1. Technical Field of the Invention
The present invention relates to a method and system for policy based management in a communication system, comprising a policy enforcement point associated with a plurality of policy decision points, wherein the enforcement point transmits a request for a decision from the decision points.
2. Description of Related Art
In an open services market, operators of communications networks such as telecommunication networks or data networks wish to provide highly secure, open, standard interfaces to their networks.
Policy-based management of a network is a recent approach to meet these requirements by distribution of functionality among network components and by simplifying the linking of the distributed functionality to one another by employing policies. In the service layer, policies may govern if, when and how much to charge, whether identities should be anonymised, etc. The term ‘policy-based management’ in this patent specification should expansively be construed to cover any kind of control of communications network functionality based on policies. It includes also the control and evaluation of policies, policy decisions and policy enforcement in a communications network.
A policy is a statement that dictates what behaviours are appropriate and under which conditions. A network administrator may define a set of policies governing the network. A policy consists of ‘policy logic’ (i.e. the rules/logic to be evaluated) and ‘policy data, comprising parameters in this policy logic that may be given specific values. A policy may be expressed in many ways including a script composed of conditions and actions. The conditions are to be evaluated. The condition/action expression is not the only way of expressing a policy. Other examples of how a policy may be expressed are:                the Privacy Preferences Expression Language. Using this language, a user can express her preferences in a set of preference-rules, which can then be used by her user agent to make automated or semi-automated decisions regarding the acceptability of machine-readable privacy policies from P3P enabled Web sites. (P3p stands for “The Platform for Privacy Preferences Project”, developed by the World Wide Web Consortium, is an industry standard which provides a simple, automated way for users to gain more control over the use of personal information on Web sites the users visit).        Parlay/OSA Policy Management policy. Parlay integrates telecom network capabilities with IT applications via a secure, measured, and billable interface. OSA stands for Open Services Architecture;        Parlay/OSA service level agreement;        Extensible Access Control Markup Language (XACML), XACML defines a general policy language used to protect resources as well as an access decision language.        
Policy-based management provides a way to allocate network resources, primarily network bandwidth, quality of service (QoS), and security (such as firewalls), according to defined business policies. The increase of the importance of policy-based management is evident in for example the increasing requirements for QoS with the use of Voice over IP (VoIP) and other real-time applications. Because of these type of applications, the requirement for bandwidth allocation based on policy increases.
Policies comprise rules for e.g.:                Access to resources on the network;        High priority traffic;        Low priority traffic;        Traffic with guaranteed delivery;        Bandwidth allocation to ensure guaranteed delivery.        
Recent trends show that the concept ‘policies’ appears more and more in the context of standardization and is increasingly being referred to by customers. Examples of standardization bodies are Open Mobile Alliance (OMA), Liberty Alliance, Web Services in general, Parlay/OSA, Internet Engineering Task Force (IETF), and Organization for the Advancement of Structured Information Standards (OASIS).
A policy-based management system allows administrators to define policy rules and manage them in the policy system. These rules may take the form ‘If condition, then action.’ A condition may be a user or group, the time of day, the application type, or the network address. Policy rules are then distributed to network resources. Policy-based management systems are best for large networks where large numbers of devices are easier to manage from a central location. Public networks will also use a form of policy management to allocate resources, but resource allocation is based on SLAs (services level agreements) established with customers. Resources include devices that manage network bandwidth, security, IP addresses, storage, processors, and agents, as well as systems that manage services such as billing and accounting.
In a communications network there are several places where policies are used. The Policy Framework (POLICY) Working Group of the Internet Engineering Task Force (IETF) has developed a policy management architecture that is considered the best approach for policy management on the Internet. It includes the following components:                Policy Management Service: A graphical user interface for specifying, editing, and administering policy;        Dedicated Policy Repository: A place to store and retrieve policy information, such as a Directory Enabled Network (DEN) device or an LDAP server (LDAP meaning ‘Lightweight Directory Access Protocol’, a protocol that applications use to access the directory);        Policy Decision Point (PDP): A resource manager or policy server that is responsible for handling events and making decisions based on those events (i.e., at time x do y);        Policy Enforcement Point (PEP): A PEP exists in network nodes such as routers, firewalls, and hosts. It enforces the policies (i.e. carry out an action) based on the decision it has received from the PDP;        Local Policy Decision Point (LPDP): This is a co-located PDP that exists within a PEP e.g. within a network node.        
A variety of protocols may be used to communicate policy information between the PDP and the PEP. Common Open Policy Service (COPS) is the usual protocol between a PEP and a PDP, where the PEP requests a decision from the PDP. COPS is a client/server protocol that provides transport services for moving policy information among IP network nodes. It also provides the transport for policy queries and responses. By moving policy information to different subnets, users can log on at other locations and receive the same service they receive from their home network. Also other protocols may be used like DIAMETER, which is a protocol for authentication, authorization and accounting) or Simple Network Management Protocol (SNMP), which is an Internet standard protocol for network management software.
A typical policy transaction starts with a resource request to some device by a user or another network device. For example, a user may request access to a router interface that leads to the Internet. The router forwards the request to the PDP in the policy server using the COPS protocol. The policy server then queries one or more directory servers to determine the user's authorization. The information is then used to build a “policy lease” that is sent back to the router. The router then implements and enforces the policy via its policy enforcement point.
In the prior art, PEPs are mostly associated with just one PDP. Typically, a PDP supports one or more commonly known configuration protocols, such as COPS. For top-down provisioning, a PDP may use COPS-Provisioning (COPS-PR) to push top-down configuration information to associated PEPs. COPS-PR is an extension to COPS where the PDP contacts a PEP. COPS-PR has been designed within a framework that is optimized for efficiently provisioning policies across devices. First, COPS-PR allows for efficient transport of attributes, large atomic transactions of data, and efficient and flexible error reporting. Second, as it has a single connection between a PEP and PDP per area of policy control identified by a COPS Client-Type, it guarantees only one PDP updates a particular policy configuration at any given time.
Systems according to the prior art comprise a PEP sending out a decision request to a PDP when a specific Event occurs at the entity implementing the PEP. The PEP sends information about the Event or a pointer/reference to such information to the PDP. The PDP evaluates the Event against the policy relevant to the event and decides the appropriate policy enforcement. Subsequently the PDP returns its decision on how the PEP must act on the Event to the PEP and the PEP carries out (enforces) the decision generated by the PDP.
Especially in the service layer area there may occur the problem that multiple policy decision points may be involved and communicate their decisions to one PEP, which may lead to multiple conflicting decisions from the PEP's point of view. For example, the privacy settings of the user (actor) may be represented as one set of policies and the business rules derived by the operator/service provider (actor) as a different set of policies. Each set of policies may be evaluated by a dedicated own PDP. The result of evaluations of both sets of policies needs to be taken into account when providing the service to the user. Typically there are two known solutions to this problem.
The first known solution is a PEP requesting actions from only one PDP. This means that this PDP contains the combined rules of the different actors/roles. This may be realized but puts a high burden on the management side of the central PDP. The problem with this solution is that this becomes quite complex. For example because permission for reading-, writing-, and/or execution management actions on policies may differ per actor.
The second known solution is a PEP consulting multiple PDPs, and combining the results in a preconfigured or hard coded way. Hard-coded features are built into the hardware or software in such a way that they cannot be easily modified. For example the privacy preferences always overrule the business rules. The problem with this solution is that the PEP has to be actively aware of the different PDPs and their priorities in a relatively inflexible way.