Method of Managing Connectivity Between Resources in a Computer Network and System Thereof

Abstract

There are provided a computer-implemented connectivity manager and a method of managing connectivity between resources in a computer network using the connectivity manager. The method comprises: generating a connectivity specification of a given application, said specification comprising one or more connections generated in accordance with received by the connectivity manager user's definition of network resources and connections therebetween required to the given application, each connection characterized by one or more source resources, one or more destination resources and services therebetween; recognizing, by the connectivity manager, all access-control devices among the plurality of access-control devices, which are involved in controlling all connections comprised in said connectivity specification; identifying, by the connectivity manager, in each of the recognized access-control devices, access-control rules engaged in control of connections comprised in said connectivity specification; and mapping, by the connectivity manager, said connections comprised in said connectivity specification to the identified engaged access-control rules.

1 . A connectivity manager comprising a processor and a memory and capable of automated managing connectivity between resources in a computer network comprising a plurality of access-control devices controlling connectivity between the network resources in accordance with a plurality of access-control rules, the manager comprising a processor-based connectivity engine operatively coupled to a hardware-based network interface, wherein the connectivity engine is configured to:
 obtain a connectivity specification of a given application, said specification comprising one or more connections generated in accordance with resources and connections therebetween specified by a user with respect to the given application, each connection characterized by one or more source resources, one or more destination resources and services therebetween;   recognize, using the network interface, all access-control devices, among the plurality of access-control devices, involved in controlling all connections comprised in said connectivity specification, wherein at least one access-control device is involved in controlling at least one connection which is not comprised in said generated connectivity specification;   identify in each of the recognized access-control devices, all access-control rules which are engaged in control of connections comprised in said connectivity specification, wherein the plurality of access-control rules comprises at least one rule which is not engaged in control of connections comprised in said connectivity specification; and   map said connections comprised in said connectivity specification to the identified engaged access-control rules.   
     
     
         2 . The connectivity manager of  claim 1 , wherein the connectivity engine is configured to recognize said access-control devices engaged in control of connections comprised in said connectivity specification responsive to an event selected from a group comprising: generating said connectivity specification; amending a generated connectivity specification of the given application; and receiving a client's connectivity request addressed to the given application. 
     
     
         3 . The connectivity manager of  claim 1  further comprising a client interface configured to receive a user's definition of connections, wherein said connectivity engine is configured to generate the connectivity specification of the given application in accordance with a received user's definition. 
     
     
         4 . The connectivity manager of  claim 1  further comprising a client interface configured to receive one or more user's amendments of a connectivity specification, wherein said connectivity engine is configured to generate the connectivity specification of the given application in accordance with received amendments. 
     
     
         5 . The connectivity manager of  claim 1 , wherein the connectivity engine is further configured to monitor changes related to access-control devices and/or changes related to access-control rules implemented on the access-control devices and to further identify the engaged rules responsive to respective changes. 
     
     
         6 . The connectivity manager of  claim 1 , wherein the results of said mapping are indicative of changes to be made in the engaged access-control rules in order to provide the connections comprised in the connectivity specification and/or a client's connectivity request addressed to the given application. 
     
     
         7 . The connectivity manager of  claim 6 , wherein the connectivity engine is further configured to issue one or more tickets related to the access-control devices and specifying said changes. 
     
     
         8 . The connectivity manager of  claim 6 , wherein the connectivity engine is further configured to automatically amend implemented access-control rules in accordance with said results of said mapping. 
     
     
         9 . The connectivity manager of  claim 6 , wherein the connectivity engine is further configured to evaluate a connectivity status of at least one connection in the given application in accordance with said results of said mapping. 
     
     
         10 . The connectivity manager of  claim 6 , wherein the connectivity engine is further configured to evaluate a connectivity status of the given application in accordance with said results of said mapping. 
     
     
         11 . The connectivity manager of  claim 10 , wherein the connectivity engine is further configured to monitor the connectivity status of the given application, recognize the status changes, and issue a respective alert. 
     
     
         12 . The connectivity manager of  claim 6 , wherein the connectivity engine is further configured to evaluate the client's connectivity request addressed to the given application in accordance with said results of said mapping. 
     
     
         13 . The connectivity manager of  claim 1 , wherein the connectivity engine is further configured to present the recognized access-control devices and/or the identified engaged access-control rules for connections specified in the application. 
     
     
         14 . The connectivity manager of  claim 1 , wherein said connectivity specification of the given application is accommodated in a memory of said connectivity manager. 
     
     
         15 . The connectivity manager of  claim 14 , wherein the results of said mapping are accommodated in the memory of said connectivity manager, said accommodation provided in association with accommodated connectivity specification of the given application. 
     
     
         16 . The connectivity manager of  claim 14 , wherein the recognized access-control devices and/or the identified engaged access-control rules for each connection comprised in the connectivity specification are accommodated in the memory of said connectivity manager, said accommodation provided in association with accommodated connectivity specification of the given application. 
     
     
         17 . The connectivity manager of  claim 1  implemented as a stand-alone suitably programmed computer operatively connected to said plurality of access-control devices. 
     
     
         18 . A method of managing connectivity between resources in a computer network comprising a plurality of access-control devices controlling a connectivity between the network resources in accordance with a plurality of access-control rules, the method comprising:
 a. generating, by a connectivity manager, a connectivity specification of a given application, said specification comprising all connections corresponding to received by the connectivity manager definition of a connectivity specified by a user with respect to the given application, each connection characterized by one or more source resources, one or more destination resources and services therebetween;   b. recognizing, by the connectivity manager, all access-control devices among the plurality of access-control devices which are involved in controlling all connections comprised in said generated connectivity specification, wherein at least one access-control device is involved in controlling at least one connection which is not comprised in said generated connectivity specification;   c. identifying, by the connectivity manager, in each of the recognized access-control devices, all access-control rules which are engaged in control of connections comprised in said connectivity specification, wherein the plurality of access-control rules comprises at least one rule which is not engaged in control of connections comprised in said connectivity specification; and   d. mapping, by the connectivity manager, said connections comprised in said connectivity specification to the identified engaged access-control rules.   
     
     
         19 . The method of  claim 18  further comprising monitoring changes related to access-control devices and/or changes related to access-control rules implemented on the access-control devices and further re-identifying the engaged rules responsive to respective changes. 
     
     
         20 . The method of  claim 18  further comprising monitoring, by the connectivity manager, the connectivity status of the given application, recognizing the status changes, and issuing a respective alert.