Method and system for managing security policies

• US 9,043,861 B2
• Filed: 05/23/2008
• Issued: 05/26/2015
• Est. Priority Date: 09/17/2007
• Status: Active Grant

• Current Assignee: Rudolf Schreiner, Ulrich Lang
• Original Assignee: Rudolf Schreiner
• Inventors: Lang, Ulrich, Schreiner, Rudolf
• Primary Examiner(s): Rahman, Mohammad L
• Application Number:
  US12/126,711
• Publication Number:
  US 20090077621A1
• Time in Patent Office: 2,559 Days
• Field of Search: 726/1, 726/2
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A system and method of managing security policies in an information technologies (IT) system are provided. In an example, the method includes receiving an input indicating a high-level security policy for the IT system, the received high-level security policy relating to non-functional system attributes for the IT system and received in a format that is not machine-enforceable at an enforcement entity of the IT system. A functional model for the IT system is determined, where the functional model indicates functional system attributes of the IT system. At least one pre-configured rule template is loaded, and at least one machine-enforceable rule is generated in a manner compliant with the received high-level security policy by iteratively filling the at least one pre-configured rule template with functional system attributes indicated by the functional model. After the generating step, the at least one machine-enforceable rule can be distributed (e.g., to an enforcement entity, an Intrusion Detection System (IDS), etc.). In another example, the receiving, determining, loading, generating and distributing steps can be performed at a policy node within an IT system.

Claims

1. A method of managing security policies in an information technologies (IT) system, comprising:

receiving an input indicating a high-level security policy for the IT system, the received high-level security policy relating to non-functional system attributes for the IT system and received in a format that is not machine-enforceable at an enforcement entity of the IT system;

determining a functional model for the IT system, the functional model indicating functional system attributes of the IT system;

loading at least one pre-configured rule template;

automatically or semi-automatically generating, by a processor, at least one machine-enforceable rule that is in a ready to execute format in a manner compliant with the received high-level security policy by iteratively filling the at least one pre-configured rule template with functional system attributes indicated by the functional model, wherein the at least one machine-enforceable rule is an output of a model-driven process and are produced from high-level models; and

distributing the at least one machine-enforceable rule.

2. The method of claim 1, wherein the high-level security policy indicates, to the generating step, to generate the at least one machine-enforceable rule to conform with one or more of a compliance policy and a security model.

3. The method of claim 2, wherein the compliance policy includes compliance with one or more government regulations.

4. The method of claim 3, wherein the government regulations include at least one of Sarbanes Oxley (SOX) compliance, Health Insurance Portability and Accountability Act (HIPAA), HL7, COBIT, privacy legislation, TOGAF/DoDAF and MODAF.

5. The method of claim 2, wherein the security model is based on one of discretionary access control (DAC) and mandatory access control (MAC), Role Based Access Control (RBAC), Chinese Wall, Biba and Clark Wilson.

6. The method of claim 1, wherein the determining step determines the functional model by loading a pre-configured functional model defined for the IT system.

7. The method of claim 1, wherein the determining step determines the functional model by receiving a manual entry of the functional system attributes from a user.

8. The method of claim 1, wherein the loading step selectively loads the at least one pre-configured template based on the received high-level security policy.

9. The method of claim 8, wherein the loading step loads templates that are required to comply with the high-level security policy and does not load templates that are not required to comply with the high-level security policy.

10. The method of claim 1, wherein the generating step includes:

assigning model elements to the high-level security policy based on a pre-defined meta-modeling layer, the pre-defined meta-modeling layer defining constructs used in the high-level security policy;

interpreting the high-level security policy based on the assigned model elements; and

determining a set of components defined by the functional model that are relevant to the high-level security policy based on the interpreting step.

11. The method of claim 10, wherein the meta-modeling layer is based on one of Unified Modeling Language (UML), BPMN, a Domain Specific Language and the OpenPMF policy model.

12. The method of claim 10, wherein the determined set of components includes at least one of a subject, an object and an operation.

13. The method of claim 12, wherein the subject is a sender and the object is a receiver.

14. The method of claim 12, wherein the subject is a client and the object is a server.

15. The method of claim 10, further comprising:

for each component within the set,

filling the at least one pre-defined rule template with functional system attributes from the functional model, the at least one pre-defined rule template filled to conform with the high-level security policy as interpreted by the interpreting step,

repeating the filling step, for each component, until all rules for a current component to comply with the high-level security policy have been generated.

16. The method of claim 10, wherein the pre-defined meta-modeling layer includes constructs that are defined by a meta-meta modeling layer.

17. The method of claim 16, wherein the meta-meta modeling layer is one of ECore and Meta-Object Facility (MOF).

18. The method of claim 1, wherein the IT system is one of a service oriented architecture (SOA) system, a data-centric system, an object-oriented system, a component-based system, a publish-subscribe oriented system, a transaction system, a database system, an information flow system, a workflow based system and a message oriented system.

19. The method of claim 1, wherein the at least one machine-enforceable rule includes reference to context information, the context information being information that cannot be evaluated until the at least one rule is enforced at the enforcement entity.

20. The method of claim 19, wherein the context information includes at least one of (i) calendar information, (ii) usage history information, (iii) geographical information, (iv) network related information, (v) organizational information, (vi) security technology related information, (vii) context in a work flow, (viii) situational information like threat level, (ix) environmental information, (x) information about arguments of an invocation and/or (xi) information exchanged.

21. The method of claim 1, wherein the non-functional system attributes affected by the high-level security policy includes security considerations.

22. The method of claim 21, wherein the security considerations affected by the high-level security policy include access permissions within the IT system.

23. The method of claim 1, further comprising:

generating at least one supplemental machine-enforceable rule based on the generated at least one machine-enforceable rule, the at least one supplemental machine-enforceable rule being an infrastructure-specific rule that facilitates the execution of the at least one machine-enforceable rule at run-time.

24. The method of claim 23, wherein the generated at least one machine-enforceable rule includes a rule permitting a first network component to send to a second network component, and

wherein the at least one supplemental machine-enforceable rule is generated to include a supplemental rule permitting the first network component access to one or more of a components server, firewalls, naming services, trading services and a discovery server to query a location of the second network component.

25. The method of claim 1, wherein the generating step transforms the high-level security policy (P3) directly into the at least one machine-enforceable rule (P1).

26. The method of claim 1, wherein the generating step first transforms the high-level security policy (P3) into at least one technology-neutral rule (P2), the technology-neutral rule not being machine-enforceable at the enforcement entity, and second transforms the technology-neutral rule to the at least one machine-enforceable rule (P1).

27. The method of claim 1, wherein the functional system attributes includes identities of components within the IT system.

28. The method of claim 1, wherein the distributing step distributes the at least one machine-enforceable rule to at least one of the enforcement entity and an Intrusion Detection System (IDS).

29. The method of claim 1, wherein the enforcement entity which is one of (i) one or more centralized policy decision points which are queried by enforcement points, and (ii) one or many decentralized combined policy decision/enforcement points.

30. The method of claim 1, wherein the at least one machine-enforceable rule is configured in accordance with at least one of OpenPMF Policy Definition Language (PDL) and eXtensible Markup Language (XML) Metadata Interchange (XMI).

63. The method of claim 1, wherein the distributing step distributes the at least one machine-enforceable rule to an entity configured to execute the at least one machine-enforceable rule so as to enforce the received high-level security policy.

64. The method of claim 1, wherein the at least one machine-enforceable rule is automatically generated from the received high-level security policy.

68. The method of claim 10, wherein at least one of assigning the model elements to the high-level security policy, interpreting the high-level security policy or determining the set of components is performed automatically.

31. An information technologies (IT) system, comprising:

a policy node configured to receive an input indicating a high-level security policy for the IT system, the received high-level security policy relating to non-functional system attributes for the IT system and received in a format that is not machine-enforceable at an enforcement entity of the IT system, the policy node further configured to determine a functional model for the IT system, the functional model indicating functional system attributes of the IT system, to load at least one pre-configured rule template, to automatically or semi-automatically generate at least one machine-enforceable rule that is in a ready to execute format in a manner compliant with the received high-level security policy by iteratively filling the at least one pre-configured rule template with functional system attributes indicated by the functional model and distributing the at least one machine-enforceable rule, wherein the at least one machine-enforceable rule is an output of a model-driven process and are produced from high-level models.

32. The system of claim 31, wherein the high-level security policy instructs the policy node to generate the at least one machine-enforceable rule to conform with one or more of a compliance policy and a security model.

33. The system of claim 32, wherein the compliance policy includes compliance with one or more government regulations.

34. The system of claim 33, wherein the government regulations include at least one of Sarbanes Oxley (SOX) compliance, Health Insurance Portability and Accountability Act (HIPAA), HL7, COBIT, privacy legislation, TOGAF/DoDAF and MODAF.

35. The system of claim 32, wherein the security model is based on one of discretionary access control (DAC) and mandatory access control (MAC), Role Based Access Control (RBAC), Chinese Wall, Biba and Clark Wilson.

36. The system of claim 31, wherein the policy node determines the functional model by loading a pre-configured functional model defined for the IT system.

37. The system of claim 31, wherein the policy node determines the functional model by receiving a manual entry of the functional system attributes from a user.

38. The system of claim 31, wherein the policy node selectively loads the at least one pre-configured template based on the received high-level security policy.

39. The system of claim 38, wherein the policy node loads templates that are required to comply with the high-level security policy and does not load templates that are not required to comply with the high-level security policy.

40. The system of claim 31, wherein the policy node is configured to generate the at least one machine-enforceable rule by assigning model elements to the high-level security policy based on a pre-defined meta-modeling layer, the pre-defined meta-modeling layer defining constructs used in the high-level security policy, interpreting the high-level security policy based on the assigned model elements and determining a set of components defined by the functional model that are relevant to the high-level security policy based on the interpreting step.

41. The system of claim 40, wherein the meta-modeling layer is based on one of Unified Modeling Language (UML), BPMN, a Domain Specific Language and the OpenPMF policy model.

42. The system of claim 40, wherein the determined set of components includes at least one of a subject, an object and an operation.

43. The system of claim 42, wherein the subject is a sender and the object is a receiver.

44. The system of claim 42, wherein the subject is a client and the object is a server.

45. The system of claim 40, wherein the policy node, for each component within the set, is configured to fill the at least one pre-defined rule template with functional system attributes from the functional model, the at least one pre-defined rule template filled to conform with the high-level security policy as interpreted by the policy node, and to repeat the filling of the at least one pre-defined rule template, for each component, until all rules for a current component to comply with the high-level security policy have been generated.

46. The system of claim 40, wherein the pre-defined meta-modeling layer includes constructs that are defined by a meta-meta modeling layer.

47. The system of claim 46, wherein the meta-meta modeling layer is one of ECore and Meta-Object Facility (MOF).

48. The system of claim 31, wherein the IT system is one of a service oriented architecture (SOA) system, a data-centric system, an object-oriented system, a component-based system, a publish-subscribe oriented system, a transaction system, a database system, an information flow system, a workflow based system and a message oriented system.

49. The system of claim 31, wherein the at least one machine-enforceable rule includes reference to context information, the context information being information that cannot be evaluated until the at least one rule is enforced.

50. The system of claim 49, wherein the context information includes at least one of (i) calendar information, (ii) usage history information, (iii) geographical information, (iv) network related information, (v) organizational information, (vi) security technology related information, (vii) context in a work flow, (viii) situational information like threat level, (ix) environmental information, (x) information about arguments of an invocation and/or (xi) information exchanged.

51. The system of claim 31, wherein the non-functional system attributes affected by the high-level security policy includes security considerations.

52. The system of claim 51, wherein the security considerations affected by the high-level security policy include access permissions within the IT system.

53. The system of claim 31, wherein the policy node is further configured to generate at least one supplemental machine-enforceable rule based on the generated at least one machine-enforceable rule, the at least one supplemental machine-enforceable rule including an infrastructure-specific rule that facilitates the execution of the generated at least one machine-enforceable rule at run-time.

54. The system of claim 53, wherein the generated at least one machine-enforceable rules includes a rule permitting a first network component to send to a second network component, and

wherein the policy node is configured to generate the at least one supplemental machine-enforceable rule to include a supplemental rule permitting the first network component access to one or more of a components server, firewalls, naming services, trading services and a discovery server to query a location of the second network component.

55. The system of claim 31, wherein the policy node transforms the high-level security policy (P3) directly into the at least one machine-enforceable rule (P1).

56. The system of claim 31, wherein the policy node first transforms the high-level security policy (P3) into at least one technology-neutral rule (P2), the technology-neutral rule not being machine-enforceable at the enforcement entity, and second transforms the technology-neutral rule to the at least one machine-enforceable rule (P1).

57. The system of claim 31, wherein the functional system attributes includes identities of components within the IT system.

58. The system of claim 31, wherein the policy node distributes the at least one machine-enforceable rule to at least one of an enforcement entity and an Intrusion Detection System (IDS).

59. The system of claim 58, wherein the enforcement entity which is one of (i) one or more centralized policy decision points which are queried by enforcement points, and (ii) one or many decentralized combined policy decision/enforcement points.

60. The system of claim 31, wherein the at least one machine-enforceable rule is configured in accordance with at least one of OpenPMF Policy Definition Language (PDL) and eXtensible Markup Language (XML) Metadata Interchange (XMI).

65. The information technologies (IT) system of claim 31, wherein the at least one machine-enforceable rule is automatically generated from the received high-level security policy.

69. The information technologies (IT) system of claim 40, wherein the policy node either automatically assigns the model elements to the high-level security policy based on a pre-defined meta-modeling layer, automatically interpreting the high-level security policy based on the assigned model elements, or automatically determines the set of components defined by the functional model.

61. A method of managing security policies in an information technologies (IT) system, comprising:

receiving an input indicating a high-level security policy for the IT system, the received high-level security policy relating to non-functional system attributes for the IT system and received in a format that is not machine-enforceable at an enforcement entity of the IT system and expressed in a high-level security policy meta model and separated from the functional model of the IT system;

determining a functional model for the IT system, the functional model indicating functional system attributes of the IT system;

loading at least one pre-configured rule template;

automatically or semi-automatically generating, by a processor, at least one machine-enforceable rule that is in a ready to execute format in a manner compliant with the received high-level security policy by iteratively filling the at least one pre-configured rule template with functional system attributes indicated by the functional model, wherein the at least one machine-enforceable rule is an output of a model-driven process and are produced from high-level models; and

distributing the at least one machine-enforceable rule.

66. The method of claim 61, wherein the at least one machine-enforceable rule is automatically generated from the received high-level security policy.

70. The method of claim 61,

wherein the generating step includes:

assigning model elements to the high-level security policy based on a pre-defined meta-modeling layer, the pre-defined meta-modeling layer defining constructs used in the high-level security policy;

interpreting the high-level security policy based on the assigned model elements; and

determining a set of components defined by the functional model that are relevant to the high-level security policy based on the interpreting step, and

wherein at least one of assigning the model elements to the high-level security policy, interpreting the high-level security policy or determining the set of components is performed automatically.

62. An information technologies (IT) system, comprising:

a policy node configured to receive an input indicating a high-level security policy for the IT system, the received high-level security policy relating to non-functional system attributes for the IT system and received in a format that is not machine-enforceable at an enforcement entity of the IT system and expressed in a high-level security policy meta model and separated from the functional model of the IT system, the policy node further configured to determine a functional model for the IT system, the functional model indicating functional system attributes of the IT system, to load at least one pre-configured rule template, to automatically or semi-automatically generate at least one machine-enforceable rule that is in a ready to execute format in a manner compliant with the received high-level security policy by iteratively filling the at least one pre-configured rule template with functional system attributes indicated by the functional model and distributing the at least one machine-enforceable rule, wherein the at least one machine-enforceable rule is an output of a model-driven process and are produced from hiqh-level models.

67. The information technologies (IT) system of claim 62, wherein the at least one machine-enforceable rule is automatically generated from the received high-level security policy.

71. The system of claim 62,

wherein the policy node is configured to generate the at least one machine-enforceable rule by assigning model elements to the high-level security policy based on a pre-defined meta-modeling layer, the pre-defined meta-modeling layer defining constructs used in the high-level security policy, interpreting the high-level security policy based on the assigned model elements and determining a set of components defined by the functional model that are relevant to the high-level security policy based on the interpreting step, and

wherein the policy node either automatically assigns the model elements to the high-level security policy based on a pre-defined meta-modeling layer, automatically interpreting the high-level security policy based on the assigned model elements, or automatically determines the set of components defined by the functional model.