Data processing: database and file management or data structures – Database design – Data structure types
Reexamination Certificate
1997-10-31
2001-04-03
Ho, Ruay Lian (Department: 2771)
Data processing: database and file management or data structures
Database design
Data structure types
C709S201000, C709S230000
Reexamination Certificate
active
06212511
ABSTRACT:
The present invention relates primarily to the management of computer networks, and more particularly to a system and method for limiting access to a management objects and event notifications to authorized users of the network management objects while also providing SQL access to at least a portion of the management information in the network with matching access restrictions.
BACKGROUND OF THE INVENTION
SNMP (Simple Network Management Protocol) was developed to provide a tool for multivendor, interoperable network management. SNMP provides a set of standards for network management, including a protocol, a database structure specification, and a set of data objects. SNMP was adopted as the standard for TCP/IP-based inte mets in 1989. An explanation of SNMP technology is beyond the scope of this document and the reader is assumed to be either conversant with SNMP or to have access to conventional textbooks on the subject, such as William Stallings, “SNMP, SNMP2 and RMON”, Addison Wesley (1996), which is hereby incorporated by reference in its entirety as background information. CMIP is a network management protocol like SNMP, except that it is based on OSI standards. The book: “SNMP, SNMPv2 and CMIP: The Practical Guide to Network Management Standards” by William Stallings, which is an excellent source of basic information on CMIP, and on CMIP related standards, is hereby incorporated by reference in its entirety as background information.
Many networks use a network manager and some form of Simple Network Management Protocol (SNMP) or CMIP for managing the network. Among its management tasks, the network manager automatically monitors the status of the devices on the network. The network manager sends event requests to the devices, which are requested to return responses when certain events occur. For example, a disk agent might be requested to send a response if available disk space falls below 50%.
An SNMP-manageable (or CMIP-manageable) device stores in its memory a Management Information Base (MIB), a collection of objects or variables representing different aspects of the device (e.g., configuration, statistics, status, control). For each class of device, the MIB has a core of standard variables. Each vendor of a device will add to the core, variables that it feels are important to the management of its device.
The MIBs for the manageable devices in a network not only store management information that can be retrieved, but also contain variables whose values, when modified by a network manager, modify the operation of the device. Simple examples are disabling a device's operation, changing the priorities assigned to different tasks performed by a device, and changing the set of messages generated by the device and the set of destinations to which those messages are sent.
Clearly, it is important to prevent unauthorized persons from accessing the management information objects in a network. Otherwise, not only will confidential information be obtained by unauthorized persons, but also the network would be open to acts of sabotage. The present invention addresses the subject of access control for network management information objects.
ITU-T X.741 (1995) is an industry standard, published by the Telecommunication standardization sector of the Intemational Telecommunication Union, previously known as the CCITT, entitled Data Networks and Open System Communications, OSI Management. The X.741 standard specifies an access control security model and the management information necessary for creating and administering access control associated with OSI (open systems interconnection) system management.
There are a number of related ITU-T standards that relate to OSI systems management that are relevant to the present invention, particularly X.740(1992) (security audit trail function) and X.812 (1995) (data networks and open systems communications security). All three of these ITU-T standards, X.741(1995), X.740(1992) and X.812(1995) are hereby incorporated by reference as background information.
While the X.741, X.740 and X.812 standard define a fairly comprehensive access control framework for controlling access to network management objects, there remain numerous access control and management issues that are not addressed or resolved by these standards.
In particular, while X.741 and the related standards define access control for limiting access to management objects, these standards do not address or specify any mechanism for limiting access to event reports. Event reports (usually called event notifications), such as the reports generated when an object is created, deleted, or a management parameter passes a specified threshold, in many systems are broadcast to all listeners. This is clearly unacceptable if the network is, for instance, the telephone switching network owned by a large telecommunications company, and the event reports concern resources being installed or utilized for a particular customer. That is, customer A should not be allowed to receive event reports about network resources being used on behalf of customer B.
In fact, the presumption in X.741 and the related standards is that event report security should be implemented using a mechanism that is separate from the access control mechanism used for restricting access to management objects. After all, access control to management objects filters inbound messages requesting access to objects, while event reports are outbound messages.
However, it has been observed by the inventors of the present invention that in many cases, the objects that a person is to be prohibited from accessing are also the objects from which that person should not be receiving event reports. For instance, using the above example, employees of customer A should neither access nor receive event reports for any of the objects that have been allocated to customer B.
Another issue not addressed by X.741 is that customers of large networks often insist upon the ability to generate network management reports using “SQL” type report generators. That is, users of such networks want or require the ability to generate reports on the status of their network resources, while avoiding the complexities of network management information retrieval using SNMP (or any other network management protocol). X.741 and the related standards do not call for, or even suggest, any type of direct SQL-type access to the management object database for the purpose of generating management reports. In fact, direct SQL-type access might be seen as contrary to the goals of X.741 since it is a potential source of security leaks.
It is therefore a goal of the present invention to provide direct SQL-type access to the management object database for purposes of report generation, as opposed to other types of object access. The purpose of the direct access mechanism is to allow users to use standard DBMS report generators to define and generate reports about the status or past performance of network objects, while still providing the same access restrictions as those that apply to normal management information access requests.
SUMMARY OF THE INVENTION
In summary, the present invention is a system and method for controlling access to management objects in a computer network. An access control database defines access rights through the use of access control objects. The access control objects include group objects, each defining a group and a set of users who are members of the group, and rule objects. A first subset of the rule objects each specify a set of the group objects, a set of the management objects, and access rights by the users who are members of the groups defined by the specified set of the group objects to the specified set of management objects.
At least one access control server is used to process access requests in accordance with the access rights specified in the access control database. A subset of the access requests specify operations to be performed on specified sets of the management objects. Each of these access requests is sent for processing t
Allavarpu Sai V. S.
Angal Rajeev
Fisher Bart Lee
Ho Ruay Lian
Pennie & Edmonds LLP
Sun Microsystems Inc.
LandOfFree
Distributed system and method for providing SQL access to... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Distributed system and method for providing SQL access to..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Distributed system and method for providing SQL access to... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2458643