System and method for ratification of policies

• US 20070162966A1
• Filed: 01/12/2006
• Published: 07/12/2007
• Est. Priority Date: 01/12/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Verma, Dinesh, Lee, Kang-Won, Agrawal, Dakshi, Lobo, Jorge, Calo, Seraphin, Giles, James, Mohania, Mukesh
• Granted Patent: US 8,006,290 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system and method for ratifying policies are provided. A method for ratifying a policy in a policy-based decision system comprises: determining if a new policy interacts with an existing policy in the policy-based decision system; and ratifying the new policy to exist in the policy-based decision system.

Claims

1. A method for ratifying a policy in a policy-based decision system, comprising:

determining if a new policy interacts with an existing policy in the policy-based decision system; and

ratifying the new policy to exist in the policy-based decision system.

2. The method of claim 1, wherein determining if a new policy interacts with an existing policy, comprises:

determining if the new policy and the existing policy are active during the same time;

determining if the new policy and the existing policy influence the same device or component of a managed system coupled to the policy-based decision system; and

reviewing metapolicies associated with the new policy and the existing policy to determine if they interact with each other.

3. The method of claim 1, further comprising:

determining if the new policy conflicts with the existing policy; and

resolving a conflict between the new policy and the existing policy.

4. The method of claim 3, wherein determining if the new policy conflicts with the existing policy, comprises:

determining if a conjunction of a Boolean expression associated with the new policy and a Boolean expression associated with the existing policy can be satisfied by a set of values assigned to variables in the Boolean expressions.

5. The method of claim 3, wherein determining if the new policy conflicts with the existing policy, comprises:

reviewing metapolicies associated with the new policy and the existing policy to determine if they are in conflict with each other.

6. The method of claim 3, wherein resolving a conflict between the new policy and the existing policy, comprises:

determining a priority of the new policy with respect to the existing policy;

assigning a priority value to the new policy; and

reassigning a priority value to the existing policy if the priority value of the new policy is higher than the priority value of the existing policy.

7. The method of claim 3, wherein resolving a conflict between the new policy and the existing policy, comprises:

marking the new policy inactive so that it does not conflict with the existing policy or marking the existing policy inactive so that it does not interact with the new policy.

8. The method of claim 3, wherein resolving a conflict between the new policy and the existing policy, comprises:

modifying the new policy or the existing policy so that they do not conflict with each other.

9. The method of claim 3, wherein resolving a conflict between the new policy and the existing policy, comprises:

reviewing metapolicies associated with the new policy and the existing policy to resolve a conflict therebetween.

10. The method of claim 1, further comprising:

receiving the new policy; and

determining if the new policy is applicable to the policy-based decision system.

11. A system for ratifying policies, comprising:

a memory device for storing a program;

a processor in communication with the memory device, the processor operative with the program to;

determine if a new policy interacts with an existing policy in a policy-based decision system; and

ratify the new policy to exist in the policy-based decision system.

12. The system of claim 11, wherein the processor is operative with the program code when determining if a new policy interacts with an existing policy to:

determine if the new policy and the existing policy are active during the same time;

determine if the new policy and the existing policy influence the same device or component of a managed system coupled to the policy-based decision system; and

review metapolicies associated with the new policy and the existing policy to determine if they interact with each other.

13. The system of claim 11, wherein the processor is further operative with the program code to:

determine if the new policy conflicts with the existing policy; and

resolve a conflict between the new policy and the existing policy.

14. The system of claim 13, wherein the processor is further operative with the program code when determining if the new policy conflicts with the existing policy to:

determine if a conjunction of a Boolean expression associated with the new policy and a Boolean expression associated with the existing policy can be satisfied by a set of values assigned to variables in the Boolean expressions.

15. The system of claim 13, wherein the processor is further operative with the program code when determining if the new policy conflicts with the existing policy to:

review metapolicies associated with the new policy and the existing policy to determine if they are in conflict with each other.

16. The system of claim 13, wherein the processor is further operative with the program code when resolving a conflict between the new policy and the existing policy to:

determine a priority of the new policy with respect to the existing policy;

assign a priority value to the new policy; and

reassign a priority value to the existing policy if the priority value of the new policy is higher than the priority value of the existing policy.

17. The system of claim 13, wherein the processor is further operative with the program code when resolving a conflict between the new policy and the existing policy to:

mark the new policy inactive so that it does not conflict with the existing policy or mark the existing policy inactive so that it does not interact with the new policy.

18. The system of claim 13, wherein the processor is further operative with the program code when resolving a conflict between the new policy and the existing policy to:

modify the new policy or the existing policy so that they do not conflict with each other.

19. The system of claim 13, wherein the processor is further operative with the program code when resolving a conflict between the new policy and the existing policy to:

review metapolicies associated with the new policy and the existing policy to resolve a conflict therebetween.

20. The system of claim 11, wherein the processor is further operative with the program code to:

receive the new policy; and

determine if the new policy is applicable to the policy-based decision system.

21. The system of claim 11, wherein the processor is included in a policy-editing tool or a policy-based decision maker of the policy-based decision system.

22. A method for ratifying a new policy in a local environment, comprising:

determining if the new policy is relevant to the local environment;

determining if the new policy interacts with an existing policy in the local environment by;

determining if the new policy and the existing policy are simultaneously active;

determining if the new policy and the existing policy affect the same device or component of the local environment;

or

determining if metapolicies associated with the new policy and the existing policy indicate interoperability; and

ratifying the new policy for deployment in the local environment.