Patent Publication Number: US-2004059801-A1

Title: Method and apparatus for implementing access control on web-based configuration pages using SNMP-based mechanism

Description:
FIELD OF THE INVENTION  
       [0001] The present invention is directed to methods and apparatuses for remotely interacting with a cable modem, and more particularly to a method and apparatus for remotely interacting with a cable modem to enable user configuration of certain parameters that affect operations of the cable modem.  
       BACKGROUND  
       [0002] As cable modems continue to evolve, additional features beyond those specified in the Data Over Cable Service Interface Specification (DOCSIS) (e.g., gateway, wireless interface) are being integrated into the cable modems. These features typically require a number of parameters to be configured in order for proper operation. Service providers, in this case, Multiple Services Operators (MSOs), want the flexibility of being able to configure these parameters on behalf of the user or to permit the user to perform the configuration on their own. Often, this is done remotely.  
       [0003] MSOs manage the cable modem configuration remotely through the use of Simple Network Management Protocol (SNMP), whereas user configuration is generally accomplished using a web browser. This necessitates some type of access control function that can be: (1) managed by the service provider through SNMP for defining the features that the user is allowed to configure; and (2) linked with the web server to enforce the access policies set by the service provider.  
       [0004] Two common approaches currently exist for the management of configuration parameters, neither of which fully addresses the issues described above. The first approach is to manage configuration exclusively through SNMP using the access control features of the SNMP framework. This allows a service provider to control which features a user is allowed to configure; however, the user must use SNMP to perform the configuration. The access control functions of SNMP will enforce the access policies set by the service provider. A web browser cannot be used to perform the configuration because there is no inherent interface between the web server and the SNMP access control function.  
       [0005] The second approach is to split the responsibility of configuring feature parameters between the service provider and the user. The service provider through SNMP configures a set of features and the user through a web browser configures a different set of features. Thus, the service provider does not have the flexibility in specifying which features the user will be allowed to configure. This is fixed by the design of the product and cannot be changed.  
       [0006] The present invention is therefore directed to the problem of developing a method and apparatus for enabling a user and/or a service provider to configure operational parameters of a cable modem remotely while providing the service provider control over which operational parameters a user may configure.  
       SUMMARY OF THE INVENTION  
       [0007] The present invention solves these and other problems by providing inter alia an access control function that is configurable through SNMP and is linked to the web server. This provides the service provider flexibility in determining which features a user is permitted to configure through a web browser. The access control function enables the service provider to define access policies that specify the user configurable features. The web server consults the access function to dynamically determine which features the user is allowed to configure and display the appropriate web pages.  
       [0008] The present invention is also very flexible and extensible. The approach is flexible because it allows each service provider to define their own set of features that they will manage or allocate management control to the user. The approach is extensible because it allows new features to be added as the product evolves. Any new features and associated configuration parameters added to the product in the future can be controlled via a Delegation Management Information Database (MIB). An MIB is an acronym for a database of objects, with attributes and values, representing the manageable components of a network device.  
       [0009] According to one aspect of the present invention, the Access Control Function may be implemented as a single function call to the Delegation MIB lookup procedure for all the parameters on a Graphical User Interface (GUI) page. This approach would require a variable list of parameters to be passed to the Access Control Function for each page. One alternative is to make multiple Access Control Function calls to the Delegation MIB lookup procedure, one function call for each parameter on a GUI page. Many of the advanced GUI pages contain several configuration parameters and a function call to determine access control for each parameter may result in reduced performance or a noticeable delay to the GUI user.  
     
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
     [0010]FIG. 1 depicts a flow chart of an exemplary embodiment of a method according to a first aspect of the present invention.  
     [0011]FIG. 2 depicts a logical diagram of the architecture of an exemplary embodiment of a management module according to another aspect of the present invention.  
     [0012]FIG. 3 depicts a block diagram of an exemplary embodiment of an apparatus for performing the method set forth in claim 1 according to still another aspect of the present invention. 
    
    
     DETAILED DESCRIPTION  
     [0013] It is worthy to note that any reference herein to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.  
     [0014] One aspect of the present invention provides an overall configuration management architecture for cable modems, e.g., Motorola cable modem gateway products. An overview of the overall architecture is first provided, followed by specific details on the components of the architecture for which the present invention applies.  
     [0015] Traditionally, the management of the configuration information in a Data Over Cable Service Interface Specification (DOCSIS) compliant cable modem was entirely done by the service provider (e.g., the cable operator). SNMP is the primary method used by the service provider to manage the cable modem. While the user was able to view some of the configuration information, the user was not allowed to modify any configuration parameters. Some non-DOCSIS value added features in the cable modem (e.g., wireless interface, gateway, router, firewall, VPN end-point, print server) require parameters to be configured for the feature to properly function. The user through a web browser usually performs the configuration of these value-added features. With this management model, the service provider does not have the ability to control the configuration of non-DOCSIS features.  
     [0016] The architecture of the present invention supports the following capabilities:  
     [0017] 1. The service provider can manage feature configuration parameters through SNMP.  
     [0018] 2. The service provider may delegate the configuration of select feature parameters to the user.  
     [0019] 3. The user can configure select feature parameters through a web browser, but only those feature parameters that are permitted by the service provider.  
     [0020] A logical representation of the management architecture is shown in FIG. 2, which depicts a Management Module  20  containing the following components:  
     [0021] (1) Delegation Management Information Base (MIB)  22 ;  
     [0022] (2) Feature MIB  23 ;  
     [0023] (3) Logical Configuration Database (LCD)  21 ;  
     [0024] (4) Access Control Function  24 ; and  
     [0025] (5) Web Server  25 .  
     [0026] The Delegation MIB  22  and the interface between the Access Control Function and the Web Server are the two components being addressed herein.  
     [0027] Referring to FIG. 3, the service provider  31  (MSO Operator using a PC or workstation) through a network management station (NMS)  32  interfaces (via the Internet, an Intranet or HFC network  33 ) to the processor  34  hosting the Management Module using SNMP. Specifically, the NMS  32  uses SNMP to interface with the Delegation MIB  22  and the Feature MIB  23 . The Feature MIB  23  is a generic name given to any MIB though which the particular parameters of a feature can be viewed and configured through SNMP. The configuration parameter settings are stored in the Local Configuration Database (LCD)  21 . There may be a different MIB for different features. For example, an 802.11 interface may have an associated 802.11 MIB, and a gateway component may have an associated gateway MIB, etc.  
     [0028] The Delegation MIB  22  enables a service provider to specify the feature parameters that the user is allowed to view and/or configure. This is accomplished by specifying an access policy for each feature parameter. The Access Control function maintains the access policies for all feature parameters.  
     [0029] A user, through a web browser executing on a personal computer  35 , interfaces with the web server  34  in the cable modem to view/configure feature parameter settings. The web server  34  interfaces with the Access Control Function  24  to determine which feature parameters a user is allowed to view/configure. Based on the access control policies defined by the service provider, the Access Control Function  24  determines which feature parameters settings the web server  34  is permitted to present to the user. Only the allowed feature parameter settings are retrieved from the LCD  21  and presented to the user. If the user is allowed to modify a parameter setting and does so, the update is stored back into the LCD  21 .  
     [0030] Delegation MIB Details  
     [0031] The Delegation MIB  22  is the mechanism through which a service provider can specify the feature parameters that a user is allowed to view/configure. The Delegation MIB  22  can be implemented as a standard SNMP MIB module and consists of a single table that has zero or more entries. An entry defines an access policy and has the form &lt;OID, AccessLevel&gt;, where:  
     [0032] OID—An object identifier from the Feature MIB  23 . The OID may be fully specified to identify a single feature parameter or may be partially specified to identify a set of feature parameters.  
     [0033] AccessLevel—Defines the access level that the user is allowed to perform on this feature parameter. Values from lowest to highest access level are: Read-Write, Read Only, and No Access.  
     [0034] Web Server Interface to Access Control Module  
     [0035] Prior to presenting a web page to the user, the web server  34  interfaces with the Access Control Function  24  to determine which feature parameters are allowed to be viewed/configured. Each configuration field on the web page is associated with an OID corresponding to a feature parameter defined in the Feature MIB  23 . For each feature parameter OID, the web server  34  interfaces with the Access Control Function  24  to determine the appropriate access level to use. The Access Control Function  24  looks for an access policy that matches the OID associated with the configuration field on the web page. If found, one of the following access levels is returned to the web server:  
     [0036] Read-Write—The web server  34  displays the feature parameter and allows the user to update the parameter.  
     [0037] Read-Only—The web server  34  displays the feature parameter as a read-only field. The field is grayed out to indicate that the user is not allowed to update this parameter.  
     [0038] No-Access—The web server  34  does not display the feature parameter to the user.  
     [0039] The matching rules used by the Access Control Function  24  are as follows:  
     [0040] Given the OID of the feature parameter, attempt to find an access policy that exactly matches. If a match is found, apply the access level specified by this entry.  
     [0041] If an exact match is not found, attempt to find an entry that matches the most number of OID sub-identifiers from left to right. E.g., let us say that the feature OID is 1.3.6.1.2.3.4.8 and there are two access policies, &lt;1.3.6.1.2, RW&gt; and &gt;1.3.6.1.2.3, RO&gt;. The access level for the feature parameter would be read-only (RO) since it best matches the second entry.  
     [0042] If there is no matching access policy, the access level is as defined by the Feature MIB. This implies that if the Delegation MIB is empty, the user has full configuration access.  
     [0043] Although various embodiments are specifically illustrated and described herein, it will be appreciated that modifications and variations of the invention are covered by the above teachings and are within the purview of the appended claims without departing from the spirit and intended scope of the invention. Furthermore, these examples should not be interpreted to limit the modifications and variations of the invention covered by the claims but are merely illustrative of possible variations.