System and method for ratification of policies

• US 8,006,290 B2
• Filed: 01/12/2006
• Issued: 08/23/2011
• Est. Priority Date: 01/12/2006
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Verma, Dinesh, Giles, James R., Calo, Seraphin B., Mohania, Mukesh K., Lee, Kang-Won, Agrawal, Dakshi, Lobo, Jorge
• Primary Examiner(s): Pyzocha; Michael
• Assistant Examiner(s): VU, PHY ANH TRAN
• Application Number:
  US11/330,932
• Publication Number:
  US 20070162966A1
• Time in Patent Office: 2,049 Days
• Field of Search: 707/200, 707/694, 709/223, 709227-237, 726 1- 6, 726 27- 30
• US Class Current: 726/6
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system and method for ratifying policies are provided. A method for ratifying a policy in a policy-based decision system comprises: determining if a new policy interacts with an existing policy in the policy-based decision system; and ratifying the new policy to exist in the policy-based decision system.

Claims

1. A method for ratifying a policy in a policy-based decision system, comprising:

determining that a new policy interacts with an existing policy in the policy-based decision system;

determining that the new policy conflicts with the existing policy by using a domain elimination algorithm;

resolving the conflict between the new policy and the existing policy, wherein resolving the conflict between the new policy and the existing policy comprises displaying to a policy author information indicative of how to modify the new policy so that the conflict between the new policy and the existing policy can be resolved; and

ratifying the new policy to exist in the policy-based decision system in response to the conflict between the new policy and the existing policy being resolved, determining a priority of the new policy with respect to the existing policy;

assigning a priority value to the new policy, and

reassigning a priority value to the existing policy if the priority value of the new policy is higher than the priority value of the existing policy

wherein the method is performed using a microprocessor,

wherein the domain elimination algorithm uses the following conjunctive Boolean expression _i=1ⁿ B_i, B_i=xc_i, where c_i, xε

D and ε

{=, <

, ≦

, >

, ≧

}, and each atomic Boolean expression B_i restricts the domain of x to D_i⊂

D,

wherein the algorithm works by examining the Boolean expressions B_i one by one, and computing R_l=∩

_i=1^l B_i at each step, where x is the new policy, D is a domain of existing policies, c_i is a constant and R_n is the solution of the algorithm indicating the result of the conflict determination.

2. The method of claim 1, wherein determining if a new policy interacts with an existing policy, comprises:

determining if the new policy and the existing policy are active during the same time;

determining if the new policy and the existing policy influence the same device or component of a managed system coupled to the policy-based decision system; and

reviewing metapolicies associated with the new policy and the existing policy to determine if they interact with each other.

3. The method of claim 1, wherein determining if the new policy conflicts with the existing policy, comprises:

reviewing metapolicies associated with the new policy and the existing policy to determine if they are in conflict with each other.

4. The method of claim 1, wherein resolving a conflict between the new policy and the existing policy, comprises:

marking the new policy inactive so that it does not conflict with the existing policy or marking the existing policy inactive so that it does not interact with the new policy.

5. The method of claim 1, wherein resolving a conflict between the new policy and the existing policy, comprises:

modifying the new policy or the existing policy so that they do not conflict with each other.

6. The method of claim 1, wherein resolving a conflict between the new policy and the existing policy, comprises:

reviewing metapolicies associated with the new policy and the existing policy to resolve a conflict therebetween.

7. The method of claim 1, further comprising:

receiving the new policy; and

determining if the new policy is applicable to the policy-based decision system.

8. A system for ratifying policies, comprising:

a memory device for storing a program;

a processor in communication with the memory device, the processor operative with the program to;

determine if a new policy interacts with an existing policy in a policy-based decision system;

if the new policy interacts with the existing policy;

determine if the new policy conflicts with the existing policy by using a domain elimination algorithm;

if the new policy conflicts with the existing policy;

resolve the conflict between the new policy and the existing policy, wherein the processor is operative with the program when resolving the conflict between the new policy and the existing policy to display to a policy author information which indicates how to modify the new policy so that the conflict between the new policy and the existing policy can be resolved; and

ratify the new policy to exist in the policy-based decision system in response to the conflict between the new policy and the existing policy being resolved, determine a priority of the new policy with respect to the existing policy;

assigning a priority value to the new policy; and

reassign a priority value to the existing policy if the priority value of the new policy is higher than the priority value of the existing policy,

wherein the domain elimination algorithm uses the following conjunctive Boolean expression _i=1ⁿ B_i, B_i=xc_i, where c_i, xε

D and ε

{=, <

, ≦

, >

, ≧

}, and each atomic Boolean expression B_i restricts the domain of x to D_i⊂

D,

wherein the algorithm works by examining the Boolean expressions B_i one by one, and computing R_l=∩

_i=1^lB_i at each step, where x is the new policy, D is a domain of existing policies, c_i is a constant and R_n is the solution of the algorithm indicating the result of the conflict determination.

9. The system of claim 8, wherein the processor is operative with the program when determining if a new policy interacts with an existing policy to:

determine if the new policy and the existing policy are active during the same time;

determine if the new policy and the existing policy influence the same device or component of a managed system coupled to the policy-based decision system; and

review metapolicies associated with the new policy and the existing policy to determine if they interact with each other.

10. The system of claim 8, wherein the processor is operative with the program when determining if the new policy conflicts with the existing policy to:

review metapolicies associated with the new policy and the existing policy to determine if they are in conflict with each other.

11. The system of claim 8, wherein the processor is operative with the program when resolving a conflict between the new policy and the existing policy to:

mark the new policy inactive so that it does not conflict with the existing policy or mark the existing policy inactive so that it does not interact with the new policy.

12. The system of claim 8, wherein the processor is operative with the program when resolving a conflict between the new policy and the existing policy to:

modify the new policy or the existing policy so that they do not conflict with each other.

13. The system of claim 8, wherein the processor is operative with the program when resolving a conflict between the new policy and the existing policy to:

review metapolicies associated with the new policy and the existing policy to resolve a conflict therebetween.

14. The system of claim 8, wherein the processor is operative with the program to:

receive the new policy; and

determine if the new policy is applicable to the policy-based decision system.

15. The system of claim 8, wherein the processor is included in a policy-editing tool or a policy-based decision maker of the policy-based decision system.

16. A computer program product for ratifying a new policy in a local environment, the computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to determine if the new policy interacts with an existing policy in the local environment;

computer readable program code configured to determine if the new policy conflicts with the existing policy by using a domain elimination algorithm, wherein the conflict determination is made if the new policy interacts with the existing policy;

computer readable program code configured to resolve the conflict between the new policy and the existing policy, wherein the conflict is resolved if the new policy conflicts with the existing policy, and wherein resolving the conflict between the new policy and the existing policy comprises displaying to a policy author information which indicates how to modify the new policy so that the conflict between the new policy and the existing policy can be resolved; and

computer readable program code configured to ratify the new policy for deployment in the local environment in response to the conflict between the new policy and the existing policy being resolved, determine a priority of the new policy with respect to the existing policy;

assign a priority value to the new policy; and

reassign a priority value to the existing policy if the priority value of the new policy is higher than the priority value of the existing policy

wherein the domain elimination algorithm uses the following conjunctive Boolean expression _i=1ⁿ B_i, B_i=xc_i, where c_i, xε

D and ε

{=, <

, ≦

, >

, ≧

}, and each atomic Boolean expression B_i restricts the domain of x to D_i⊂

D,

wherein the algorithm works by examining the Boolean expressions B_i one by one, and computing R_l=∩

_i=1^lB_i at each step, where x is the new policy, D is a domain of existing policies, c_i is a constant and R_n is the solution of the algorithm indicating the result of the conflict determination.