Network management device, network management method and program

Abstract

One aspect of the present invention: registers, in a specification information storage unit, specification information in which characteristics of network equipment to be managed are defined using a plurality of sets of attribute information; registers, in an entity information storage unit, entity information in which actual resources to be set for the network equipment are defined in correspondence with the plurality of sets of attribute information; and further registers, in the specification information storage unit, policy information defining disclosure conditions for at least one of the plurality of sets of attribute information included in the specification information, in a state in which the policy information is associated with the specification information. When a disclosure request for the entity information is input, it is determined whether or not the disclosure request satisfies the disclosure conditions on the basis of the policy information associated with the specification information corresponding to said entity information.

Description

[Technical Field]

[0001] One aspect of the present invention relates to a network management system, a network management device, a network management method, and a program used to manage a network. [Background technology]

[0002] When managing information using a database, there are cases where information cannot be disclosed unconditionally, depending on, for example, the type of information, the qualifications of the administrator, etc. Therefore, in the general data management field, disclosure conditions are set, for example, on a database, file, or record basis, and when a user requests disclosure of information, it is determined whether the content of the user's request satisfies the disclosure conditions, and if the content of the request satisfies the disclosure conditions, the information corresponding to the unit can be disclosed.

[0003] Meanwhile, in the field of network management, a technology has been proposed for managing networks when building or operating a network management system, for example, by defining the characteristics of various networks or the devices that use them using multiple attributes according to a predetermined model format, generating specification information and entity information represented by the multiple attributes, and registering them in a database within the system (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent No. 6655524 Summary of the Invention [Problem to be solved by the invention]

[0005] However, even in the network management system, for example, entity information may contain information elements specific to the owner, so unconditional disclosure is not desirable, and effective measures are eagerly awaited.

[0006] The present invention has been made in light of the above circumstances, and aims to provide a technique that enables effective disclosure control of management information used in network management. [Means for solving the problem]

[0007] In order to solve the above problem, one aspect of the network management device or method according to the present invention is to register specification information that defines the characteristics of a network facility to be managed using a plurality of pieces of attribute information in a specification information storage unit, and to register entity information that defines actual resources to be set for the network facility in correspondence with the plurality of pieces of attribute information in the entity information storage unit, and further to register the plurality of pieces of attribute information included in the specification information Among them, for a combination of multiple attribute information including attribute information that defines the characteristics of a resource specification Policy information defining disclosure conditions is registered in the specification information storage unit in association with the specification information, and when a disclosure request for the entity information is input, it is determined whether the disclosure request satisfies the disclosure conditions defined by the corresponding policy information.

[0008] According to one aspect of the present invention, specification information relating to registered network equipment is Multiple Attribute information A combination of multiple attribute information, including attribute information that defines the characteristics of a resource specification Policy information defining disclosure conditions for the entity information is registered. When a disclosure request for entity information corresponding to the specification information is received, it is determined whether or not the disclosure request satisfies the disclosure conditions defined by the policy information.

[0009] Thus, according to one embodiment, the specification information and entity information used for network management include: Based on the disclosure conditions set for a combination of multiple attribute information Disclosure control can be performed, thereby enabling appropriate management of network management information. [Effects of the Invention]

[0010] That is, according to one aspect of the present invention, it is possible to provide a technique that enables effective disclosure control of management information used for network management. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a network management system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing an example of a hardware configuration of an operator terminal of the network management system shown in FIG. [Figure 3] FIG. 3 is a block diagram showing an example of the software configuration of the operator terminal of the network management system shown in FIG. [Figure 4] FIG. 4 is a block diagram showing an example of a hardware configuration of a network management device in the network management system shown in FIG. [Figure 5] FIG. 5 is a block diagram showing an example of a software configuration of the network management device of the network management system shown in FIG. [Figure 6] FIG. 6 is a flowchart showing an example of a procedure and content of a registration request reception and transmission process executed by the control unit of the operator terminal shown in FIGS. [Figure 7] FIG. 7 is a flowchart showing an example of the procedure and content of the registration process of the specification information, entity information, and policy information executed by the control unit of the network management device shown in FIGS. [Figure 8] FIG. 8 is a flowchart showing an example of the procedure and content of the access control process executed by the control unit of the network management device shown in FIGS. [Figure 9] FIG. 9 is a diagram showing an example of policy information registered by the policy information registration process shown in FIG. [Figure 10] FIG. 10 is a diagram illustrating an example of the operation of the access control process. [Figure 11]FIG. 11 is a diagram illustrating another example of the operation of the access control process. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] [One embodiment] (Configuration example) (1) System FIG. 1 is a diagram showing an example of the configuration of a network management system according to an embodiment of the present invention.

[0014] In one embodiment, the network management system has a network management device NM as its core component, and is capable of transmitting information data via a network NW between this network management device NM and an operator terminal OT used by the network manager, and multiple user terminals UT1 to UTn used by other managers or users.

[0015] The network NW includes multiple types of networks, such as the IP (Internet Protocol) network that constitutes the Internet, Ethernet (registered trademark) that constitutes a LAN (Local Area Network), and other transmission networks, but any network that is capable of transmitting the above information data may be used.

[0016] (2) Equipment (2-1) Operator terminal (OT) 2 and 3 are block diagrams showing an example of the hardware configuration and software configuration of the operator terminal OT.

[0017] The operator terminal OT includes a control unit 1A that uses a hardware processor such as a central processing unit (CPU). A storage unit having a program storage unit 2A and a data storage unit 3A, a communication interface (hereinafter, the interface will be referred to as I / F) unit 4A, and an input / output I / F unit 5A are connected to the control unit 1A via a bus 6A.

[0018] An input device 51 and an output device 52 are connected to the input / output I / F unit 5A. The input device 51 includes, for example, a keyboard, a mouse, and operation buttons. The input device 51 is used by a network administrator to input specification information, entity information, and policy information related to the network to be managed or the devices used in this network (hereinafter collectively referred to as network equipment).

[0019] The specification information is expressed as a plurality of pieces of attribute information defining the characteristics of the network equipment, which are associated with identification information such as the name of the specification information. The entity information is expressed as a plurality of pieces of attribute information defining, for example, the resources actually available for the network equipment, which are associated with the plurality of attributes of the specification information, and which are associated with identification information such as the name of the entity information.

[0020] The policy information defines the disclosure conditions for, for example, all or each of the attribute information constituting the specification information, or a combination thereof. The policy information is also called an access control policy.

[0021] The output device 52 includes, for example, a display, and displays display data required for input processing of the specification information, entity information, and policy information.

[0022] The communication I / F unit 4A, under the control of the control unit 1A, transmits information data to and from the network management device NM using a communication protocol defined by the network NW.

[0023] The program storage unit 2A is configured by combining, for example, a nonvolatile memory such as a solid-state drive (SSD) as a storage medium that can be written to and read from at any time, and a nonvolatile memory such as a read-only memory (ROM), and stores middleware such as an operating system (OS), as well as application programs required for inputting the above-mentioned information required for network management in one embodiment and transmitting a registration request for that information. Hereinafter, the OS and each application program will be collectively referred to as the program.

[0024] The data storage unit 3A is, for example, a combination of a non-volatile memory such as an SSD that can be written to and read from at any time as a storage medium, and a volatile memory such as RAM (Random Access Memory), and its storage area includes a specification information storage unit 31A, an entity information storage unit 32A, and a policy information storage unit 33A as the main storage units required to implement one embodiment of the present invention.

[0025] The specification information storage unit 31A stores the input specification information until the transmission of the registration request is completed. The entity information storage unit 32A stores the input entity information until the transmission of the registration request is completed. The policy information storage unit 33A stores the input policy information until the transmission of the registration request is completed.

[0026] The control unit 1A includes, as processing functions necessary for implementing one embodiment, a specification registration request transmission processing unit 11A, an entity registration request transmission processing unit 12A, and a policy registration request transmission processing unit 13A. These processing units 11A to 13A are all realized by causing a hardware processor in the control unit 1A to execute an application program stored in the program storage unit 2A.

[0027] In addition to storing the above application programs in advance in the program storage unit 2A, they may also be downloaded from the network management device NM or other application servers when necessary and stored in the program storage unit 2A.

[0028] The specification registration request transmission processing unit 11A receives specification information input on the input device 51 via the input / output I / F unit 5A, and transmits a specification registration request including the received specification information from the communication I / F unit 4A to the network management device NM.

[0029] The entity registration request transmission processing unit 12A receives entity information input via the input / output I / F unit 5A and transmits an entity registration request including the received entity information from the communication I / F unit 4A to the network management device NM.

[0030] The policy registration request transmission processing unit 13A receives policy information input via the input / output I / F unit 5A on the input device 51, and transmits a policy registration request including the received policy information from the communication I / F unit 4A to the network management device NM.

[0031] An example of the specification information, entity information, and policy information will be described in the operation example.

[0032] (2-2) Network Management Device NM 4 and 5 are block diagrams showing an example of the hardware and software configurations of the network management device NM.

[0033] The network management device NM is, for example, a server computer installed on the web or in the cloud. The network management device NM may also be an information processing device such as a personal computer used by an administrator.

[0034] The network management device NM has a control unit 1B that uses a hardware processor such as a CPU, and this control unit 1B is connected to a memory unit having a program memory unit 2B and a data memory unit 3B, and a communication I / F unit 4B via a bus 5B.

[0035] Under the control of the control unit 1B, the communication I / F unit 4B transmits and receives information data to and from the operator terminal OT and the user terminals UT1 to UTn, respectively, using a communication protocol defined by the network NW.

[0036] The program storage unit 2B is configured, for example, by combining a non-volatile memory such as an HDD or SSD as a storage medium that can be written to and read at any time, with a non-volatile memory such as a ROM, and stores middleware such as an OS as well as programs necessary to execute various control processes according to one embodiment of the present invention.

[0037] The data storage unit 3B is, for example, a combination of a non-volatile memory such as an HDD or SSD as a storage medium that can be written to and read from at any time, and a volatile memory such as RAM, and in its storage area, is provided with a specification information database (hereinafter, the database will be referred to as DB) 31B and an entity information DB 32B as storage units necessary to implement one embodiment.

[0038] The specification information DB 31B stores specification information that defines the characteristics of the network equipment to be managed and is sent from the operator terminal OT in response to a specification registration request, and policy information that is defined for this specification information. The entity information DB 32B stores entity information that defines the actual resources of the network equipment and is sent from the operator terminal OT in response to an entity registration request.

[0039] The control unit 1B includes, as processing functions according to an embodiment of the present invention, a specification information registration processing unit 11B, an entity information registration processing unit 12B, a policy information registration processing unit 13B, and an access control processing unit 14B. These processing units 11B to 14B are all realized by causing a hardware processor in the control unit 1B to execute an application program stored in the program storage unit 2B.

[0040] Note that part or all of the processing units 11B to 14B may be realized using hardware such as an LSI (Large Scale Integration) or an ASIC (Application Specific Integrated Circuit).

[0041] The specification information registration processing unit 11B receives a specification registration request transmitted from the operator terminal OT via the communication I / F unit 4B, and registers the specification information included in the received specification registration request in the specification information DB 31B.

[0042] The entity information registration processing unit 12B receives the entity registration request sent from the operator terminal OT via the communication I / F unit 4B, determines whether the entity information represented by the received entity registration request satisfies the registration requirements based on the specification information of the corresponding network equipment registered in the specification information DB 31B, and if the registration requirements are met, registers the entity information in the entity information DB 32B.

[0043] The policy information registration processing unit 13B receives the policy registration request sent from the operator terminal OT via the communication I / F unit 4B, and stores the policy information contained in the received policy registration request, i.e., information defining the disclosure conditions for the attributes of the specification information, in the specification information DB 31B in association with the specification information related to the corresponding network equipment.

[0044] When a disclosure request for entity information defined for a desired network facility is transmitted from a user terminal UT1 to UTn, the access control processing unit 14B receives the disclosure request via the communication I / F unit 4B. Then, the access control processing unit 14B determines whether the entity information specified by the received disclosure request satisfies the disclosure conditions based on the policy information linked to the corresponding specification information, and if the disclosure conditions are satisfied, performs processing to transmit the entity information from the communication I / F unit 4B to the requesting user terminal UT1 to UTn.

[0045] (Example of operation) Next, an example of the operation of the device configured as above will be described.

[0046] (1) Registration of management information related to the network equipment to be managed Fig. 6 is a flowchart showing an example of the procedure and content of a process for accepting input of management information and transmitting a request for its registration, which is executed by the control unit 1A of the operator terminal OT. Fig. 7 is a flowchart showing an example of the procedure and content of a process for registering management information, which is executed by the control unit 1B of the network management device NM.

[0047] (1-1) Registration of specification information (1-1-1) Processing by operator terminal OT In the standby state, the control unit 1A of the operator terminal OT determines in steps S10, S20, and S30 which of the specification information input mode, entity information input mode, and policy information input mode has been set.

[0048] When the specification information input mode is set and the network administrator inputs specification information about the network equipment to be managed by the input device 51, the control unit 1A of the operator terminal OT receives the input specification information via the input / output I / F unit 5A in step S11 under the control of the specification registration request transmission processing unit 11A and temporarily stores it in the specification information storage unit 31A. Then, when the network administrator inputs a transmission instruction after finishing inputting the specification information, the specification registration request transmission processing unit 11A detects the input of the transmission instruction in step S12 and transmits a specification registration request including the specification information stored in the specification information storage unit 31A from the communication I / F unit 4A to the network management device NM in step S13.

[0049] (1-1-2) Processing by the network management device NM In the standby state, the control unit 1B of the network management device NM monitors the reception of a specification registration request, an entity registration request, and a policy registration request in steps S40, S50, and S60, respectively.

[0050] In this state, when a specification registration request is sent from the operator terminal OT, the control unit 1B of the network management device NM receives the specification registration request via the communication I / F unit 4B under the control of the specification information registration processing unit 11B, and registers the specification information included in the received specification registration request in the specification information DB 31B in step S41.

[0051] Figure 9 shows an example of specification information to be registered. This example shows the case of registering specification information related to the Termination Point Encapsulation (TPE) of network equipment that uses Ethernet to be managed, and four attribute information items for defining the characteristics of the network equipment are associated with an identifier name TPE_Ethernet_Spec. Each attribute information item is represented by a pair consisting of a Resource Spec Characteristic (RSC) that indicates the name of the attribute and a Resource Spec Characteristic Value (RSCV) that indicates the range that the attribute can take.

[0052] For example, the four attribute information are: TPE_Ethernet_Spec RSC:vlan / RSCV:1-4096 RSC: Bandwidth / RSCV: 1-1000Mbps RSC:physicalpor / RSCV:pp name ·RSC:owner / RSCV:Owner name Define

[0053] (1-2) Registering entity information (1-2-1) Processing by operator terminal OT With the entity information input mode set, when a network administrator inputs entity information defining actual resources for network equipment to be managed using the input device 51, the control unit 1A of the operator terminal OT receives the input entity information via the input / output I / F unit 5A in step S21 under the control of the entity registration request transmission processing unit 12A and temporarily stores it in the entity information storage unit 32A. Then, when the network administrator inputs a transmission instruction after inputting the entity information, the entity registration request transmission processing unit 12A detects the input of the transmission instruction in step S22 and transmits an entity registration request representing the entity information stored in the entity information storage unit 32A from the communication I / F unit 4A to the network management device NM in step S23.

[0054] (1-2-2) Processing by the network management device NM When an entity registration request is transmitted from the operator terminal OT, the control unit 1B of the network management device NM receives the entity registration request via the communication I / F unit 4B under the control of the entity information registration processing unit 12B, and registers the entity information represented by the received entity registration request in the entity information DB 32B in step S51.

[0055] Entity information is represented by the name of a resource specification and multiple attribute information. Each attribute information is represented by a pair of RSC, which represents the name of the attribute, and Resource Characteristic Value (RCV), which represents the value for the attribute.

[0056] Figure 10 shows an example of registered entity information. In this example, the name and four attribute information for TPE_Ethernet1 are registered. Resource Spec:TPE_Ethernet_Spec RSC:vlan / RCV:123 RSC: Bandwidth / RCV: 1000Mbps RSC:physicalpor / RCV:Switch 1 pp name RSC:owner / RCV:Company C It is defined as follows.

[0057] (1-3) Registering policy information (1-3-1) Processing by operator terminal OT With the policy information input mode set, when the network administrator inputs policy information to be applied to the specification information of network equipment registered as a management target using the input device 51, the control unit 1A of the operator terminal OT receives the input policy information via the input / output I / F unit 5A in step S31 under the control of the policy registration request transmission processing unit 13A and temporarily stores it in the policy information storage unit 33A. Then, when the network administrator inputs a transmission instruction after finishing inputting the policy information, the policy registration request transmission processing unit 13A detects the input of the transmission instruction in step S32 and transmits a policy registration request representing the policy information stored in the policy information storage unit 33A from the communication I / F unit 4A to the network management device NM in step S33.

[0058] (1-3-2) Processing by the network management device NM When a policy registration request is transmitted from the operator terminal OT, the control unit 1B of the network management device NM receives the policy registration request via the communication I / F unit 4B under the control of the policy information registration processing unit 13B. Then, in step S61, the control unit 1B registers the policy information included in the received policy registration request in association with the specification information to be applied that is registered in the specification information DB 31B.

[0059] The policy information is represented by the name of the specification information to which it is applied, the disclosure conditions, and the content of the action.

[0060] An example of policy information registration is shown in Figure 9. In this example, the policy is applied to TPE_Ethernet_Spec, the disclosure condition is defined as "requester is equal to Owner", and the action is defined as "readable".

[0061] The disclosure conditions may also be those that set whether to disclose attributes that define other attributes such as VLAN, bandwidth, number of wavelengths, and IP address of the device, or may set whether to disclose all attributes that make up the specification information. Furthermore, the disclosure conditions may be those that set whether to disclose multiple attributes by using, for example, an AND condition or an OR condition, either alone or in combination.

[0062] Furthermore, in the above operational example, the policy information registration process is performed at an arbitrary timing separate from the specification information registration process, but the policy information registration process may also be performed together with the specification information registration process.

[0063] (2) Access control for registered specification information FIG. 8 is a flowchart showing an example of the procedure and content of the access control process executed by the control unit 1B of the network management device NM.

[0064] Suppose that the owner of the specification information already registered in the network management device NM sends a disclosure request for the specification information from terminal UTi, which is one of the user terminals UT1 to UTn, in order to partially change the specification information or to register new specification information by referring to the specification information.

[0065] In response to this, the control unit 1B of the network management device NM detects the receipt of the disclosure request in step S70 under the control of the access control processing unit 14B. When the disclosure request is received, the access control processing unit 14B first acquires entity information corresponding to the entity name specified in the disclosure request from the entity information DB 32B in step S71. Next, in step S72, the access control processing unit 14B reads policy information associated with the specification information from which the entity information was generated from the specification information DB 31B.

[0066] Then, in step S73, the access control processing unit 14B determines whether the disclosure content specified by the disclosure request satisfies the disclosure conditions based on the disclosure conditions defined in the read policy information. If the result of this determination is that the content of the disclosure request satisfies the disclosure conditions, in step S74, the access control processing unit 14B transmits the entity information requested to be disclosed from the communication I / F unit 4B to the requesting user terminal UTi.

[0067] In contrast, if the content of the disclosure request does not satisfy the disclosure conditions, the access control processing unit 14B generates a disclosure-prohibited message in step S75 and returns the generated disclosure-prohibited message from the communication I / F unit 4B to the requesting user terminal UTi.

[0068] (2-1) Example of operation when disclosure conditions are met FIG. 10 is a diagram showing an example of the operation when the disclosure conditions are satisfied.

[0069] In this example, the requester transmits a disclosure request from the user terminal UTi, specifying "TPE_Ethernet 1" as the disclosure target and "Company C" as the requester's name. The access control processing unit 14B of the network management device NM then first obtains entity information corresponding to "TPE_Ethernet 1," the disclosure target specified by the disclosure request, from the entity information DB 32B in (1) of FIG.

[0070] Next, the access control processing unit 14B reads the policy information associated with the specification information that is the source of the acquired entity information from the specification information DB 31B in (2) of FIG.

[0071] Next, in (3) of FIG. 10, the access control processing unit 14B refers to the disclosure conditions described in the read policy information and determines whether the request content of the disclosure request satisfies the disclosure conditions. In this example, the disclosure requester described in the disclosure request is "Company C," and the Owner described in the disclosure conditions is also "Company C." Therefore, in (4) of FIG. 10, the access control processing unit 14B transmits entity information corresponding to "TPE_Ethernet 1," which is specified in the disclosure request as the disclosure target, to the requesting user terminal UTi.

[0072] (2-2) Example of behavior when disclosure conditions are not met FIG. 11 is a diagram showing an example of the operation when the disclosure conditions are not satisfied.

[0073] In this example, the requester transmits a disclosure request from the user terminal UTi, specifying "TPE_Ethernet 1" as the disclosure target and "Company D" as the requester name. The access control processing unit 14B of the network management device NM then first obtains entity information corresponding to "TPE_Ethernet 1," the disclosure target specified by the disclosure request, from the entity information DB 32B in (1) of FIG.

[0074] Next, the access control processing unit 14B reads the policy information associated with the specification information that is the source of the acquired entity information from the specification information DB 31B in (2) of FIG.

[0075] 11 (3), the access control processing unit 14B refers to the disclosure conditions described in the read policy information and determines whether the request content of the disclosure request satisfies the disclosure conditions. In this example, although the Owner described in the disclosure conditions is "Company C," the disclosure requester described in the disclosure request is "Company D," so the access control processing unit 14B determines that the disclosure request does not satisfy the disclosure conditions.

[0076] Therefore, in this case, the access control processing unit 14B generates a disclosure prohibition message in (4) of FIG. 11 and returns it to the requesting user terminal UTi.

[0077] (Actions and Effects) As described above, in one embodiment, policy information defining disclosure conditions for each attribute information of specification information relating to registered network equipment is transmitted from the operator terminal OT to the network management device NM and registered in the specification information DB 31B. When a disclosure request for entity information of the specification information is received from a user terminal UT1 to UTn, the network management device NM, under the control of the access control processing unit 14B, compares the content of the received disclosure request with the disclosure conditions defined by the policy information to determine whether or not the entity information can be disclosed, and if it is determined that disclosure is possible, transmits the entity information to the requesting user terminal UTi.

[0078] Therefore, according to one embodiment, disclosure control can be performed on an attribute-by-attribute basis for specification information and entity information used in network management, thereby enabling appropriate management of network management information.

[0079] [Other embodiments] (1) In one embodiment, a case has been described in which a network administrator uses an operator terminal OT to remotely register specification information, entity information, and policy information in a network management device NM. However, the present invention is not limited to this. For example, if the functions of the network management device NM are provided in an information processing device such as a personal computer located in an office, the specification information, entity information, and policy information may be registered directly in the information processing device.

[0080] (2) In one embodiment, the registration operations for specification information, entity information, and policy information are performed from a single operator terminal OT, but the registration operations for specification information, entity information, and policy information may also be performed from separate operator terminals.

[0081] (3) In one embodiment, the network management device NM is provided with the specification information DB 31B and the entity information DB 32B. However, the specification information DB 31B and the entity information DB 32B may be provided in a database server or the like separate from the network management device NM, and the network management device NM may access the specification information DB 31B and the entity information DB 32B provided in the database server or the like to perform registration processing of the specification information, entity information, and policy information. Furthermore, the specification information registration processing function, the entity information registration processing function, and the policy information registration function may be distributed and located in multiple information processing devices.

[0082] (4) In addition, the functions, processing procedures and processing contents, format and data structure of specification information, entity information and policy information of the network management device can be modified and implemented in various ways without departing from the spirit of this invention.

[0083] Although the embodiments of the present invention have been described in detail above, the above description is merely an example of the present invention in every respect. It goes without saying that various improvements and modifications can be made without departing from the scope of the present invention. In other words, when implementing the present invention, specific configurations according to the embodiments may be appropriately adopted.

[0084] In short, this invention is not limited to the above-described embodiments, and in the implementation stage, the components can be modified and embodied without departing from the spirit of the invention. Furthermore, various inventions can be formed by appropriately combining multiple components disclosed in the above-described embodiments. For example, some components may be omitted from all the components shown in the embodiments. Furthermore, components from different embodiments may be appropriately combined. [Explanation of symbols]

[0085] NM...Network management device OT: Operator terminal UT1~UTn...User terminal NW...Network 1A, 1B...Control section 2A, 2B...Program memory section 3A, 3B…Data storage unit 4A, 4B...Communication I / F section 5A…I / O I / F section 6A, 5B...bus 51...Input device 52...Output device 11A...Specification registration request transmission processing unit 12A...Entity registration request transmission processing unit 13A...Policy registration request transmission processing unit 11B...Specification information registration processing unit 12B...Entity information registration processing unit 13B...Policy information registration processing unit 14B...Access control processing section 31A...Specification information storage section 32A...Entity information storage unit 33A...Policy information storage unit 31B...Specification information DB 32B...Entity information DB

Claims

1. a first registration processing unit that registers specification information, which defines characteristics of network equipment to be managed using a plurality of pieces of attribute information, in a specification information storage unit; a second registration processing unit that registers entity information, which defines actual resources to be set for the network equipment in correspondence with the plurality of pieces of attribute information, in an entity information storage unit; a third registration processing unit that registers policy information that defines disclosure conditions for a combination of a plurality of pieces of attribute information, including attribute information that defines characteristics of a resource specification, among the plurality of pieces of attribute information included in the specification information, in the specification information storage unit in a state where the policy information is associated with the specification information; an access control processing unit that, when a disclosure request specifying the entity information as a disclosure target is input, determines whether the disclosure request satisfies the disclosure condition based on the policy information; A network management device comprising:

2. The access control processing unit A process of acquiring the entity information designated as a disclosure target by the disclosure request from the entity information storage unit; A process of acquiring, from the specification information storage unit, the policy information associated with the specification information corresponding to the acquired entity information; a process of determining whether the disclosure request satisfies the disclosure condition for the combination of the plurality of pieces of attribute information defined by the acquired policy information; The network management device according to claim 1 , wherein the network management device executes the following:

3. The access control processing unit a process of outputting the entity information designated as the disclosure target by the disclosure request to a source of the disclosure request when it is determined that the disclosure request satisfies the disclosure condition; The network management device of claim 2 further comprising:

4. The access control processing unit When it is determined that the disclosure request does not satisfy the disclosure conditions, a process of outputting a disclosure-prohibited message to the source of the disclosure request is performed. The network management device of claim 2 further comprising:

5. A network management method executed by an information processing device, comprising: a step of registering specification information, which defines the characteristics of the network equipment to be managed using a plurality of pieces of attribute information, in a specification information storage unit; a step of registering entity information, which defines actual resources to be set for the network equipment in correspondence with the plurality of pieces of attribute information, in an entity information storage unit; registering policy information, which defines disclosure conditions for a combination of a plurality of pieces of attribute information including attribute information defining characteristics of a resource specification, among the plurality of pieces of attribute information included in the specification information, in the specification information storage unit in a state in which the policy information is associated with the specification information; a step of determining, when a disclosure request specifying the entity information as a disclosure target is input, whether or not the disclosure request satisfies the disclosure conditions based on the policy information; A network management method comprising:

6. 5. A program for causing a processor included in a network management device to execute processing performed by a processing unit included in the network management device according to claim 1.

Images