Method and system for integrating policies across systems

• US 20050268325A1
• Filed: 05/27/2004
• Published: 12/01/2005
• Est. Priority Date: 05/27/2004
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Deng, Yu, Sahai, Akhil, Kuno, Harumi
• Granted Patent: US 8,095,959 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

The disclosed embodiments relate to a system and method of applying policies. The method may include identifying a first entity and a first relationship, the first relationship defining an attribute related to the first entity. Additionally, the method may include identifying a policy associated with the first entity and the first relationship and applying semantics to determine a degree of relatedness between the first entity and a second entity. Further, the method may include applying the policy to a second relationship that defines an attribute related to the second entity if the degree of relatedness between the entity and the second entity is within a range of values.

Claims

1. A processor-based method of applying a policy, comprising:

identifying a first entity and a first relationship, the first relationship defining an attribute related to the first entity;

identifying a policy associated with the first entity and the first relationship;

applying semantics to determine a degree of relatedness between the first entity and a second entity; and

applying the policy to a second relationship that defines an attribute related to the second entity if the degree of relatedness between the entity and the second entity is within a range of values.

2. The method of claim 1, comprising defining the policy as a security policy for a server on a network.

3. The method of claim 1, comprising associating a plurality of policies with a plurality of entities and a plurality of relationships.

4. The method of claim 1, comprising returning a final result set.

5. The method of claim 1, comprising defining the policy as a quality of service policy.

6. The method of claim 1, comprising defining the first entity and the second entity as computers.

7. The method of claim 1, comprising defining the first entity and the second entity as components of a network.

8. A processor-based method of applying policies, comprising:

determining whether an entity is subject to a policy, the policy being associated with the entity and at least one relationship;

identifying the policy associated with the at least one relationship;

identifying a set of entities associated with the policy;

adding the identified set of entities to a result set;

determining whether the relationship has semantics;

if semantics are present, adding to the result set a different entity that is caused by the relationship to be in indirect association with the set of entities; and

if no semantics are present, returning a final result set.

9. The method of claim 8, comprising defining the set of entities as a single entity.

10. The method of claim 8, comprising defining the set of entities as a plurality of entities.

11. The method of claim 8, comprising returning a final result set.

12. The method of claim 8, comprising defining the policy as a security policy for a server on a network.

13. The method of claim 8, comprising associating a plurality of policies with a plurality of entities and relationships.

14. The method of claim 8, comprising defining the policy as a quality of service policy.

15. The method of claim 8, comprising defining the entity and the different entity as computers.

16. The method of claim 8, comprising defining the entity and the different entity as components of a network.

17. A processor-based method of identifying policies, comprising:

identifying a policy that applies to a given entity, the policy being associated with at least one entity and at least one relationship;

identifying a source entity object and a policy object that is directly associated with the source entity object;

adding the identified policy object to a result set;

identifying at least one relationship of the source entity having semantics and at least one associated policy;

determining whether more than one relationship is present;

where more than one relationship is present, determining whether a policy source is associated with the source entity object and adding the policy source to a result set where the policy source is associated with the source entity object; and

returning a result set.

18. The method of claim 17, comprising defining the policy as a security policy for a server on a network.

19. The method of claim 17, comprising defining the policy as a quality of service policy.

20. A computer system for applying policies, comprising:

a determination module for determining whether an entity is subject to a policy, the policy being associated with at least one entity and at least one relationship;

a policy identification module for identifying the policy of a given relationship;

an entity identification module for identifying a set of entities associated with the policy;

a first addition module for adding the identified set of entities to a result set;

a semantics determining module for determining whether the relationship has semantics;

a calculation module for calculating other entities in indirect association with the set of entities via the relationship for each entity in the set of entities where semantics are present; and

a second addition module for adding the calculated other entities to the result set.

21. The computer system of claim 20, comprising a return module for returning a final result set.

22. A computer program for applying policies, comprising:

a tangible medium;

a determination module stored on the tangible medium, the determination module adapted to determine whether an entity is subject to a policy, the policy being associated with at least one entity and at least one relationship;

a policy identification module stored on the tangible medium, the policy identification module adapted to identify the policy of a given relationship;

an entity identification module stored on the tangible medium, the entity identification module adapted to identify a set of entities associated with the policy;

a first addition module stored on the tangible medium, the first addition module adapted to add the identified set of entities to a result set;

a semantics determining module stored on the tangible medium, the semantics determining module adapted to determine whether the relationship has semantics;

a calculation module stored on the tangible medium, the calculation module adapted to calculate other entities in indirect association with the set of entities via the relationship for each entity in the set of entities where semantics are present; and

a second addition module stored on the tangible medium, the second addition module adapted to add the calculated other entities to the result set.

23. The computer program of claim 22, comprising a return module stored on the tangible medium, the return module adapted to return a final result set.