EFFICIENT POLICY CONFLICT DETECTION

• US 20080271111A1
• Filed: 04/27/2007
• Published: 10/30/2008
• Est. Priority Date: 04/27/2007
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Strassner, John C., Cox, Gregory W., Raymer, David L.
• Granted Patent: US 8,484,693 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A method and computer program product for detecting a policy conflict in a managed system includes examining a plurality of policy rules for overlapping policy targets, in response to finding no overlapping policy targets, reporting that the policy rules do not conflict, and in response to finding overlapping policy targets, examining the plurality of policy rules for at least two rules having a same condition and a same event, and, in response to not finding at least two rules having a same condition and a same event, reporting that the policy rules do not conflict.

Claims

1. A method for detecting a policy conflict in a managed system, the method comprising:

examining a plurality of policy rules for overlapping policy targets; and

in response to no policy target overlaps being determined, reporting that the plurality of policy rules do not conflict.

2. The method according to claim 1, further comprising:

determining that if a set of conditions and a set of events for the policy rules are not simultaneously satisfied, then there is definitively no conflict in the plurality of policies.

3. The method according to claim 2, further comprising:

in response to the conditions and events for the policy rules being simultaneously satisfied, performing additional tests to determine if a conflict does exist.

4. The method according to claim 3, further comprising:

applying the plurality of policy rules to at least one of a model and an actual instance of a real system;

comparing one or more macro states that result from the applying of the plurality of policy rules; and

in response to determining a difference between the at least two macro states, reporting that the plurality of policy rules conflict.

5. The method according to claim 4, further comprising:

in response to determining that there is no difference between the at least two resulting macro states;

applying the plurality of policy rules to a system model;

comparing the micro states that result from the applying of the policy rules; and

in response to determining a difference between the at least two micro states, reporting that the plurality of policy rules conflict.

6. The method according to claim 5, further comprising:

in response to determining that there is no difference between the at least two micro states, reporting that plurality of policy rules do not conflict.

7. A method for detecting a policy conflict in a managed system, the method comprising:

creating a model of policy targets, the model capable of simulating the effects of applying policy rules to the policy targets;

applying the action of the rules to the model;

comparing at least two resulting macro states of the model with each other; and

in response to the at least two macro states differing, reporting a conflict.

8. The method according to claim 7, further comprising:

in response to the at least two macro states not differing;

comparing at least two resulting micro states of the model with each other; and

in response to the at least two micro states differing, reporting a conflict.

9. The method according to claim 8, further comprising:

in response to the at least two micro states not differing, reporting that the policy rules do not conflict.

10. A computer program product for detecting a policy conflict in a managed system, the computer program product comprising:

a storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

examining a plurality of policy rules for overlapping policy targets;

in response to finding no overlapping policy targets, reporting that the policy rules do not conflict; and

in response to finding overlapping policy targets;

examining the plurality of policy rules for at least two rules having a same condition and a same event; and

in response to not finding at least two rules having a same condition and a same event, reporting that the policy rules do not conflict.

11. The computer program product according to claim 10, further comprising:

in response to finding at least two rules having a same condition and a same event;

creating a model of policy targets, the model capable of simulating the effects of applying the policy rules to the policy targets;

applying the action of the rules to the model;

comparing at least two resulting macro states of the model with each other; and

in response to the at least two macro states differing, reporting a conflict.

12. The computer program product according to claim 11, further comprising:

in response to the at least two macro states not differing;

comparing at least two resulting micro states of the model with each other; and

in response to the at least two micro states differing, reporting a conflict.

13. The computer program product according to claim 12, further comprising:

in response to the at least two micro states not differing, reporting that the policy rules do not conflict.