the like. Policy A to be recovered (with holes) includes delta policies for Policy A and Policy A. Policy A consists of version information (Version 1.0), rule 1, rule 2, and rule 3, and delta policies for A (Version 1.0 => Version 1.1, Version 1.2 => Version 1.3, Version 1.3 => Version 2.0) It consists of. Here, the client searches for the hole version, that is, Version 1.1 => Version 1.2, through the version scanning of the policy A, and requests the policy store of the server (1). The server then integrates the delta policy value for policy A (Version 1.1 => Version 1.15) and the delta policy b (Version 1.15 => Version 1.2) into a single delta policy (Version 1.1 => Version 1.2). Repair the corrupted policy in the store.

Although described above based on the preferred embodiment of the present invention, those skilled in the art will understand that it can be carried out in other specific forms without changing the technical spirit or essential features of the technical field to which the present invention belongs. Therefore, the embodiments described above are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is defined by the appended claims rather than the foregoing description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts are to be interpreted as being included in the scope of the present invention. Should be.

 By using the policy distribution and management method using the delta policy according to the present invention, since only necessary changes are upgraded according to the current policy version of the client, the network load can be reduced by removing unnecessary traffic during policy distribution. In addition, it is possible to select a distribution method suitable for the performance of the network channel and the client, apart from the uniform upgrade, and the policy recovery is easy.

Claims (31)

delete delete delete delete delete delete delete delete In a policy management system including a policy management server and a client, a method of distributing a policy using a delta policy, (a) checking, at the policy management server, the last version policy of the client; (b) comparing, at the policy management server, the last version policy of the client with a next version policy to distribute; (c) the policy management server generates a delta policy that is a difference between the last version policy and a next version policy, and when a plurality of delta policies exist between the two versions, Concatenating and integrating a plurality of delta policies in sequence; And (d) distributing the consolidated delta policy to the client at the policy management server. delete The method of claim 9, wherein in step (c), Incorporating the plurality of delta policies optimizes the rules of the delta policy with minimal changes. The method according to claim 9 or 11, And generating a delta policy by combining adjacent version policies between the last version policy and the next version policy in the policy management server. The method according to claim 9 or 11, The delta policy includes a version section information between a last version policy and a next version policy, a rule to be changed, and a change form. The method of claim 13, wherein the modified form of the rule, Method for distributing policy using delta policy, which includes Append, Delete, and Replace. 12. The method of claim 9 or 11, wherein the last version policy is The policy distribution method using a delta policy, characterized in that the policy to upgrade using the delta policy. The method of claim 9 or 11, wherein the next version policy, The policy distribution method using a delta policy, characterized in that after the upgrade due to the delta policy. The method according to claim 9 or 11, The client is a policy distribution method using a delta policy, characterized in that it comprises a wired or wireless terminal. The method according to claim 9 or 11, The policy management server comprises a policy decision point (PDP) policy distribution method using a delta policy. The method according to claim 9 or 11, The client includes a policy execution point (PEP) policy distribution method using a delta policy. In a policy management system including a policy management server and a client, a method of recovering a damaged policy by using a delta policy when the client's policy is damaged, (a) checking a hole version in the client that needs to be repaired; (b) requesting the policy management server for the compromised hole version at the client; (c) generating recovery data corresponding to the hole version at the policy management server; (d) transmitting, by the policy management server, the recovery data to the client to recover the corrupted policy of the client. The method of claim 20, wherein prior to step (c), and (c0) determining the number of hole versions in the policy management server. The method of claim 21, And the recovery data is a delta policy in which a plurality of delta policies corresponding to the hole version are integrated. The method of claim 21, According to a result of the determination, the recovery data is a policy recovery method, characterized in that the delta policy corresponding to the hole version. The method according to any one of claims 20 to 23, And the client includes a wired and wireless terminal. The method according to any one of claims 20 to 23, The policy management server includes a policy decision point (PDP). The method according to any one of claims 20 or 23, And the client includes a policy execution point (PEP). delete delete delete Identify the last policy version of the client, create a delta policy that is the difference between the last version policy and the next version policy to deploy, and multiple delta policies exist between the two versions. A policy management server for connecting and integrating the plurality of delta policies in a sequence and distributing them to the client; And And a client that receives the delta policy from the policy management server and executes a next version policy. The method of claim 30, And the policy management server and the client are physically separated from each other.

Images