JP7798199B2 - Network management device, network management method and program - Google Patents

Description

One aspect of the present invention relates to a network management device, a network management method, and a program used, for example, to manage multiple networks or devices that use them.

As a method for managing different types of networks and the devices that use them, a method has been proposed in which a data model is built and managed for each managed network or device. This type of method requires building a data model for each type of network, which requires a lot of work to develop and subsequently manage the network management system.

Therefore, for example, when building or operating a network management system, a technology has been proposed for managing networks by defining the characteristics of various networks or the devices that use them using multiple attributes according to a predetermined common model format, and registering the specification information and entity information represented by the multiple attributes in a database within the system (see, for example, Patent Document 1).

By applying the technology described in Patent Document 1, the information used for network management can be applied to any network without having to be created and modified as a data model for each individual network. In other words, even if there are multiple types of networks to manage, there is no need to define a data model for each type of network or device, which can significantly reduce the work required for developing and subsequently managing a network management system.

On the other hand, when managing information using a shared database, there are cases where information cannot be disclosed unconditionally, depending on, for example, the type of information or the qualifications of the administrator. This is no exception in network management systems. Therefore, the inventors are considering defining disclosure conditions for specification information when creating specification information related to each network or its devices. This will make it possible to appropriately control the disclosure behavior of specification information or entity information related to each network or its devices, i.e., network equipment.

Japanese Patent No. 6655524

However, with the system described in Patent Document 1, for example, if a network or a device that uses it is added as a new managed object after the system has started operating, all new specification information must be created, regardless of the type of network or device being added. In other words, for each newly added network or device, all attributes that make up the specification information must be defined without omission. As a result, the task of creating specification information still requires a significant amount of work.

Furthermore, in the system described in Patent Document 1, when attempting to define disclosure conditions for specification information of networks, devices, etc., the disclosure conditions must be defined each time new specification information is created, which also requires a lot of work.

This invention was made with the above-mentioned circumstances in mind, and aims to provide technology that reduces the amount of work required to define at least policy information, among the various management information related to additionally registered network equipment, thereby enabling a reduction in the workload required to define policy information.

To solve the above problem, one aspect of the network management device or method of the present invention is to register, when first specification information relating to a registered first network equipment and first specification information representing its disclosure conditions are registered, additionally registering second policy information representing disclosure conditions for second specification information relating to second network equipment, the second policy information including inheritance control information indicating whether the disclosure conditions are inherited from the first policy information to the second policy information. When a disclosure request for entity information registered in association with the second specification information is input, the device determines whether the second policy information is the inheritance control information, and if it is determined to be the inheritance control information, determines whether the disclosure request satisfies the second disclosure conditions based on the inheritance control information.

According to one aspect of the present invention, when additionally registering second policy information to be newly used as second specification information, if the second policy information is identical to the already registered first policy information and the registered first specification information can be inherited by the second policy information, inheritance control information indicating whether or not the inheritance is possible is defined as the second policy information. Therefore, when defining new second policy information, disclosure conditions need only be defined if no inheritable policy information has been registered. This reduces the amount of work required for network administrators to define policy information externally, compared to unconditionally defining disclosure conditions for all second policy information. As a result, it is possible to reduce the workload required for external definition processing of policy information.

In other words, according to one aspect of this invention, it is possible to provide technology that reduces the amount of work required to define at least policy information among the various management information related to network equipment to be additionally registered, thereby enabling a reduction in the workload required to define policy information.

FIG. 1 is a diagram showing an example of the configuration of a network management system according to an embodiment of the present invention. FIG. 2 is a block diagram showing an example of the hardware configuration of an operator terminal used in the network management system shown in FIG. FIG. 3 is a block diagram showing an example of the software configuration of the operator terminal used in the network management system shown in FIG. FIG. 4 is a block diagram showing an example of the hardware configuration of a network management device used in the network management system shown in FIG. FIG. 5 is a block diagram showing an example of the software configuration of a network management device used in the network management system shown in FIG. FIG. 6 is a flowchart showing an example of the procedure and content of the input reception process of various registration information and the transmission process of a registration request executed by the control unit of the operator terminal shown in FIGS. FIG. 7 is a flowchart showing an example of the procedure and content of the registration process of specification/policy information and entity information executed by the control unit of the network management device shown in FIGS. FIG. 8 is a flowchart showing an example of the processing procedure and processing contents of the entity information registration processing shown in FIG. FIG. 9 is a flowchart showing an example of the procedure and content of the access control process executed by the control unit of the network management device shown in FIGS. FIG. 10 is a diagram for explaining an example of the operation of the specification and policy information registration process. FIG. 11 is a diagram illustrating a first example of the operation executed by the access control process shown in FIG. FIG. 12 is a diagram illustrating a second example of the operation executed by the access control process shown in FIG. FIG. 13 is a diagram illustrating a third example of the operation executed by the access control process shown in FIG. FIG. 14 is a diagram illustrating a fourth example of the operation executed by the access control process shown in FIG.

The following describes an embodiment of the present invention with reference to the drawings.

[One embodiment]
(Configuration example)
(1) System FIG. 1 is a diagram showing an example of the configuration of a network management system according to an embodiment of the present invention.

In one embodiment, the network management system has a network management device NM as its core component, and enables information data to be transmitted via a network NW between this network management device NM and an operator terminal OT used by the network administrator, and multiple user terminals UT1 to UTn used by other administrators or users.

The network NW includes multiple types of networks, such as the IP (Internet Protocol) network that constitutes the Internet, Ethernet (registered trademark) that constitutes a LAN (Local Area Network), and other transmission networks, but any network capable of transmitting the above information data may be used.

(2) Device (2-1) Operator terminal (OT)
2 and 3 are block diagrams showing an example of the hardware configuration and software configuration of the operator terminal OT.

The operator terminal OT has a control unit 1A that uses a hardware processor such as a central processing unit (CPU). A storage unit having a program storage unit 2A and a data storage unit 3A, a communications interface (hereinafter referred to as "I/F") unit 4A, and an input/output I/F unit 5A are connected to this control unit 1A via a bus 6A.

An input device 51 and an output device 52 are connected to the input/output I/F unit 5A. The input device 51 includes, for example, a keyboard, a mouse, and operation buttons. The input device 51 is used by a network administrator to input specification information, entity information, and policy information related to the network to be managed or the devices used in this network (hereinafter collectively referred to as network equipment).

Specification information is expressed as multiple pieces of attribute information that define the characteristics of network equipment, associated with identification information such as the name of the specification information. Entity information, for example, defines the resources that can actually be used for the network equipment in correspondence with multiple attributes of the specification information, and is expressed as multiple pieces of attribute information associated with identification information such as the name of the entity information. Policy information, for example, defines the disclosure conditions for all, each, or a combination of the multiple attribute information that make up the specification information. Policy information is also referred to as an access control policy.

The output device 52, for example, comprises a display and displays the display data required for the input processing of the above specification information and entity information.

Under the control of the control unit 1A, the communication I/F unit 4A transmits information data between the network management device NM using a communication protocol defined by the network NW.

The program storage unit 2A is configured, for example, by combining a non-volatile memory such as a solid-state drive (SSD) (storage medium) that can be written to and read from at any time with a non-volatile memory such as read-only memory (ROM), and stores middleware such as an operating system (OS), as well as application programs required for inputting the above-mentioned information required for network management in one embodiment and sending registration requests for that information. Hereinafter, the OS and each application program will be collectively referred to as the "program."

The data storage unit 3A is, for example, a combination of a non-volatile memory such as an SSD that can be written to and read from at any time as a storage medium, and a volatile memory such as RAM (Random Access Memory), and its storage area includes a specification/policy information storage unit 31A and an entity information storage unit 32A as the main storage units required to implement one embodiment of this invention.

The specification/policy information storage unit 31A stores the input specification information and policy information until the transmission of the registration request is complete. The entity information storage unit 32A stores the input entity information until the transmission of the registration request is complete.

The control unit 1A includes the following processing functions necessary to implement one embodiment of this invention: a specification information input reception processing unit 11A, a policy information input reception processing unit 12A, an entity information input reception processing unit 13A, a specification/policy registration request transmission processing unit 14A, and an entity registration request transmission processing unit 15A. These processing units 11A to 15A are all realized by causing the hardware processor of the control unit 1A to execute application programs stored in the program storage unit 2A.

In addition to storing the above application programs in advance in the program memory unit 2A, they may also be downloaded from the network management device NM or other application servers when needed and stored in the program memory unit 2A.

The specification information input reception processing unit 11A receives specification information entered by the network administrator on the input device 51 via the input/output I/F unit 5A, and stores the received specification information in the specification/policy information storage unit 31A.

Specification information includes specification information that includes all attribute information that is entered when registering a new network or device, and differential specification information that is entered when registering a similar network or device that shares some of the attribute information with an already registered network or device. An example of this will be described in the operation example.

The policy information input reception processing unit 12A receives policy information defining the disclosure conditions for the above specification information, entered by the network administrator on the input device 51, via the input/output I/F unit 5A. The received policy information is then stored in the specification/policy information storage unit 31A in association with the corresponding specification information.

The entity information input reception processing unit 13A receives entity information including multiple attribute information defining the resources actually used in the network equipment, entered by the network administrator on the input device 51, via the input/output I/F unit 5A, and stores the received entity information in the entity information storage unit 32A.

In response to input of a transmission instruction, the specification/policy registration request transmission processing unit 14A reads specification information and policy information from the specification/policy information storage unit 31A, generates a specification/policy registration request including the read specification information and policy information, and transmits the generated specification/policy registration request from the communication I/F unit 4A to the network management device NM.

In response to input of a transmission instruction, the entity registration request transmission processing unit 15A reads the entity information from the entity information storage unit 32A, generates a registration request for the read entity information, and transmits the generated entity registration request from the communication I/F unit 4A to the network management device NM.

Examples of the above specification information, policy information, and entity information will be described in the operational example.

(2-2) Network Management Device NM
4 and 5 are block diagrams showing an example of the hardware and software configurations of the network management device NM.

The network management device NM consists of, for example, a server computer installed on the web or in the cloud. The network management device NM may also be a personal computer used by an administrator.

The network management device NM has a control unit 1B that uses a hardware processor such as a CPU, and this control unit 1B is connected to a memory unit having a program memory unit 2B and a data memory unit 3B, and a communication I/F unit 4B via a bus 5B.

Under the control of the control unit 1B, the communication I/F unit 4B sends and receives information data between the operator terminal OT and the user terminals UT1 to UTn using a communication protocol defined by the network NW.

The program memory unit 2B is configured, for example, by combining a non-volatile memory such as an HDD or SSD as a storage medium that can be written to and read from at any time with a non-volatile memory such as a ROM, and stores middleware such as an OS as well as programs necessary to execute various control processes in one embodiment of this invention.

The data storage unit 3B is, for example, a combination of a non-volatile memory such as an HDD or SSD as a storage medium that can be written to and read from at any time, and a volatile memory such as RAM, and its storage area includes a specification/policy information database (hereinafter the database will be referred to as DB) 31B and an entity information DB 32B as storage units necessary to implement one embodiment of this invention.

The specification information DB31B stores specification information that defines the characteristics of the network equipment to be managed, which is sent from the operator terminal OT in response to a specification registration request. The entity information DB32B stores entity information that defines the actual resources of the network equipment, which is sent from the operator terminal OT in response to an entity registration request.

The control unit 1B includes, as processing functions according to one embodiment of the present invention, a specification/policy registration request reception processing unit 11B, a specification/policy information registration processing unit 12B, an entity registration request reception processing unit 13B, and an entity information registration processing unit 14B, as well as an access control processing unit 15B. All of these processing units 11B to 15B are realized by causing the hardware processor of the control unit 1B to execute application programs stored in the program storage unit 2B.

In addition, some or all of the above processing units 11B to 15B may be realized using hardware such as an LSI (Large Scale Integration) or an ASIC (Application Specific Integrated Circuit).

The specification/policy registration request receiving processing unit 11B receives the specification/policy registration request sent from the operator terminal OT via the communication I/F unit 4B and passes the received specification/policy registration request to the specification/policy information registration processing unit 12B.

The specification/policy information registration processing unit 12B registers the specification information and policy information contained in the specification/policy registration request passed from the specification/policy registration request receiving processing unit 11B in the specification/policy information DB 31B in a mutually associated state.

The entity registration request receiving processing unit 13B receives the entity registration request sent from the operator terminal OT via the communication I/F unit 4B and passes the received entity registration request to the entity information registration processing unit 14B.

The entity information registration processing unit 14B determines whether the entity information represented by the received entity registration request satisfies the registration conditions, and if the registration conditions are met, registers the entity information in the entity information DB 32B.

To determine whether the above entity information satisfies the registration conditions, complete specification information including all attribute information is generated based on the corresponding differential specification information registered in the specification/policy information DB31B and the specification information of the network or device from which it is inherited, and a process is performed to determine whether the above entity information satisfies the registration conditions based on the generated complete specification information; an example of this is described in the operation example.

When a disclosure request for entity information defined for a desired network or device is sent from a user terminal UT1 to UTn, for example, the access control processing unit 15B receives this disclosure request via the communication I/F unit 4B. The access control processing unit 15B then determines whether the entity information specified in the received disclosure request satisfies the disclosure conditions based on the policy information linked to the corresponding specification information, and if the disclosure conditions are met, performs processing to transmit the entity information from the communication I/F unit 4B to the requesting user terminal UT1 to UTn. An example of this access control processing will be described in the operation example.

(Example of operation)
Next, an example of the operation of the network management system configured as above will be described.
In this example, we will assume that specification information regarding the communication termination point (Termination Point Encapsulation: TPE) of a network that uses, for example, Ethernet, and policy information representing the disclosure conditions of this specification information have already been registered in the specification/policy information DB31B of the network management device NM.

(1) Registration of specification information and policy information (1-1) Input acceptance and transmission of specification information and policy information by operator terminal OT FIG. 6 is a flowchart showing an example of the processing procedure and processing content of the input acceptance processing of specification information, policy information, and entity information and its registration request transmission processing executed by the control unit 1A of the operator terminal OT.

In standby mode, the control unit 1A of the operator terminal OT determines whether the specification/policy information input mode or the entity information input mode has been set in steps S10 and S20, respectively.

When the specification/policy information input mode is set and, for example, specification information for network equipment provided by another vendor is to be registered, the network administrator first determines whether the network equipment from the other vendor to be registered has some similar characteristics to the registered network equipment. If the characteristics are similar, the network administrator generates unique attribute information from the specification information of the network equipment to be registered that is different from the specification information of the registered network equipment, i.e., unique attribute information with different attribute names or possible ranges from the multiple attribute information included in the specification information.

In addition, the network administrator generates inheritance relationship information that represents the inheritance relationship between the specification information of the registered network equipment and the specification information of the network equipment to be registered, in order to have the specification information of the network equipment to be registered inherit attribute information that has common attribute names and possible values from the multiple attribute information in the specification information of the registered network equipment.

Then, the network administrator inputs the generated attribute information specific to the network equipment to be registered and the inheritance relationship information into the operator terminal OT from the input device 51.

The process of defining the above-mentioned unique attribute information and inheritance relationship information is performed, for example, by obtaining specification information about registered network equipment from a database independently managed by the network administrator or from the specification/policy information DB31B of the network management device NM, and then referencing the obtained specification information. Furthermore, the above-mentioned inheritance relationship information may be automatically generated by the operator terminal OT based on information about the first and second network equipment selected by the network administrator when defining the attribute information unique to the network equipment to be registered.

The control unit 1A of the operator terminal OT, under the control of the specification information input reception processing unit 11A, imports the attribute information and inheritance relationship information specific to the network equipment to be registered that were input via the input device 51 in steps S11 and S12, respectively. The imported attribute information and inheritance relationship information specific to the network equipment to be registered is then temporarily stored in the specification/policy information storage unit 31A as differential specification information that represents the differences from the specification information from which the information is to be inherited.

Once the input of the differential specification information is complete, the network administrator then defines policy information for the differential specification information. This policy information is then input into the network management device NM from the input device 51.

Policy information is typically defined to include the name of the specification information to which the policy applies, the disclosure conditions, and an action that indicates the content of the processing. However, in one embodiment of the present invention, inheritance control information or policy change information is defined as policy information. Of these, inheritance control information is information that specifies whether or not to allow the inheritance of policy information associated with the specification information from which the policy is inherited to the differential specification information. In contrast, policy change information changes the policy information associated with the specification information from which the policy is inherited, and includes the content of the changed policy information.

When the policy information is input, the control unit 1A of the operator terminal OT, under the control of the policy information input reception processing unit 12A, imports the policy information via the input/output I/F unit 5A using the input device 51 in step S13. The imported policy information is then associated with the previously acquired differential specification information and temporarily stored in the specification/policy information storage unit 31A.

Next, when the control unit 1A of the operator terminal OT detects the network administrator's input operation of a transmission instruction in step S14, under the control of the specification/policy registration request transmission processing unit 14A, in step S15, it reads the above differential specification information and policy information from the above specification/policy information storage unit 31A, and transmits a specification/policy registration request including the above read information from the communication I/F unit 4A to the network management device NM.

When the control unit 1A of the operator terminal OT has completed the input acceptance and transmission process of specification information and policy information for one of the network facilities to be added, it determines in step S16 whether there is a next network facility to be registered, and if so, returns to step S11 and executes the above-mentioned series of specification information input acceptance and transmission processes in steps S11 to S16. Then, when an instruction to end the registration of the specification and policy information is input, it returns to the standby state.

(1-2) Registration of Specification Information and Policy Information by the Network Management Device NM FIG. 7 is a flowchart showing an example of the processing procedure and processing content of the registration processing of specification information, policy information, and entity information executed by the control unit 1B of the network management device NM.

In standby mode, the control unit 1B of the network management device NM monitors the receipt of specification/policy registration requests and entity registration requests in steps S30 and S40, respectively.

In this state, a specification/policy registration request is sent from the operator terminal OT, and when this specification/policy registration request is received by the communication I/F unit 4B, the specification/policy registration request receiving processing unit 11B captures the specification/policy registration request in step S30 and passes the captured specification registration request to the specification/policy information registration processing unit 12B.

In step S31, the specification/policy information registration processing unit 12B associates the differential specification information and policy information contained in the above specification/policy registration request with identification information representing the name of the specification information to be registered and registers them in the specification/policy information DB 31B.

FIG. 10 is a diagram showing an example of the registration result of the differential specification information and policy information.
In this example, TPE_Ethernet_Spec, which represents specification information, and policy information defining its disclosure conditions have already been registered in specification/policy information DB31B, and in this state, differential specification information and policy information for TPE_Ethernet_A Company_Spec, TPE_Ethernet_B Company_Spec, and TPE_Ethernet_C Company_Spec, which represent specification information for network equipment provided by vendors A, B, and C, respectively, are additionally registered.

In this example, the registered specification information TPE_Ethernet_Spec contains four attribute information. Each attribute information is represented by a pair of Resource Spec Characteristic (RSC), which represents the name of the attribute, and Resource Spec Characteristic Value (RSCV), which represents the range that the attribute can take.

And the specification information, e.g.
TPE_Ethernet_Spec
・RSC: vlan / RSCV: 1-4096
・RSC: Bandwidth/RSCV: 1-1000Mbps
It is defined as follows: RSC: physicalpor/RSCV: pp name RSC: owner/RSCV: owner name

The policy information associated with the registered specification information defines the application destination, disclosure conditions, and actions as attributes. These attributes are, for example,
Condition: "Requester is equal to owner"
Action: "Discloseable"
It is written as follows.

On the other hand, the differential specification information of the additionally registered network equipment of each of companies A, B, and C includes only unique attribute information.
TPE_Ethernet_Company A_Spec
・RSC: vlan / RSCV: 1-1000
TPE_Ethernet_Company B_Spec
・RSC: Bandwidth/RSCV: 1-500Mbps
TPE_Ethernet_CompanyC_Spec
・RSC: Bandwidth/RSCV: 1-500Mbps
It is defined as follows:

Furthermore, the differential specification information of each company includes inheritance relationship information. For simplicity, Fig. 10 shows an example of the inheritance relationship represented by lines and arrows. However, in reality, for example, TPE_Ethernet_Spec → TPE_Ethernet_Company A_Spec
・TPE_Ethernet_Spec → TPE_Ethernet_Company B_Spec
・TPE_Ethernet_Spec→TPE_Ethernet_CompanyC_Spec
The inheritance relationship information may be expressed using other symbols or text data, and the description method may be any method that can be recognized by the control unit 1B.

Furthermore, of the above-mentioned differential specification information, for the differential specification information of company A and company B, "no policy inheritance" and "policy inheritance" are defined as inheritance control information, respectively, and for the differential specification information of company C, the following information is defined as information indicating the change content of the specification:
Applicable to: TPE_Ethernet_CompanyC_Spec
Condition: "Anyone who requests it"
Action: "Discloseable"
is defined.

The disclosure conditions defined in the policy information may also set whether or not to disclose attributes that define other attributes such as VLAN, bandwidth, number of wavelengths, and device IP address, or may even set whether or not to disclose all attributes that make up the specification information. Furthermore, the disclosure conditions may set whether or not to disclose multiple attributes by using, for example, AND or OR conditions, either alone or in combination.

(2) Registration of entity information (2-1) Acceptance of input of entity information by operator terminal OT and transmission thereof With the entity information input mode set, the network administrator then defines entity information representing the resources actually used for the network equipment to be added, and inputs the defined entity information into the input device 51.

The control unit 1A of the operator terminal OT, under the control of the entity information input reception processing unit 13A, imports the entity information input on the input device 51 in step S21 and temporarily stores it in the entity information storage unit 32A.

Next, when the control unit 1A of the operator terminal OT detects the network administrator's input operation of a transmission instruction in step S22, under the control of the entity registration request transmission processing unit 15A, in step S23, it reads the above entity information from the entity information storage unit 32A and transmits a registration request for the above read entity information from the communication I/F unit 4A to the network management device NM.

When the control unit 1A of the operator terminal OT has completed the input acceptance and transmission process of entity information for one of the added network devices, it determines in step S16 whether there is any other entity information to be registered. If there is, it returns to step S11 and executes the above-mentioned series of entity information input acceptance and transmission processes in steps S11 to S16. Then, when an instruction to end registration of the above-mentioned entity information is input, it returns to the standby state.

(2-2) Registration of entity information by the network management device NM When an entity registration request is sent from the operator terminal OT and this entity registration request is received by the communication I/F unit 4B, the entity registration request receiving processing unit 13B captures the entity registration request in step S40 and passes the captured entity registration request to the entity information registration processing unit 14B.

When the entity information registration processing unit 14B receives the above-mentioned entity registration request, in step S41, it performs a series of processes to register the entity information as follows.

Figure 8 is a flowchart showing an example of the processing procedure and processing content of the entity information registration processing performed by the entity information registration processing unit 14B.

That is, in step S411, the entity information registration processing unit 14B first reads the differential specification information of the network equipment specified in the entity registration request from the specification/policy information DB 31B. Next, in step S412, the entity information registration processing unit 14B reads specification information related to the network equipment that will be the inheritance source from the specification/policy information DB 31B based on the inheritance relationship information contained in the read differential specification information.

The entity information registration processing unit 14B then, in step S413, combines the attribute information contained in the specification information of the network equipment from which the inheritance was derived with the unique attribute information contained in the differential specification information, thereby generating complete specification information containing all the attribute information necessary to define the characteristics of the network equipment.

In step S414, the entity information registration processing unit 14B then compares the attribute information defined by the entity information included in the entity registration request with the attribute information included in the generated complete specification information. Then, in step S415, it determines whether the possible values of the attributes requested in the entity registration request are within the range of possible values of attributes with matching names among the attribute information included in the complete specification information of the network equipment to be registered. In other words, it determines whether the contents of the entity registration request satisfy the registration conditions defined by the attributes in the specification information of the network equipment to be registered.

If the result of this determination is that the contents of the entity registration request satisfy the registration conditions, the entity information registration processing unit 14B proceeds to step S416 and registers the entity information included in the entity registration request in the entity information DB 32B. Finally, in step S417, a registration completion message is sent from the communication I/F unit 4B to the operator terminal OT that originated the request.

The entity information includes multiple attribute information corresponding to the above specification information. Each attribute information is represented by a pair of RSC, which represents the name of the attribute, and Resource Characteristic Value (RCV), which represents the value for the attribute. An example is shown in the access control section.

When a specification/policy registration request is received, it is also possible to read the inheritance source specification information from specification/policy information DB31B based on the inheritance relationship information included in the specification/policy registration request, and generate complete specification information based on this inheritance source specification information and the differential specification information included in the specification/policy registration request, and register this in specification/policy information DB31B. In this case, when determining whether or not to register entity information, the entity information registration processing unit 14B does not need to perform the process of generating the complete specification information, but can obtain the complete specification information from specification/policy information DB31B and determine whether or not to register the entity information.

(3) Access Control for Registered Specification Information FIG. 9 is a flowchart showing an example of the procedure and content of the access control process executed by the control unit 1B of the network management device NM.

(3-1) When Policy is Not Inherited FIG. 11 is a diagram showing an example of access control when policy is not inherited and a disclosure request is unconditionally rejected.

For example, suppose a network administrator from Company X sends a disclosure request using terminal UTi, one of the user terminals UT1 to UTn, for specification information registered in the network management device NM.

In response to this, the control unit 1B of the network management device NM, under the control of the access control processing unit 15B, detects the receipt of the above-mentioned disclosure request in step S50. When the above-mentioned disclosure request is received, the access control processing unit 15B first obtains, in step S51, entity information corresponding to the entity name specified in the disclosure request from the entity information DB 32B.

In the example shown in Figure 11, TPE_Ethernet 1 is specified in the disclosure request, so the access control processing unit 15B obtains the entity information indicated by TPE_Ethernet 1 from the entity information DB 32B, as shown in (1) of Figure 11.

Next, in step S52, the access control processing unit 15B reads from the specification/policy information DB 31B the policy information associated with the differential specification information from which the entity information requested to be disclosed was generated.

In the example shown in Figure 11, the entity information TPE_Ethernet 1 requested to be disclosed lists TPE_Ethernet_Company A_spec as the differential specification information of the source. Therefore, as shown in (2) in Figure 11, the access control processing unit 15B first searches for the differential specification information TPE_Ethernet_Company A_spec, and then obtains the policy information associated with the retrieved differential specification information TPE_Ethernet_Company A_spec from the specification/policy information DB 31B.

After acquiring the policy information, the access control processing unit 15B next determines in step S53 whether the content of the policy information is "inheritance control information" or "policy change information." If the result of this determination is "inheritance control information," the access control processing unit 15B then determines in step S54 whether the "inheritance control information" is "inherit" or "not inherit."

In the example shown in Figure 11, the "inheritance control information" is set to "do not inherit." Therefore, as shown in (3) of Figure 11, the access control processing unit 15B determines that no policy information is set in the differential specification information TPE_Ethernet_Company A_spec corresponding to the entity information TPE_Ethernet 1 for which disclosure has been requested. Based on the result of this determination, the access control processing unit 15B denies disclosure of the entity information TPE_Ethernet 1 specified in the disclosure request. Instead, in step S58, it generates a disclosure-prohibited message and returns the generated disclosure-prohibited message from the communication I/F unit 4B to the requesting user terminal UTi.

(3-2) When a disclosure request satisfies the disclosure conditions of an inherited policy FIG. 12 is a diagram showing an example of access control when a policy is inherited and a disclosure request satisfies the disclosure conditions of the inherited policy.

Note that the processing from step S50 to step S54 in Figure 9 is the same as in the case (3-1) described above, so its explanation will be omitted.

As shown in (2) of Figure 12, assume that "inherit" is entered in the policy information associated with the differential specification information TPE_Ethernet_Company_B_Spec corresponding to the entity information TPE_Ethernet_1 for which disclosure has been requested. In this case, in step S55, the access control processing unit 15B searches for the specification information TPE_Ethernet_Spec that is the inheritance source of the differential specification information TPE_Ethernet_Company_B_Spec, and obtains the policy information associated with this inheritance source specification information from the specification/policy information DB 31B, as shown in (3) of Figure 12. Then, in step S56, the access control processing unit 15B determines whether the request content of the disclosure request satisfies the disclosure conditions defined in the inherited policy information.

In the example shown in Figure 12, the inherited policy information defines the disclosure condition as "requester is equal to owner," while the requester listed in the disclosure request is "Company X." Therefore, as shown in (4) of Figure 12, the access control processing unit 15B determines that the request content of the disclosure request satisfies the disclosure condition, because requester Company X matches the owner of the entity information that is the subject of the request.

Based on the above judgment result, the access control processing unit 15B transmits the entity information specified in the above disclosure request from the communication I/F unit 4B to the requesting user terminal UTi in step S57. Thus, the entity information TPE_Ethernet 1 is disclosed, as shown in (5) of Figure 12.

(3-3) When the disclosure conditions of the inherited policy are not met Figure 13 is a diagram showing an example of access control when the policy is continued but the disclosure request does not meet the disclosure information of the inherited policy.

Note that the processing from step S50 to step S55 in Figure 9 is the same as in the case (3-2) described above, so its explanation will be omitted.

In step S55, the access control processing unit 15B obtains the inherited policy information from the specification/policy information DB 31B, as shown in (3) of Figure 13, and in step S56, determines whether the request content of the disclosure request sent from the user terminal UTi satisfies the disclosure conditions defined in the inherited policy information.

In the example shown in Figure 13, the requester listed in the disclosure request is "Company Y," and the inherited policy information defines the disclosure condition as "the requester is equal to the owner." Therefore, the requester, Company Y, does not match the owner of the entity information that is the target of the request, and the access control processing unit 15B determines that the request content of the disclosure request does not satisfy the disclosure condition defined in the policy, as shown in (4) of Figure 13.

As a result of this judgment, the access control processing unit 15B denies disclosure of the entity information TPE_Ethernet 1 specified in the above disclosure request, and instead generates a disclosure-prohibited message in step S58 and returns this disclosure-prohibited message from the communication I/F unit 4B to the requesting user terminal UTi.

(3-4) When the disclosure request satisfies the disclosure conditions of the changed policy Figure 14 is a diagram showing an example of access control when a policy is changed and as a result the disclosure request satisfies the disclosure conditions of the changed policy.

Note that the processing from step S50 to step S52 in Figure 9 is the same as in the cases (3-1) and (3-2) described above, so its explanation will be omitted.

If the access control processing unit 15B determines that the content of the policy information associated with the differential specification information corresponding to the entity information requested for disclosure is "policy change information," it proceeds to step S56. Then, in step S56, it determines whether the request content of the disclosure request sent from the user terminal UTi satisfies the changed disclosure conditions defined in the policy change information.

The example shown in Figure 14 shows a case where, when registering policy information, policy information different from the policy information associated with TPE_Ethernet_Spec of the specification information from which it is inherited is defined for TPE_Ethernet_Company_Spec of the differential specification information, that is, a case where policy information is redefined without inheriting the policy information of the specification information from which it is inherited.

In this state, when requester Company Y requests disclosure of entity information TPE_Ethernet 2, the owner defined for this entity information TPE_Ethernet 2 is "Company X," and this requester "Company X" satisfies the disclosure conditions and actions defined in the policy information after the change in the differential specification information corresponding to the above entity information TPE_Ethernet 2, i.e., the condition that "anyone can disclose by any requester."

As a result, based on the above judgment result, the access control processing unit 15B transmits the entity information specified in the above disclosure request from the communication I/F unit 4B to the requesting user terminal UTi in step S57. Thus, as shown in (5) of Figure 12, the entity information TPE_Ethernet 2 is disclosed.

If, in determining the disclosure conditions in step S56, the contents of the disclosure request do not satisfy the disclosure conditions of the changed policy information, the access control processing unit 15B proceeds to step S58. In step S58, the disclosure of the entity information TPE_Ethernet 2 is not permitted, and instead a disclosure-prohibited message is generated and returned from the communication I/F unit 4B to the requesting user terminal UTi.

(Actions and Effects)
As described above, in the network management device NM of one embodiment, when externally defining specification information that defines the characteristics of network equipment similar to registered network equipment and policy information that defines the disclosure conditions thereof, differential specification information that indicates the difference between the specification information of the registered network equipment is defined as the inheritance source, and information indicating whether or not to inherit the policy information is defined, and these pieces of information are registered.

Furthermore, in this state, when a user sends a disclosure request for registered information, the system first determines whether the policy information associated with the differential specification information corresponding to the information to be disclosed is "inherit" or "do not inherit." If it is determined that the information to be disclosed is not to be inherited, the system refuses to disclose the information to be disclosed. If it is determined that the information to be disclosed is to be inherited, the system further determines whether the disclosure request satisfies the disclosure conditions based on the policy information from which it was inherited, and if the disclosure conditions are met, the information to be disclosed is sent to the source of the disclosure request.

Furthermore, if "policy change information" is defined in the policy information associated with the above-mentioned differential specification information, it is determined whether the above-mentioned disclosure request satisfies the disclosure conditions based on this policy change information, and if the disclosure conditions are met, the information to be disclosed is sent to the requester.

Therefore, according to one embodiment, when setting policy information for differential specification information, if the policy information to be set is identical to the policy information associated with registered specification information and this registered policy information can be inherited by the policy information, inheritance control information indicating whether or not inheritance is possible is defined as second policy information. Therefore, when setting new policy information, disclosure conditions only need to be defined if inheritable policy information has not already been registered. This reduces the amount of definition work required by network administrators when externally defining policy information compared to unconditionally defining disclosure conditions for all policy information each time policy information is set. As a result, it is possible to reduce the workload required for external definition processing of policy information.

Furthermore, when determining whether or not to disclose information in response to a disclosure request, even if disclosure conditions are not defined in the policy information, the policy information is inherited from the specification information from which it is inherited, so the determination of whether or not to disclose can be made without any problems.

In other words, according to one embodiment, it is possible to reduce the workload required for external definition processing of policy information while reliably determining whether or not disclosure is permitted.

[Other embodiments]
(1) In one embodiment, a series of processes from inputting specification information and policy information to registering them is performed simultaneously. However, the present invention is not limited to this. The series of processes from inputting specification information to registering it and the series of processes from inputting policy information to registering it may be performed independently. In this way, the network administrator can register policy information at any time, for example, after registering specification information.

(2) In one embodiment, an example was described in which a network administrator uses an operator terminal OT to remotely register specification information, entity information, and policy information in the network management device NM. However, this invention is not limited to this. If the functionality of the network management device NM is provided in an information processing device such as a personal computer located in an office, for example, the specification information, entity information, and policy information may be registered directly in the information processing device.

(3) In one embodiment, registration operations for specification information, entity information, and policy information are performed from a single operator terminal OT, but it is also possible to perform registration operations for specification information, entity information, and policy information from separate operator terminals.

(4) In one embodiment, the network management device NM is provided with the specification/policy information DB31B and entity information DB32B. However, the specification/policy information DB31B and entity information DB32B may be provided in a database server or the like separate from the network management device NM, and the network management device NM may access the specification/policy information DB31B and entity information DB32B provided in the database server or the like to perform registration processing for specification information, entity information, and policy information. Furthermore, the specification information registration processing function, entity information registration processing function, and policy information registration function may be distributed across multiple information processing devices.

(5) In addition, the functions, processing procedures and processing content, format and data structure of specification information, entity information and policy information of the network management device can be modified and implemented in various ways without departing from the spirit of this invention.

Although the embodiments of the present invention have been described in detail above, the above description is merely an example of the present invention in every respect. It goes without saying that various improvements and modifications can be made without departing from the scope of the present invention. In other words, when implementing the present invention, specific configurations corresponding to the embodiments may be adopted as appropriate.

In short, this invention is not limited to the above-described embodiments, and can be embodied by modifying the components in the implementation stage without departing from the spirit of the invention. Furthermore, various inventions can be created by appropriately combining multiple components disclosed in the above-described embodiments. For example, some components may be deleted from all of the components shown in the embodiments. Furthermore, components from different embodiments may be appropriately combined.

DESCRIPTION OF THE SYMBOLS NM...Network management device OT...Operator terminal UT1 to UTn...User terminal NW...Network 1A, 1B...Control unit 2A, 2B...Program storage unit 3A, 3B...Data storage unit 4A, 4B...Communication I/F unit 5A...Input/output I/F unit 6A, 5B...Bus 51...Input device 52...Output device 11A...Specification information input reception processing unit 12A...Policy information input reception processing unit 13A...Entity information input reception processing unit 14A...Specification/policy registration request transmission processing unit 15A...Entity registration request transmission processing unit 11B...Specification/policy registration request reception processing unit 12B...Specification/policy information registration processing unit 13B...Entity registration request reception processing unit 14B...Entity information registration processing unit 15B...Access control processing unit 31A...Specification/policy information storage unit 32A...Entity information storage unit 31B...Specification/policy information DB
32B...Entity information DB

Claims (7)

a storage unit in which first specification information defining characteristics of a first network equipment to be managed and first policy information defining first disclosure conditions related to the first specification information are registered in a mutually associated state;
a first registration processing unit that additionally registers second specification information in the storage unit, the second specification information defining characteristics of second network equipment that are partially common to the first specification information;
a second registration processing unit that registers entity information, which defines actual resources to be set for the second network equipment in correspondence with a plurality of pieces of attribute information included in the second specification information, in an entity information storage unit;
a third registration processing unit that registers second policy information that defines a second disclosure condition related to the second specification information in the storage unit in a state where the second policy information is associated with the second specification information;
an access control processing unit that, when a disclosure request for the entity information is input, determines whether the disclosure request satisfies the second disclosure condition based on the second policy information associated with the second specification information corresponding to the entity information;
The second registration processing unit
additionally registering inheritance control information indicating whether or not a disclosure condition is inherited from the first policy information to the second policy information as the second policy information;
The access control processing unit
A network management device that determines whether the second policy information is the inheritance control information, and if it is determined to be the inheritance control information, determines whether the disclosure request satisfies the second disclosure condition based on the inheritance control information. The access control processing unit
a process of determining whether the inheritance control information indicates that there is inheritance or that there is no inheritance when it is determined that the second policy information is the inheritance control information;
a process of determining that the disclosure request does not satisfy the second disclosure condition when it is determined that the inheritance is not present;
The network management device according to claim 1 , further comprising: if it is determined that the inheritance is present, a process of determining whether the disclosure request satisfies the first disclosure condition based on the first policy information that is the source of inheritance. a third registration processing unit that additionally registers policy change information representing third disclosure conditions obtained by changing at least a part of the second disclosure conditions represented by the second policy information as the second policy information in the storage unit in a state where the policy change information is associated with the second specification information;
2. The network management device of claim 1, wherein, when the disclosure request for the entity information is input, the access control processing unit determines whether the second policy information associated with the second specification information corresponding to the entity information is the inheritance control information or the policy change information, and if it is determined to be the policy change information, determines whether the disclosure request satisfies the third disclosure condition based on the policy change information. A network management device as described in any one of claims 1 to 3, wherein the access control processing unit transmits the entity information to the sender of the disclosure request when it is determined that the disclosure request satisfies the first disclosure condition, the second disclosure condition, or the third disclosure condition defined by the second policy information. when it is determined that the disclosure request does not satisfy the first disclosure condition, the second disclosure condition, or the third disclosure condition defined by the second policy information, the access control processing unit generates a disclosure not permitted message and returns the message to a sender of the disclosure request.
4. The network management device according to claim 1. A network management method executed by an information processing device, comprising:
a first step of registering, in a storage unit, first specification information that defines characteristics of a first network equipment to be managed and first policy information that defines first disclosure conditions related to the first specification information in a state in which the first specification information and the first policy information are associated with each other;
a second step of additionally registering second specification information in the storage unit, the second specification information defining characteristics of second network equipment that are partially common to the first specification information;
a third step of registering entity information, which defines actual resources to be set for the second network equipment in correspondence with a plurality of pieces of attribute information included in the second specification information, in an entity information storage unit;
a fourth step of registering second policy information, which defines second disclosure conditions related to the second specification information, in the storage unit in a state where the second policy information is associated with the second specification information;
a fifth step of determining, when a disclosure request for the entity information is input, whether or not the disclosure request satisfies the second disclosure condition based on the second policy information associated with the second specification information corresponding to the entity information;
The fourth step is
additionally registering inheritance control information indicating whether or not a disclosure condition is inherited from the first policy information to the second policy information as the second policy information;
The fifth step is
A network management method that determines whether the second policy information is the inheritance control information, and if it is determined to be the inheritance control information, determines whether the disclosure request satisfies the second disclosure condition based on the inheritance control information. A program that causes a processor provided in a network management device to execute at least one process of each processing unit provided in the network management device described in any one of claims 1 to 3.