SECURITY POLICY VERIFICATION SYSTEM

• US 20100325569A1
• Filed: 06/18/2009
• Published: 12/23/2010
• Est. Priority Date: 06/18/2009
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: SINGH, Rajesh Chandra, SMITH, Nigel David, KING, Nigel
• Granted Patent: US 8,495,703 B2
• Time in Patent Office: Days
• US Class Current: 715/771
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 8/75 Structural analysis for program understanding

Abstract

Systems and methods are provided that comprise a security policy verification system for verifying security policies. The system parses programming language code that implements security policies, and identifies annotations in the programming language code. The system then matches the annotations to the security policies to which the annotations correspond. The system then displays a natural language description of the security policy in a user interface.

Claims

1. A computer-readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide a security policy verification system by:

parsing programming language code that implements one of a plurality of security policies;

identifying a first annotation in the programming language code;

matching the first annotation to a first security policy to which the first annotation corresponds; and

displaying a natural language description of the first security policy in a user interface.

2. The computer-readable medium of claim 1, wherein the first security policy has a plurality of implementations.

3. The computer-readable medium of claim 1, wherein the first security policy is associated with one or more roles.

4. The computer-readable medium of claim 1, wherein the first annotation is defined by a security policy reference implementation.

5. The computer-readable medium of claim 1, further comprising:

displaying the programming language code at a request of a user.

6. The computer-readable medium of claim 1, further comprising:

determining that a second security policy is not implemented; and

displaying an indication in the user interface that the second security policy is not implemented for a first technology.

7. The computer-readable medium of claim 6, wherein determining that the second security policy is not implemented comprises:

parsing a plurality of existing security policy implementations; and

failing to identify a second annotation corresponding to the second security policy.

8. The computer-readable medium of claim 1, further comprising displaying in the user interface all implemented security policies for a role.

9. A computer-implemented method for providing a security policy verification system, comprising:

parsing programming language code that implements one of a plurality of security policies;

identifying a first annotation in the programming language code;

matching the first annotation to a first security policy to which the first annotation corresponds; and

displaying a natural language description of the first security policy in a user interface.

10. The method of claim 9, further comprising:

determining that a second security policy is not implemented; and

displaying an indication in the user interface that the second security policy is not implemented.

11. The method of claim 9, wherein determining that the second security policy is not implemented comprises:

parsing a plurality of existing security policy implementations; and

failing to identify a second annotation corresponding to the second security policy.

12. The method of claim 9, further comprising displaying in the user interface all implemented security policies for a role.

13. The method of claim 9, wherein the first security policy has a plurality of implementations.

14. A security policy verification system, comprising:

a repository storing a plurality of security policy implementations;

a reference implementation including a plurality of annotation codes corresponding to a plurality of security policies;

a parser for parsing the plurality of security policy implementations and identifying one of the plurality of annotation codes in one of the plurality of security policy implementations;

a security policy module that matches the one annotation to the one security policy; and

a user interface that displays a natural language description of the one security policy.