Runtime usage analysis for a distributed policy enforcement system

• US 8,650,288 B2
• Filed: 05/31/2011
• Issued: 02/11/2014
• Est. Priority Date: 11/24/2010
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Yamuna, Prakash, Kavantzas, Nickolas
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): PATEL, HITESHKUMAR R
• Application Number:
  US13/118,944
• Publication Number:
  US 20120131469A1
• Time in Patent Office: 987 Days
• Field of Search: 709/206, 709/220, 709/223, 709/224, 726/1, 715/736
• US Class Current: 709/224
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

In one set of embodiments, methods, systems, and apparatus are provided for determining, by a server, a policy association between a web service policy and a policy subject associated with an application hosted by the server, the policy association being made while the server is offline, generating a runtime usage association based on the policy association, wherein the runtime usage association is between the web service policy and the policy subject; and generating a user interface based upon the runtime usage association, the user interface displaying one or more web service policies associated with one or more policy subjects of the application. The runtime usage association may be updated in response to a change to the policy association made by an administrative tool, where the change and the updating occur in real time while the server is online.

Claims

1. A method comprising:

determining, by a server in a computer system, a policy association between a web service policy and a policy subject associated with an application hosted by the server, the policy association being made while the server is offline;

generating, by the computer system, a runtime usage association based on the policy association, wherein the runtime usage association is between the web service policy and the policy subject;

generating, by the computer system, one or more counts of a number of policy subjects with which the web service policy is associated, wherein generating the count comprises determining how many policy subjects are associated with the web services policy by one or more runtime usage associations; and

generating, by the computer system, a user interface based upon the runtime usage association, the user interface configured to display one or more web service policies associated with one or more policy subjects of the application.

2. The method of claim 1, further comprising:

updating the runtime usage association in response to a change to the policy association made by an administrative tool,

wherein the change and the updating occur in real time while the server is online.

3. The method of claim 2, wherein determining the policy association comprises loading the policy association from a database, wherein the web service policy is associated in the database with the policy subject.

4. The method of claim 1, wherein determining the policy association comprises loading the policy association from policy attachment metadata associated with the policy subject.

5. The method of claim 4, wherein determining the policy association further comprises identifying at least one policy attachment association that is included in the policy attachment metadata and not included in the runtime usage association.

6. The method of claim 1, wherein generating the runtime usage association comprises storing the runtime usage association in a database at a location determined based upon the web service policy.

7. The method of claim 1, further comprising:

generating, by the computer system, a usage analysis of the web service policy, wherein the usage analysis lists at least one policy subject associated with the web service policy by at least one runtime usage association; and

displaying the usage analysis in the user interface.

8. The method of claim 1, further comprising:

generating information configured to display the one or more counts in the user interface.

9. The method of claim 1, further comprising:

determining, by the server being executed by the computer system and in response to a request in the user interface to modify the web service policy, whether the web service policy is associated with one or more policy subjects by one or more runtime usage associations;

prompting a user to confirm modification of the web service policy if the web service policy is associated with one or more policy subjects; and

modifying the web service policy if the user confirms the modification.

10. The method of claim 1, wherein the policy subject comprises a service, a reference, a domain identifier, an application server identifier, an application identifier, or a combination thereof.

11. A system comprising:

a processor configured to;

determine a policy association between a web service policy and a policy subject associated with an application hosted by a server, the policy association being made while the server is offline;

generate a runtime usage association based on the policy association, wherein the runtime usage association is between the web service policy and the policy subject;

generate one or more counts of a number of policy subjects with which the web service policy is associated, wherein to generate the count the processor is configured to determine how many policy subjects are associated with the web services policy by one or more runtime usage associations; and

generate a user interface based upon the runtime usage association, the user interface configured to display one or more web service policies associated with one or more policy subjects of the application.

12. The system of claim 11, wherein the processor is further configured to:

update the runtime usage association in response to a change to the policy association made by an administrative tool,

wherein the change and the update occur in real time while the server is online.

13. The system of claim 12, wherein the processor is further configured to load the policy association from a database, and the web service policy is associated in the database with the policy subject.

14. The system of claim 11, wherein the processor is further configured to load the policy association from policy attachment metadata associated with the policy subject.

15. The system of claim 14, wherein the processor is further configured to identify at least one policy attachment association that is included in the policy attachment metadata and not included in the runtime usage association.

16. The system of claim 11, wherein the processor is further configured to store the runtime usage association in a database at a location determined based upon the web service policy.

17. The system of claim 11, wherein the processor is further configured to:

generate a usage analysis of the web service policy, wherein the usage analysis lists at least one policy subject associated with the web service policy by at least one runtime usage association; and

display the usage analysis in the user interface.

18. A non-transitory machine-readable medium for a computer system, the non-transitory machine-readable medium having stored thereon a series of instructions executable by a processor, the series of instructions comprising:

instructions that cause the processor to determine a policy association between a web service policy and a policy subject associated with an application hosted by a server, the policy association being made while the server is offline;

instructions that cause the processor to generate a runtime usage association based on the policy association, wherein the runtime usage association is between the web service policy and the policy subject;

instructions that cause the processor to generate one or more counts of a number of policy subjects with which the web service policy is associated, wherein to generate the count the processor is configured to determine how many policy subjects are associated with the web services policy by one or more runtime usage associations; and

instructions that cause the processor to generate a user interface based upon the runtime usage association, the user interface configured to display one or more web service policies associated with one or more policy subjects of the application.

19. The non-transitory machine-readable medium of claim 18, the series of instructions executable by the processor further comprising:

instructions that cause the processor to update the runtime usage association in response to a change to the policy association made by an administrative tool,

wherein the change and the update occur in real time while the server is online.

20. The non-transitory machine-readable medium of claim 19, the series of instructions executable by the processor further comprising instructions that cause the processor to load the policy association from a database,

wherein the web service policy is associated in the database with the policy subject.

21. The non-transitory machine-readable medium of claim 18, the series of instructions executable by the processor further comprising instructions that cause the processor to load the policy association from policy attachment metadata associated with the policy subject.

22. The non-transitory machine-readable medium of claim 21, the instructions that cause the processor to determine the policy association further comprising:

instructions that cause the processor to identify at least one policy attachment association that is included in the policy attachment metadata and not included in the runtime usage association.

23. The non-transitory machine-readable medium of claim 18, the instructions that cause the processor to generate the runtime usage association further comprising instructions that cause the processor to store the runtime usage association in a database at a location determined based upon the web service policy.

24. The non-transitory machine-readable medium of claim 18, the series of instructions executable by the processor further comprising:

instructions that cause the processor to generate a usage analysis of the web service policy, wherein the usage analysis lists at least one policy subject associated with the web service policy by at least one runtime usage association; and

instructions that cause the processor to display the usage analysis in the user interface.

25. The non-transitory machine-readable medium of claim 18, the series of instructions executable by the processor further comprising:

instructions that cause the processor to display the one or more counts in the user interface.