Policy Enforcement

• US 20110078107A1
• Filed: 11/28/2009
• Published: 03/31/2011
• Est. Priority Date: 09/29/2009
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Bhandolkar, Birur Keshavarao Sudhanva, Almeida, Kiran Joseph, Ravindran, Viji Kakkattu
• Granted Patent: US 8,498,959 B2
• Time in Patent Office: Days
• US Class Current: 706/61
• CPC Class Codes: G06Q 99/00 Subject matter not provided for in other groups of this subclass

Abstract

An enforcement system may include a policy decision point and an adaptive grid. Requests for service from users are passed to the policy decision point which uses enforcer agents in the adaptive grid to enforce policies by selecting from available policy enforcement points. The adaptive grid may also include explorer agents for evaluating enforcement capabilities available to the enforcement system.

Claims

1. An enforcement system for enforcing policies with regard to service requests comprising:

a plurality of enforcer agents adapted to enforce policies;

at least one explorer agent adapted to evaluate policy enforcement capabilities available to the enforcement system; and

a policy decision point adapted to identify the policies that need to be enforced for a service request and to pass this information to at least one enforcer agent (32) to enforce the identified policies.

2. An enforcement system according to claim 1, further comprising an enforcement knowledge base,

wherein each explorer agent is adapted to store in the knowledge base information about the policy enforcement capabilities available to the enforcement system.

3. An enforcement system according to claim 2, wherein each enforcer agent is adapted to use the information in the enforcement knowledge base to enforce policies.

4. An enforcement system according to claim 3, wherein the enforcer agents are adapted, after using a policy enforcement capability, to update the enforcement knowledge base with information about the policy enforcement capability.

5. An enforcement system according claim 1, wherein the policy enforcement capabilities include a plurality of non-identical policy enforcement points.

6. An enforcement system according to claim 1, comprising a policy grid which comprises:

a policy enforcement layer including a plurality of policy enforcement points;

a semantic web services layer including a plurality of semantic web services corresponding to the policy enforcement points; and

an agent layer including the enforcer agents and the at least one explorer agent, wherein the enforcer agents and the explorer agents interact with the semantic web services in the semantic web services layer.

7. An enforcement system according to claim 1, further comprising:

a virtual service interface for accepting service requests and passing them to a policy decision point; and

a service interface connected to the policy grid to allow the enforcement system to access at least one service.

8. A method of enforcing policies, comprising:

accepting a service request;

analysing the request by a policy decision point to shortlist a set of policies that need to be enforced for the request;

selecting at least one enforcer agent from a plurality of enforcer agents to enforce policies with respect to the service request and passing information from the service request to the or each selected enforcer agent;

selecting in the or each selected enforcer agent at least one policy enforcement capability to enforce policies with respect to the service request.

9. A method according to claim 8, further comprising:

identifying using at least one explorer agent information about a policy enforcement capability and updating a knowledge base with this information.

10. A method according to claim 9 wherein the step of selecting at least one policy enforcer agent uses the information in the knowledge base.

11. A method according to claim 8 wherein the policy enforcement capabilities include a plurality of non-identical policy enforcement points.

12. A method according to claim 8;

wherein the selected enforcer agent or agents calculate the runtime information including the performance metrics about the or each selected enforcement capability;

and stores information about the performance of the or each selected enforcement capability generated from the runtime information in the knowledge base.

13. A method of operating a policy enforcement system, comprising:

introducing a new policy enforcement point and corresponding semantic web service into the policy enforcement system;

identifying the capabilities of the new policy enforcement point with an explorer agent by querying the corresponding semantic web service; and

updating an enforcement database with the identified capabilities, the enforcement database including information about the policy enforcement points available in the policy enforcement system.

14. A method of operating a policy enforcement system according to claim 13, further comprising:

accepting a service request in a enforcer agent;

querying the enforcement database for capabilities of policy enforcement points;

selecting one or more policy enforcement points; and

enforcing policies with respect to the service request using the selected policy enforcement point or points.

15. A method according to claim 14, further comprising;

calculating performance metrics about the or each selected enforcement capability to evaluate the performance of the selected policy enforcement point or points and updating the enforcement database with an evaluation of the performance of the selected policy enforcement point or points in enforcing the policies.