CREATING POLICY RULES AND ASSOCIATED POLICY RULE COMPONENTS

• US 20090164499A1
• Filed: 12/20/2007
• Published: 06/25/2009
• Est. Priority Date: 12/20/2007
• Status: Abandoned Application

• Current Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Cox, Gregory W., Samudrala, Srinivasa C., Strassner, John C.
• Application Number:
  US11/961,306
• Publication Number:
  US 20090164499A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A method and information processing system manage policy elements in an information processing system. At least one policy element (110) from a plurality of policy elements stored in at least one policy repository (108) is retrieved. The plurality of policy elements includes at least one of a plurality of reusable policy rules (110), a plurality of reusable policy rule components (118, 120, 122), a plurality of reusable policy rule templates, and a plurality of and policy rule component templates. A new reusable policy element is created from at least one of the policy element (110) that has been retrieved and a default policy element. The new reusable policy element is stored in the at least one policy repository (108). A reusable policy element is queried using metadata (224) associated with the reusable policy element.

Claims

1. A method for managing policy elements in an information processing system, the method comprising:

retrieving at least one policy element from a plurality of policy elements stored in at least one policy repository, wherein the plurality of policy elements include at least one of

a plurality of reusable policy rules,

a plurality of reusable policy rule components,

a plurality of reusable policy rule templates, and

a plurality of and policy rule component templates;

creating a new reusable policy element from at least one of

the policy element that has been retrieved, and

a default policy element;

storing the new reusable policy element in the at least one policy repository; and

querying a reusable policy element using metadata associated with the reusable policy element.

2. The method of claim 1, wherein the storing further comprises at least one of:

determining a repository in the plurality of repositories comprising storage space for storing the new reusable policy element based on the metadata associated with the new reusable policy element.

3. The method of claim 1, wherein the plurality of reusable policy rule components include at least:

Metadata;

Events;

Conditions; and

Actions.

4. The method of claim 1, wherein each policy rule in the plurality of policy rules and each policy rule template in the plurality of policy rule templates includes at least one pointer to a policy rule component and a policy rule component template it contains, wherein the pointer is used by at least one of a human user and a machine user to identify one of the policy rule components and policy rule component templates used in one of the policy rule and policy rule template, respectively, and wherein

each policy rule component in the plurality of policy rule components and each policy rule component template in the plurality of policy rule component templates includes at least one pointer to a policy rule and policy rule template containing the policy rule component and the policy rule component template, respectively, wherein the pointer is used by at least one of a human user and a machine user to identify one of the policy rule and policy rule template that use the policy rule component and the policy rule component template, respectively.

5. The method of claim 1, wherein the at least one repository is one of a physical storage entity and a logical partition of a physical storage entity.

6. The method of claim 1, wherein at least one policy element in the plurality of policy elements are stored in a different repository than the other policy elements.

7. The method of claim 6, wherein the different repository is at least one of a different physical entity and a different logical partition of an original physical entity for enabling both physical.

8. The method of claim 1, wherein each of the policy elements in the plurality of policy elements support management operations, where the management operations include at least one of:

changing a name of an existing policy element, thereby causing the existing policy element to be known by a new name;

creating a copy of a policy element;

creating at least one different version of a policy element, wherein the creating different version at least includes creating different named policy elements that are uniquely identifiable for supporting different functionality;

changing a storage location of a policy element; and

updating a policy element to identify a location of a reusable policy rule component whose location has been changed.

9. The method of claim 8, wherein the copy of the policy element includes at least one of:

a shallow copy of the policy element, wherein a shallow copy includes a copy of the policy element without a copy of policy element contained within the policy element; and

a deep copy of the policy element, wherein a deep copy includes a copy of the policy element and all other policy element contained within the policy element.

10. The method of claim 8, wherein creating at least one different version of a policy element further comprises:

determining a set of permissions associated with the policy element; and

associating the set of permissions determined to be associated with the policy element to the at least one different version that has been created.

11. The method of claim 1, wherein the creating at least one new reusable policy element, further comprises:

determining a set of permissions associated with at least one of a human user and a machine user; and

authorizing one of the human user and the machine user to perform a set of management operations on the new reusable policy element based on the set of permissions determined to be associated with the at least one human user and the machine user.

12. The method of claim 11, wherein set of management operations include at least one of:

creating;

modifying;

deleting;

copying;

moving; and

renaming at least one of policy elements.

13. The method of claim 11, wherein the creating the new reusable policy element, further comprises:

determining a set of permissions associated with the new reusable policy element that has been created;

identifying a set of policy rule components that reference the new reusable policy element and a set of policy rule components referenced by the new reusable policy element, wherein a policy rule component includes at least one of Events, Conditions, Actions, and Metadata, and wherein the set of permissions also impact the set of policy rule components that reference the new reusable policy element and a set of policy rule components referenced by the new reusable policy element.

authorizing one of the human user and the machine user to perform a set management operations on the new reusable policy element based on both the set of permissions determined to be associated at least one of the human user and the machine user and the set of permissions determined to be associated with new reusable policy element.

14. The method of claim 13, further comprising:

copying the new reusable policy element, wherein the copying creates one of a shallow copy of the new reusable policy element and a deep copy of the new reusable policy element; and

associating the set of permissions determined to be associated with the new reusable policy element with the one of a shallow copy the new reusable policy element and a deep copy of the new reusable policy element.

15. The method of claim 1, wherein the at least one repository further comprises an organizational structure that enforces at least one role-based access control on each entry in the repository as well as the repository itself.

16. The method of claim 15, wherein the role-based access control includes:

ensuring that a user has appropriate permissions to operate on the policy element as well as contents of the policy element; and

ensuring that the policy element has appropriate permissions to allow operations requested by the user to be performed on the policy element.

17. A method for managing policy elements in an information processing system, the method comprising:

retrieving at least one policy element from a plurality of policy elements stored in at least one policy repository, wherein the plurality of policy elements include at least one of

a plurality of reusable policy rules,

a plurality of reusable policy rule components,

a plurality of reusable policy rule templates, and

a plurality of and policy rule component templates;

creating a new reusable policy element from at least one of

the policy element that has been retrieved, and

a default policy element;

storing the new reusable policy element in the at least one policy repository;

querying a reusable policy element using metadata associated with the reusable policy element;

determining a set of permissions associated with at least one of a human user and a machine user; and

authorizing one of the human user and the machine user to perform a set of management operations on the new reusable policy element based on the set of permissions determined to be associated with the at least one human user and the machine user.

18. The method of claim 17, wherein each of the policy elements in the plurality of policy elements support management operations, where the management operations include at least one of:

changing a name of an existing policy element, thereby causing the existing policy element to be known by a new name;

creating a copy of a policy element;

creating at least one different version of a policy element, wherein the creating different version at least includes creating different named policy elements that are uniquely identifiable for supporting different functionality;

changing a storage location of a policy element; and

updating a policy element to identify a location of a reusable policy rule component whose location has been changed.

19. An information processing system for managing policy elements in an information processing system, the information processing system comprising:

a memory;

a processor communicatively coupled to the memory; and

a policy manager communicatively coupled to the memory and the processor, wherein the policy manager is adapted to;

retrieve at least one policy element from a plurality of policy elements stored in at least one policy repository, wherein the plurality of policy elements include at least one of

a plurality of reusable policy rules,

a plurality of reusable policy rule components,

a plurality of reusable policy rule templates, and

a plurality of and policy rule component templates;

creating a new reusable policy element from at least one of the policy element that has been retrieved;

a default policy element;

store the new reusable policy element in the at least one policy repository; and

query a reusable policy element using metadata associated with the reusable policy element.

20. The information processing system of claim 19, wherein each of the policy elements in the plurality of policy elements support management operations, where the management operations include at least one of:

changing a name of an existing policy element, thereby causing the existing policy element to be known by a new name;

creating a copy of a policy element;

creating at least one different version of a policy element, wherein the creating different version at least includes creating different named policy elements that are uniquely identifiable for supporting different functionality;

changing a storage location of a policy element; and

updating a policy element to identify a location of a reusable policy rule component whose location has been changed.