Policy based service management

• US 20070124797A1
• Filed: 06/12/2004
• Published: 05/31/2007
• Est. Priority Date: 07/25/2003
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Gupta, Rajiv, Sarukkai, Sekhar
• Granted Patent: US 7,757,268 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561

Abstract

A system and a method for policy management in a web services environment includes a policy design tool, a policy storage and a policy manager controller. The policy design tool creates (or updates) a policy for association with a web service. The policy storage stores the policy. The policy manager controller provides an interface for transmission of the policy to a policy enforcement tool and also receives messages relating to the policy from the policy enforcement tool. In addition, a system and method for policy enforcement in a web services environment includes a policy enforcement controller, a policy enforcement repository, an enforcer, a policy enforcement framework, and a policy container. The policy enforcement controller receives and commits a policy and the policy enforcement repository stores the committed policy. The enforcer module receives a request to invoke the policy and the policy enforcement framework determines whether the requested policy is committed in the policy enforcement repository and whether the policy is instantiated. The policy container determines whether the policy is enforceable.

Claims

1. In a web services environment, a method for managing application policies, comprising:

designing a policy for use with a web service;

associating the policy with the web service;

committing the policy; and

communicating the policy to an enforcement process for use with the web service.

2. The method of claim 1, further comprising receiving a confirmation of a status of the policy from the enforcement process.

3. The method of claim 2, wherein the confirmation comprises one from a group consisting of a policy implementation and a policy update.

4. The method of claim 1, further comprising receiving feedback data from a monitor, the feedback data for use in automatically changing the policy.

5. The method of claim 1, further comprising associating the policy with a second web service, an association of with the web service having a different objective than an association of the second web service.

6. The method of claim 5, wherein the web service comprises one from a group consisting of an application, a system operation, and a system function.

7. The method of claim 5, wherein the web service comprises message encryption and the second web service comprises a user login application.

8. A system for policy management in a web services environment, the system comprising:

a policy design tool configured to create a policy for association with a web service;

a policy storage coupled with the policy design tool and configured to store the policy; and

a policy manager controller coupled with the policy design tool and configured to provide an interface for transmission of the policy to a policy enforcement mechanism and configured to receive messages relating to the policy from the policy enforcement mechanism.

9. The system of claim 8, wherein the policy manager controller further couples with the policy storage.

10. The system of claim 8, further comprising a delegation tool for associating the policy with the web service.

11. The system of claim 8, further comprising a monitor interface configured to receive feedback information relating to a policy, the monitor interface coupled with the policy design tool.

12. The system of claim 11, wherein the policy design tool is further configured to update the policy in response to receiving the feedback information from the monitor interface.

13. The system of claim 12, wherein the policy manager controller transmits a revocation signal to the policy enforcement mechanism to revote the policy in response to the policy design tool updating the policy.

14. The system of claim 12, wherein the policy design tool pushes the new policy to the policy manager controller for transmission to the policy enforcement mechanism.

15. In a web services environment, a process for enforcing policies created from a policy management tool, the process comprising:

receiving a policy associated with a web service;

locking the policy;

committing locally the policy in response the policy being a new version and in response to locking the policy;

de-committing locally the policy in response to an update of the policy; and

transmitting a confirmation of receipt of the policy to the policy management tool.

16. The process of claim 15, further comprising rolling back the policy committed in response to reverting to a prior version of a policy.

17. The process of claim 15, further comprising generating an error in response to one from a group consisting of:

improperly attempting to lock the policy without receiving the policy;

improperly invoking a policy having an update not yet committed; and

improperly accessing an application without compliance to the policy.

18. The process of claim 15, wherein in response to a client invoking a web service, the process further comprises:

determining whether the policy is committed;

determining whether the policy is instantiated;

s determining whether the policy is enforced; and

in response to the policy being committed, instantiated and enforce, invoking the web service.

19. The process of claim 18, wherein the step of determining whether a policy is enforced further comprises manipulating a Simple Object Access Protocol header in a context of a message sent to a messenger.

20. The process of claim 18, further comprising transferring control to a messenger for invoking the web service.

21. The process of claim 17, further comprising monitoring the policy and transmitting feedback information to the policy management tool.

22. A system for policy enforcement in a web services environment, the system comprising:

a policy enforcement controller configured to receive a policy;

a policy enforcement repository communicatively coupled with the policy enforcer and configured to store a policy committed by the policy enforcer controller;

an enforcer module configured to receive a request to invoke the policy;

a policy enforcement framework communicatively coupled with the policy enforcer and configured to determine whether the policy requested is committed in the policy enforcement repository and whether the policy is instantiated; and

a policy container communicatively coupled with the policy enforcement framework and configured to determine whether the policy is enforced.

23. The system of claim 22, wherein the policy enforcement mechanism is further configured to transmit a control signal to a messenger to invoke the policy in response to the policy being committed, instantiated, and enforced.

24. The system of claim 22, wherein the enforcer module is coupled with a listener to receive the request to invoke the policy.

25. The system of claim 22, further comprising at least one policy step.

26. The system of claim 25, wherein a policy step comprises a monitor to determine what happens between a client and a service associated the policy.