Method and system for managing security policies

• US 10,009,385 B2
• Filed: 06/21/2017
• Issued: 06/26/2018
• Est. Priority Date: 09/17/2007
• Status: Active Grant

• Current Assignee: Rudolf Schreiner, Ulrich Lang
• Original Assignee: Rudolf Schreiner
• Inventors: Lang, Ulrich, Schreiner, Rudolf
• Primary Examiner(s): Rahman, Shawnchoy
• Application Number:
  US15/629,170
• Publication Number:
  US 20170289198A1
• Time in Patent Office: 370 Days
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A policy management system includes a policy management device that is configured to manage a policy input and/or a template and/or a functional model, a policy enforced device that is directly or indirectly connected to the policy management device via a network and that is configured such that at least a part of the functional model managed by the policy management device reflects the functional features/behaviors of the policy enforced device, a policy enforcement device that is configured to execute policy enforcement on the policy enforced device, and a policy decision device that is configured to receive machine-enforceable rule and/or configuration from the policy management device. The policy enforcement device, when a policy relevant event occurs, instructs the policy decision device to determine the result of the condition of the transmitted machine-enforceable rule and/or configuration for implementing the policy input for the policy enforced device, thereby modifying an operation of the policy enforced device or the policy enforcement device to execute the action.

Claims

1. A policy management system, comprising:

at least one policy management device including a processor, memory having a computer executable program and a policy input and/or a template stored and/or a functional model therein, the at least one policy management device being configured to manage the policy input and/or the template and/or the functional model when the computer executable program is executed by the processor;

at least one policy enforced device that includes a processor, memory having a computer executable program and is directly or indirectly connected to the policy management device via a network and that is configured when the computer executable program is executed by the processor, such that at least a part of the functional model managed by the policy management device reflects the functional features/behaviors of the at least one policy enforced device;

at least one policy enforcement device that is a part of or connected to the at least one policy enforced device and/or at least one policy decision device and is configured, when the respective executable program is executed by the respective processor, to execute policy enforcement on the policy enforced device, the policy enforcement device being a part of or connected to the at least one policy enforced device and/or at least one policy decision device; and

the at least one policy decision device that is configured to receive at least one machine-enforceable rule and/or configuration from the at least one policy management device,

wherein the at least one policy management device receives a policy input loaded from the memory, or entered by a user via a user interface, indicating at least one input policy for the at least one policy enforced device, the received input policy relating to non-functional system attributes for the at least one policy enforced device and received in a format that is not machine-decidable at a policy decision entity and is not machine-enforceable at a policy implementation entity of the at least one policy enforced device,

wherein the at least one policy management device determines at least one functional model for the at least one policy enforced device relevant for the received input policy based on which functional system attributes are indicated by the input policy and/or configuration template, the at least one functional model indicating functional system attributes used to iteratively fill attribute placeholders,

wherein the at least one policy management device loads at least one pre-configured rule and/or configuration template from the memory to the processor,

wherein the at least one policy management device automatically or semi-automatically generates at least one machine-enforceable rule and/or configuration that is in a ready to implement format in a manner compliant with the received input policy by selecting the at least one pre-configured rule and/or configuration template corresponding to the input policy, and iteratively fills attribute placeholders of the at least one pre-configured rule and/or configuration template with functional system attributes values indicated by the at least one functional model, wherein the at least one machine-enforceable rule and/or configuration, which indicates at least one condition and at least one action is an output that is produced by the processor from the received policy input, the at least one functional model, and/or the at least one pre-configured rule and/or configuration template,

wherein the at least one policy management device transmits the at least one machine-enforceable rule and/or configuration to the at least one policy decision device that determines the result(s) of the at least one pre-configured rule and/or configuration template for the policy enforced device, and

wherein the at least one policy enforcement device, when a policy relevant event occurs, instructs the at least one policy decision device to determine the result of the at least one condition of the transmitted at least one machine-enforceable rule and/or configuration for implementing the policy input for the at least one policy enforced device, thereby modifying an operation of the at least one policy enforced device or the at least one policy enforcement device to execute the at least one action.

2. The policy management system according to claim 1, wherein the at least one policy management device transmits the at least one machine-enforceable rule and/or configuration to the at least one policy decision device which determines which actions should be or should not be executed by the at least one policy enforcement device, which implements the at least one machine-enforceable rule for communicating at the at least one policy enforced device.

3. The policy management system according to claim 1, wherein the pre-configured rule and/or configuration template is implemented as a model-to-model transformation, a model-to-text transformation, hard-coded security models of the received policy input, or hard-coded processor instructions.

4. The policy management system according to claim 1, wherein the pre-configured rule and/or configuration template specifies the mappings, transformations or instructions how the at least one machine-enforceable rule and/or configuration is produced from the received policy input.

5. The policy management system according to claim 4, wherein the pre-configured rule and/or configuration template specifies which attributes of the received policy input are to be filled in using which functional system attributes.

6. The policy management system according to claim 1, wherein the pre-configured rule and/or configuration template and/or the at least one policy input and/or functional model each contain reference information that indicates a reference to information contained in the pre-configured rule and/or configuration template and/or in the at least one policy input and/or functional model.

7. The policy management system according to claim 6, wherein the reference to the information contained in the pre-configured rule and/or configuration template and/or in the at least one policy input and/or functional model directly indicates the referenced information in the pre-configured rule and/or configuration template and/or in the at least one policy input and/or functional model.

8. The policy management system according to claim 6, wherein the reference to the information contained in the pre-configured rule and/or configuration template and/or in the at least one policy input and/or functional model indicates a mapping element in the pre-configured rule and/or configuration template and/or in the at least one policy input and/or functional model, which reference information that indicates an indirect reference to information contained in the pre-configured rule and/or configuration template and/or in the at least one policy input and/or functional model.

9. The policy management system according to claim 1, wherein the at least one functional model specifies at least one subset of the model elements of the at least one functional model, the subset indicating the model elements available as inputs.

10. The policy management system according to claim 1, wherein the received policy input includes at least one of organization-specific, industry-specific, market-specific, user-specific, technical architecture-specific, enterprise architecture-specific, or business architecture-specific policy input.

11. The policy management system according to claim 1, wherein the received policy input includes monitoring, alarm and logging policies, which include conditions and actions that trigger monitoring alerts to be created, log entries to be created, and/or alarms to be triggered.

12. The policy management system according to claim 1, wherein the at least one policy decision device is not collocated with the at least one policy enforcement device and communicates with the at least one policy enforcement device on or connected with another policy enforced device and that makes a decision based on the at least one action, or that is collocated on the same policy enforced device with the at least one policy enforcement device that enforces the at least one machine-enforceable rule and/or configuration.

13. The policy management system according to claim 1, wherein functional system attribute values that are filled by the at least one policy management device include values that are available or known before the at least one machine-enforceable rule and/or configuration is decided at the at least one policy decision device and/or enforced at the at least one policy enforcement device.

14. The policy management system according to claim 1, wherein functional system attributes values that are filled by the at least one policy management device include values that are not available or known until the at least one machine-enforceable rule and/or configuration is decided at the at least one policy decision device and/or enforced at the at least one policy enforcement device.

15. The policy management system according to claim 1, wherein the functional system attributes specify attribute values, calculation result values, and/or comparison values of the at least one template that is filled in.

16. The policy management system according to claim 12, wherein the at least one action includes at least one of a request for the at least one policy enforced device or policy enforcement device to proceed with the policy relevant event, a request for the at least one policy enforced device or policy enforcement device not to proceed with the policy relevant event, a request for the at least one policy enforced device or policy enforcement device to remove some or all of a content transmitted as part of the policy relevant event, a request for the at least one policy enforced device or policy enforcement device to proceed with the policy relevant event but to modify some or all of the content of transmitted as part of the policy relevant event, a request for the at least one policy enforced device or policy enforcement device to create a log entry about subsequent requests available on the at least one policy enforced device, and a request for the at least one policy enforced device or policy enforcement device to raise monitoring alerts and/or alarms.

17. The policy management system according to claim 1, wherein the input policy includes an indication that facilities the processor to select a particular template, so that the processor loads at least one template needed to process a particular input policy, and does not load a template not needed to process the particular input policy.

18. The policy management system according to claim 1, wherein the policy enforcement device is connected to the at least one policy enforced device via the network.

19. The policy management system according to claim 1, wherein the at least one policy decision device is included in the at least one policy enforced device.

20. The policy management system according to claim 1, wherein the at least one policy decision device is included in the at least one policy enforcement device.