Sophos Limited

Endforce, Inc.

Kenneth E Mulh

Raymond John Bell

Kevin A Russo

William S Emerick

Mark A Beadles

Bradley A C Manring

In embodiments of the present invention, improved capabilities are described for a method presenting a client, providing client information and requesting an IP address from a DHCP server, where the DHCP server may formulate a first IP assignment and a first multiple DHCP options. A policy management facility may be associated with the interception of the first IP assignment and the first multiple DHCP options, which may result in the first IP assignment and the first multiple DHCP options not being sent to the client. The method may send client information to the policy management facility. The policy management facility may formulate a second multiple DHCP options and may send it to the DHCP server. The DHCP server may change first IP assignment and first multiple DHCP option to a second IP assignment and the second multiple DHCP options. The second IP assignment and the second multiple DHCP options may then be forwarded to the client.

Dynamic internet address assignment based on user identity and policy compliance

User interface and policy loading aspects of a policy-based, outsourced, network management system. In one aspect, a user selects policies using a graphical user interface (GUI) with a two paned window having a tree view of the policies in one pane. In another aspect, the policies are (1) created in the GUI format (e.g., XML), (2) sent over a network (e.g., the internet) to a service center in the same format, and (3) are loaded, manipulated and stored in the same format. In another aspect, the initial loading of the policies is done using a bulk loader in a logic layer. In another aspect, the logic layer also includes a configuration checker which handles changes or additions to policies in a finished network management system. Any aspects of the new or changed policy that are inconsistent with the finished system are parsed and stripped out. In another aspect, where the details of a new policy or change aren't specified, a base configuration creator creates a policy with minimal attributes. In another aspect, the logic layer also contains a device control console, which allows bypassing the policy creating and configuring to allow a user to directly access a device for configuration.

Selection and storage of policies in network management

The present invention provides device configuration and policy configuration data to network devices over a public network, e.g., the internet. A secure communication link is first established over the public network to the network device. Next, policy and configuration information is downloaded to the network device using that secure communication link. In one embodiment, the communication link is an IPSec tunnel. In particular, the network policy may include a virtual private network (VPN) policy. The invention addresses the secure downloading of configuration and policy information, which has not been an issue in prior art devices where there was an ability to provide such information internally to a network, without the need to go over the internet.

Device plug-in system for configuring network device over a public network

A policy engine in a policy-based, outsourced, network management system. In one embodiment, the management system is multi-layered, modular and stores device configuration data in non-device specific format, which are subsequently translated to device-specific format by lower layers of the management system. The non-device specific format is the same (e.g., XML) as that used to create the policies with the user GUI (e.g., browser) and transport them to the service center over the internet. A database stores a policy directory in a hierarchical format that is separate from a policy store (configuration store) for devices in a flat (non-hierarchical or parallel) format. In one embodiment, a policy engine develops policies in a hierarchical format, but then stores the device schema, or objects, in a low-level, flat database. Multiple hierarchical services which impact a single device have the characteristics related to that device knitted together, and then fed back to a policy store database as a flat file for that device, in a non-device specific format. Thus, instead of storing the policies separately, and in hierarchical linked format, the device descriptions are stored with the aspects of all policies that affect that device.

Growing community of inventors

Upper Arlington, OH, United States of America

Kenneth E Mulh