Managing and changing device settings

A system facilitates the configuring of a set of devices. The system stores templates, where each template includes configuration data that applies to one or more of the devices. The system configures the devices based on the configuration data in the templates.

BACKGROUND

1. Field of the Invention

The principles of the invention relate generally to device management and, more particularly, to the managing and changing of device settings.

2. Description of Related Art

Security devices have been used to secure networks from intruders. A large network might deploy hundreds (if not a thousand or more) security devices to protect the network against intruders. A small network might deploy as few as about a dozen security devices.

Currently, network operators configure the security devices using a command line interface. A large security device configuration might include five thousand or more lines of data. A small security device configuration, on the other hand, might include one hundred or fewer lines of data. Current configuration techniques commonly require that a network operator enter the lines of data separately for each security device in the network. When there are hundreds (or more) of security devices, configuring the security devices becomes burdensome and error prone.

SUMMARY

According to one aspect, a system for configuring a device is provided. The system may include a memory and a processor. The memory may store a set of templates. The templates may include parameter values for the device. The processor may prioritize the templates, where a parameter value associated with a higher priority one of the templates overrides a parameter value associated with a lower priority one of the templates. The processor may configure the device based on the parameter values in the templates and the priorities of the templates.

According to another aspect, a system for configuring a device is provided. The system may include means for storing a set of templates, where a first one of the templates obtains configuration information associated with the device from a second one of the templates. The system may also include means for configuring the device based on the configuration information in the first template that was obtained from the second template.

According to yet another aspect, a system for configuring a set of devices of different types is provided. The system may include a memory and a processor. The memory may store a template associated with the devices, where the template includes generic configuration data that applies to the different types of devices. The processor may configure the devices based on the generic configuration data in the template.

According to a further aspect, a system for configuring a set of devices of different types is provided. The system may include a memory and a processor. The memory may store a first template that includes generic configuration data that applies to the different types of devices and a second template that includes specific configuration data that applies to one of the different types of devices. The processor may configure the devices based on the generic configuration data in the first template and the specific configuration data in the second template.

According to another aspect, a method for configuring a device may include associating a template with the device, where the template includes a parameter associated with the device; obtaining configuration information from the device; determining whether a parameter in the configuration information equals the parameter in the template; and removing the parameter in the configuration information when the parameter in the configuration information equals the parameter in the template.

According to a further aspect, a method for configuring devices may include associating a template with a set of devices, where the template includes configuration information associated with the devices; changing the configuration information included in the template; identifying the devices that are associated with the template; validating data associated with at least some of the identified devices; and loading the changed configuration information from the template into the identified devices.

DETAILED DESCRIPTION

Overview

True integration can occur when every device in a network can be controlled and every event can be seen in real time from a single location. Management systems and methods, consistent with the principles of the invention, may integrate a network of individual devices, such as security devices, into a single effective system that can be controlled from a central location.

To assist in managing and configuring multiple, possibly distributed, devices, management systems and methods, consistent with the principles of the invention, may use device templates that can specify configuration parameter values for the devices. A template may refer to a data object and methods for accessing and using it. Templates may be stored as objects, where an object may include a data structure with one or more sub-fields.

Parameter values for a device may be configured by referring to one or more templates. When a parameter value in a template is changed, the parameter value may also change for all device configurations that refer to that template. Accordingly, templates may reduce deployment costs, reduce network complexity, permit devices to be configured more efficiently, and minimize troubleshooting time.

Exemplary Network Configuration

FIG. 1is an exemplary diagram of a network100in which systems and methods consistent with the principles of the invention may be implemented. Network100may include network devices110-1through110-M (where M≧2) (collectively referred to as network devices110) and user interface devices120-1through120-N (where N≧1) (collectively referred to as user interface devices120) connected to a management system130. Network devices110and user interface devices120may connect to management system130via wired, wireless, and/or optical connections.

Network devices110may include security devices (e.g., devices that perform firewall, virtual private network (VPN), denial of service (DoS) protection, traffic management processing, and/or other security-related processing) and/or other types of devices that permit access to network100and/or protect network100against malicious traffic or other forms of attack. Alternatively or additionally, network devices110may include computers or other types of computation or communication devices.

User interface devices120may include any devices capable of providing a user interface to an operator, such as a personal computer, a wireless telephone, a personal digital assistant (PDA), a laptop, or another type of computation or communication device. WhileFIG. 1shows user interface devices120as separate from management system130, it may be possible for management system130to reside in the same physical device as at least one of user interface devices120.

The user interface may be embodied in software in user interface devices120. The user interface may be used to remotely access management system130to provide a powerful, graphical environment for centrally managing network devices110in network100. In one implementation, the user interface may communicate with management system130using a secure, proprietary, transmission control protocol (TCP)-based connection that encrypts and authenticates traffic. Multiple operators may simultaneously (or substantially simultaneously) interact with network devices110via user interface devices120.

Management system130may be implemented within a device, such as a computer or a combination of computers. Management system130may provide functionality to integrate management of network devices110in network100. For example, management system130may permit an operator to identify, configure, manage, monitor, and/or generate reports with regard to network devices110deployed in network100.

FIG. 2is an exemplary diagram of management system130according to an implementation consistent with the principles of the invention. Management system130may include user interface server210and device server220. User interface server210and device server220may work collectively to perform the functions of management system130. In one implementation, user interface server130and device server220may communicate using a secure, proprietary, TCP-based connection that encrypts and authenticates traffic.

User interface server210may manage the system resources and data that drives the functionality of management system130. User interface server210may maintain database(s) to centralize the storage of information associated with network devices110, such as their configuration data and policies. The database(s) may store data associated with network devices110and templates as objects.

FIG. 3is an exemplary diagram of a portion of a database300that may be maintained by user interface server210according to an implementation consistent with the principles of the invention. Database300may include information associated with template objects310and information associated with device objects320. Each template object may correspond to a template and can refer to other template objects. In one implementation, templates are generic in that they apply to different types and versions of network devices110. In another implementation, templates are specific in that they apply to specific types or versions of network devices110. In yet another implementation, templates may be operator-configurable as either generic or specific.

Each device object may correspond to a deployed or undeployed one of network devices110. A deployed device refers to a device that is currently being used in network100. An undeployed device refers to a device that is not currently being used in network100. A new device configuration can be modeled for an undeployed device prior to installing the configuration on a physical device.

Various relationships may exist between template objects and device objects.FIGS. 4A and 4Billustrate two possible relationships. As shown inFIG. 4A, a template object may refer to multiple template objects. In this case, a template object may be used to supply a configuration parameter value (or multiple configuration parameter values) for another template object.

As shown inFIG. 4B, a device object may refer to multiple template objects. As described above with regard toFIG. 4A, any of these template objects may refer other template objects. When a device object refers to more than one template object, conflicts may arise when two (or more) template objects contain different values for the same configuration parameter. Accordingly, the template objects may be prioritized so that the higher priority template values override lower priority template values. An operator may set or change the priority of template objects referred to by a device object. The operator may also set parameter values within the device object that may override any conflicting template parameter values. The operator may determine where a parameter value comes from (e.g., a default value, a template value, or a device object value) via one of user interface devices120(FIG. 1). Several techniques are known in the art for presenting this information to the operator.

To illustrate the overriding of parameter values, assume that a device (D1) refers to two templates (T1 and T2) and that template T2 is higher in priority than template T1.

To further illustrate the overriding of parameter values, assume that a device (D1) refers to two templates (T1 and T2) and that template T2 is higher in priority than template T1.

For each device parameter, there is a path from the top of the template through various subparameters to the parameter. To find the corresponding data in the template, each parameter in the path, starting from the top, may be examined. There are two cases for stepping down the path in the template: (1) the simple parameters case, and (2) the list parameters case.

Simple parameters can have a single value for each of its subparameters. Simple parameters may be identified by a fixed keyword in the device object (e.g., “status”). As another example, “header” is a simple parameter that has several subparameters, such as “osVersion” and “platform.” In this case, the template may be examined to find a parameter with the same fixed keyword in the template.

List parameters can have multiple values for each of its subparameters. For example, “zone” is a list parameter that can have can have multiple subparameters that, in the simple case, can be identified by the data in the subparameter (e.g., TRUST and UNTRUST). In this case, the template may be examined to find a parameter with a matching key field value in the template.

The structure of list and key parameters may be defined in an object schema. In the example above, the matching is done using the value from a single subparameter. The schema may alternatively specify that matching is to be done using multiple subparameters—all of which must be equal to find the matching parameter.

Returning toFIG. 2, device server220may enable network devices110to connect to and communicate with management system130. WhileFIG. 2shows a single device server220, there may be additional device servers220in other implementations consistent with the principles of the invention. Some of the functions performed by device server(s)220may include translating communication between user interface server210and network devices110, collecting information from network devices110, formatting configuration information sent to network devices110, and/or consolidating log and event data from network devices110.

Exemplary Architecture of User Interface Device, Management System, User Interface Server, and/or Device Server

FIG. 5is an exemplary diagram of a device500that may correspond to one of user interface devices120, management system130, user interface server210, and/or device server220according to an implementation consistent with the principles of the invention. Device500may include a bus510, a processor520, a main memory530, a read only memory (ROM)540, a storage device550, an input device560, an output device570, and a communication interface580. Bus510may permit communication among the elements of device500.

Processor520may include a conventional processor, microprocessor, or processing logic that may interpret and execute instructions. Main memory530may include a random access memory (RAM) or another type of dynamic storage device that may store information and instructions for execution by processor520. ROM540may include a conventional ROM device or another type of static storage device that may store static information and instructions for use by processor520. Storage device550may include a magnetic and/or optical recording medium and its corresponding drive.

Input device560may include a conventional mechanism that permits an operator to input information to device500, such as a keyboard, a mouse, a pen, voice recognition and/or biometric mechanisms, etc. Output device570may include a conventional mechanism that outputs information to the operator, including a display, a printer, a speaker, etc. Communication interface580may include any transceiver-like mechanism that enables device500to communicate with other devices and/or systems.

Device500may perform certain processes in response to processor520executing software instructions contained in a computer-readable medium, such as memory530. A computer-readable medium may be defined as a physical or logical memory device and/or carrier wave. The software instructions may be read into memory530from another computer-readable medium, such as storage device550, or from another device via communication interface580. The software instructions contained in memory530may cause processor520to perform processes that will be described later. Alternatively, hardwired circuitry may be used in place of or in combination with software instructions to implement processes consistent with the principles of the invention. Thus, implementations consistent with the principles of the invention are not limited to any specific combination of hardware circuitry and software.

Exemplary Processing

FIG. 6is a flowchart of exemplary processing for creating a template according to an implementation consistent with the principles of the invention. Processing may begin with an operator interacting with a user interface on a device, such as one of user interface devices120(FIG. 1). The user interface may present the operator with the option of creating a template, such as an add template button. Selection of the add template button may cause a new template object to be created (act610).

In one implementation, the user interface may present the operator with a new template dialog window in response to the operator's selection of the add template button. The new template dialog window may present the operator with the option of naming the template and a list of configuration parameters (including subparameters, sub-subparameters, etc.) for which configuration data may be presented. The configuration parameters may correspond to all possible parameters that may be configured for a device, such one of network devices110.

A template name may be provided by the operator (act620). The template name may be used to refer to the template and/or to distinguish the template from other templates. One or more configuration parameters may be selected from the list of configuration parameters (act630). For each of the selected configuration parameters, one or more parameter values may be received (act640). For example, the operator may provide a value for each of the selected configuration parameters. Alternatively, the operator may refer to another template to provide values for one or more of the configuration parameters.

When the operator finishes providing values for the selected configuration parameters, the operator may save the new template. For example, the operator may select a save button provided in the user interface. In response to selection of the save button, the new template may be saved. In one implementation, the new template may be saved as a template object (act650) within information associated with template objects310(FIG. 3) of database300.

Once a template is created, it may be desirable to let a device object refer to it.FIG. 7is a flowchart of exemplary processing for referencing a template by a device object according to an implementation consistent with the principles of the invention. Processing may begin with the operator interacting with a user interface on a device, such as one of user interface devices120(FIG. 1). The user interface may present the operator with the option of opening a device object, such as a device button. The user interface may then present the operator with a list of deployed and undeployed (modeled) devices in network100(FIG. 1). Selection of one of the devices from the list of devices may be received to indicate the operator's desire to open the device object associated with the device (act710).

In one implementation, the user interface may present the operator with a device dialog window in response to the operator's selection of a device. The device dialog window may present the operator with configuration options. The operator may be presented with the current parameter values for the device and, optionally for each parameter value, where the data originated (e.g., default value, device value, or template value). The data origin information (possibly in combination with a flag in the template) may be used to limit which parameters of the device object can be modified. For example, if a no-modification flag is set in the template, then parameters specified by the template cannot be modified.

When the operator finishes providing parameter values, the operator may save the device object. For example, the operator may select a save button provided in the user interface. In response to selection of the save button, the device object may be saved (act740). In one implementation, the device object may be saved in information associated with device objects320(FIG. 3) of database300.

The configuration data from the device object and the template(s) may then be loaded into the physical device (act750). For example, management system130may determine whether a connection exists with the device (e.g., one of network devices110). Management system130may then push the configuration data to the device to configure the device.

At some point, the operator may desire to modify an existing template.FIG. 8is a flowchart of exemplary processing for editing a template according to an implementation consistent with the principles of the invention. Processing may begin with an operator interacting with a user interface on a device, such as one of user interface devices120(FIG. 1). The user interface may present the operator with the option of opening a template object, such as a template button. The user interface may then present the operator with a list of previously-created templates. Selection of one of the templates from the list of templates may be received to indicate the operator's desire to open the template object associated with the template (act810).

In one implementation, the user interface may present the operator with a template dialog window in response to the operator's selection of a template from the list of templates. The template dialog window may present the operator with a list of configuration parameters. The operator may then modify the template by, for example, changing, adding, deleting, or otherwise modifying parameter values corresponding to the configuration parameters that the template contains (act820).

When the operator finishes modifying the template, the operator may save the modified template. For example, the operator may select a save button provided in the user interface. In response to selection of the save button, the modified template may be saved. In one implementation, the modified template may be saved as a template object (act830) within information associated with template objects310(FIG. 3) of database300.

It is possible that a configuration parameter within the modified template may include a parameter value that is invalid for or unsupported by one of the devices that refers to the modified template. Accordingly, the device object(s) referring to the template may be identified (act840). The device object(s) may be identified via an analysis of the device objects in information associated with device objects320(FIG. 3).

The identified device object(s) may then be revalidated (act850). The revalidation process may occur prior to or after the template object is saved to database300. The revalidation process may check, for example, whether parameter values are well-formed for their type (e.g., integer, IP, boolean), enumeration values are from the allowable list, integer values are in range, string lengths are in range, required parameters are present, and/or lists have an appropriate number of repetitions for each identified device object(s). Invalid device configurations may be marked in some manner so that the operator can remedy the invalid or unsupported parameter values.

The configuration data from the identified device object(s) and the relevant template objects, including the modified template object, may then be loaded into the physical device(s) (e.g., one(s) of network devices110) associated with the identified device object(s) (act860). For example, management system130may determine whether a connection exists with one of these devices. Management system130may then push the configuration data to the device to configure the device.

At some point, the operator may desire to import configuration data from a device, such as one of network devices110(FIG. 1).FIG. 9is a flowchart of exemplary processing for importing configuration data from a device according to an implementation consistent with the principles of the invention. Processing may begin with an operator interacting with a user interface on a device, such as one of user interface devices120. The user interface may present the operator with the option of opening a device object, such as a device button. The user interface may then present the operator with a list of deployed and undeployed (modeled) devices in network100(FIG. 1).

The operator may select one of the devices from the list of devices (act910) and indicate a desire for the import operation to be performed. The configuration data may be sent (imported) from the device (act920). The configuration data may be loaded into the corresponding device object.

It may then be determined which template parameters correspond to the device object parameters (act930). This may be done using keyword or key field value matching, as described above.

The device object may then be saved (act960). In one implementation, the device object may be saved in information associated with device objects320(FIG. 3) of database300.

CONCLUSION

Systems and methods consistent with the principles of the invention may assist in managing and configuring multiple, possibly distributed, devices based on one or more device templates that can specify configuration parameter values for the devices.

The foregoing description of preferred embodiments of the invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention.

For example, while series of acts have been described with regard toFIGS. 6-9, the order of the acts may differ in other implementations consistent with the principles of the invention. Also, non-dependent acts may be performed in parallel.