Object model for network policy management

DETAILED DESCRIPTION The present invention is directed to a unified policy management system where various policies, namely, the set of rules and instructions that determine the network's operation, may be established and enforced from a single site.
According to one embodiment of the invention, the system includes a first edge device associated with a first network having a first set of resources that is configured to manage the policies for the first network according to the policy settings stored in a first database.
The system also includes a second edge device associated with a second network having a second set of resources that is configured to manage the policies for the second network according to the policy settings stored in a second database.
The first and second edge devices act as policy enforcers for their respective networks.
The system further includes a central policy server defining the first and second policy settings and managing the first and second edge devices from a single location.
Thus, a network administrator need not multiply his or her efforts and associated expenditures in configuring and managing the policy enforcers individually.
The central policy server is also associated with a central database storing configuration information of the first and second edge devices.
The central database is organized according to a hierarchical object oriented structure for simplifying policy management.
According to one aspect of the invention, the central database and the first and second databases are Lightweight Directory Access Protocol (LDAP) databases all adhering to the hierarchical object oriented structure.
According to another aspect of the invention, the structure includes a plurality of resource objects and policy objects for defining the first and second policy settings.
The resource objects preferably include devices, users, hosts, services, and time.
Devices are the policy enforcers at the edge of a particular private network and are associated with a set of users and a particular host