Policy update apparatus, policy management system, policy update method, policy management method and recording medium

• US 9,183,009 B2
• Filed: 06/20/2012
• Issued: 11/10/2015
• Est. Priority Date: 06/20/2011
• Status: Active Grant

• Current Assignee: IP Wave Pte. Ltd.
• Original Assignee: NEC Corporation
• Inventors: Ogawa, Ryuichi
• Primary Examiner(s): Abbaszadeh, Jaweed A
• Assistant Examiner(s): Chen, Xuxing
• Application Number:
  US13/819,641
• Publication Number:
  US 20130290695A1
• Time in Patent Office: 1,238 Days
• Field of Search: 713/100
• US Class Current: 1/1
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

The present invention provides a policy update apparatus which can update a software policy appropriately corresponding to the configuration change in a resource. The policy update apparatus includes policy retrieving means which receives a resource identifier, reads out an install destination resource identifier corresponding to the resource identifier from resource management means which stores with providing a mapping between the resource identifier and the install destination resource identifier which indicates an install destination resource in which the resource identified by the resource identifier is installed, and reads out the software policy corresponding to the resource identifier and the install destination resource identifier, and policy update means which updates the software policy, correlates the updated software policy to the resource identifier and the install destination resource identifier, and stores to policy storage means.

Claims

1. A policy update apparatus comprising:

a policy storage unit configured to store a software policy, which is setting information on a resource, with a mapping to a resource identifier which indicates said resource and an install destination resource identifier which indicates an install destination resource in which said resource is installed;

a policy retrieving unit configured to receive the resource identifier, read out the install destination resource identifier which is correlated to said received resource identifier from a resource management unit which stores the resource identifier and the install destination resource identifier which indicates the install destination resource in which the resource identified by said resource identifier is installed with a mapping between them, and read out said software policy which is correlated to said received resource identifier and said read out install destination resource identifier from said policy storage unit; and

a policy update unit configured to update said read out software policy, correlate said updated software policy to said received resource identifier and said read out install destination resource identifier, and store said updated software policy to said policy storage unit.

2. The policy update apparatus according to claim 1,

wherein said policy storage unit is further configured to store the resource identifier, a software identifier which indicates software being applied to the resource identified by said resource identifier, the install destination resource identifier and the software policy with a mapping between them, and

wherein said policy retrieving unit is further configured to receive the resource identifier and the software identifier, read out the install destination resource identifier which is correlated to said resource identifier from said resource management unit, and read out said software policy which is correlated to said resource identifier, said install destination resource identifier and said software identifier from said policy storage unit.

3. The policy update apparatus according to claim 2,

wherein said policy storage unit a is further configured to store the software policy as a default policy with a mapping from the software policy to a software identifier, and

wherein said policy retrieving unit is further configured to read out said default policy when said software policy which is correlated to the resource identifier, said install destination resource identifier and said software identifier does not exist in said policy storage unit.

4. The policy update apparatus according to claim 1,

wherein said policy storage unit is further configured to store the resource identifier, the install destination resource identifier, the software policy, and an update history of said software policy with a mapping between them,

wherein said policy update apparatus further comprises a verification unit,

wherein said policy retrieving unit is further configured to pass the update history which is correlated to the read out software policy to said verification unit, and

wherein said verification unit is configured to verify whether or not said software policy is correct based on the coincidence of the software policy updated by said policy update unit and the update history received from said policy retrieving unit.

5. The policy update apparatus according to claim 1, further comprising a verification unit,

wherein said policy retrieving unit is further configured to pass a verification rule corresponding to the software policy read out from said policy storage unit to said verification unit, and

wherein said verification unit is configured to verify the software policy updated by said policy update unit based on the verification rule received from said policy retrieving unit.

6. A policy management system comprising:

a policy update apparatus and

a resource management unit,

wherein the policy update apparatus comprises;

a policy storage unit configured to store a software policy, which is setting information on a resource, with a mapping to a resource identifier which indicates said resource and an install destination resource identifier which indicates an install destination resource in which said resource is installed;

a policy retrieving unit configured to receive the resource identifier, read out the install destination resource identifier which is correlated to said received resource identifier from a resource management unit which stores the resource identifier and the install destination resource identifier which indicates the install destination resource in which the resource identified by said resource identifier is installed with a mapping between them, and read out said software policy which is correlated to said received resource identifier and said read out install destination resource identifier from said policy storage unit; and

a policy update unit configured to update said read out software policy, correlate said updated software policy to said received resource identifier and said read out install destination resource identifier, and store said updated software policy to said policy storage unit.

7. The policy management system according to claim 6, further comprising a policy distribution unit configured to deliver the software policy,

wherein said resource management unit is further configured to store from a plurality of resource identifiers to one resource group identifier with a mapping between them, and

wherein said policy distribution unit is further configured to read out the resource group identifier which is correlated to the resource identifier, which is correlated to said software policy and stored in said policy storage unit, from said resource management unit, and deliver the software policy which said policy update unit has updated to the resource indicated by a predetermined resource identifier which is correlated to said read out resource group identifier.

8. The policy management system according to claim 6,

wherein said policy storage unit is further configured to store a cluster group identifier which indicates a cluster, an in-cluster server identifier which indicates a computer belonging to said cluster, the resource identifier, the install destination resource identifier and a cluster policy which is setting information on said computer with a mapping between them,

wherein said policy management unit is further configured to store the resource identifier and the in-cluster server identifier which indicates the computer in which the resource indicated by said resource identifier is equipped with a mapping between them,

wherein said policy retrieving unit is further configured to read out the cluster policy, which is correlated to the install destination resource identifier read out from said resource management unit, the resource identifier which said policy retrieving unit has received and the in-cluster server identifier which is correlated to said resource identifier and stored in said policy storage unit, from said policy storage unit, and

wherein said policy update unit is further configured to update the cluster policy which said policy retrieving unit has read out, make a correlation among the updated cluster policy, said resource identifier and said install destination resource identifier, and store the updated cluster policy to said policy storage unit.

9. A policy update method comprising:

storing a software policy, which is setting information on a resource, to policy storage means with a mapping to a resource identifier which indicates said resource and an install destination resource identifier which indicates an install destination resource in which said resource is installed;

receiving the resource identifier, reading out the install destination resource identifier which is correlated to said received resource identifier from resource management means which stores the resource identifier and the install destination resource identifier which indicates the install destination resource in which the resource identified by said resource identifier is installed with a mapping between them, and reading out said software policy which is correlated to said received resource identifier and said read out install destination resource identifier from said policy storage means;

updating said read out software policy;

correlating said updated software policy to said received resource identifier and said read out install destination resource identifier; and

storing said updated software policy to said policy storage means.

10. A policy management method comprising:

storing a software policy, which is setting information on a resource, to policy storage means with a mapping to a resource identifier which indicates said resource and an install destination resource identifier which indicates an install destination resource in which said resource is installed;

storing the resource identifier and the install destination resource identifier which indicates the install destination resource in which the resource identified by said resource identifier is installed with a mapping between them to resource management means;

receiving the resource identifier;

reading out the install destination resource identifier which is correlated to said received resource identifier from said resource management means;

reading out said software policy which is correlated to said received resource identifier and said read out install destination resource identifier from said policy storage means;

updating said read out software policy;

correlating said updated software policy to said received resource identifier and said read out install destination resource identifier; and

storing said updated software policy to said policy storage means.

11. A non-transitory computer-readable recording medium including a policy update program which causes a computer to execute the processing which comprising:

a processing which stores a software policy, which is setting information on a resource, to policy storage means with a mapping to a resource identifier which indicates said resource and an install destination resource identifier which indicates an install destination resource in which said resource is installed;

a processing which receives the resource identifier, reads out the install destination resource identifier which is correlated to said received resource identifier from resource management means which stores the resource identifier and the install destination resource identifier which indicates the install destination resource in which the resource identified by said resource identifier is installed with a mapping between them, and reads out said software policy which is correlated to said received resource identifier and said read out install destination resource identifier from said policy storage means; and

a processing which updates said read out software policy, correlates said updated software policy to said received resource identifier and said read out install destination resource identifier, and stores said updated software policy to said policy storage means.

12. A policy update apparatus comprising:

policy storage means for storing a software policy, which is setting information on a resource, with a mapping to a resource identifier which indicates said resource and an install destination resource identifier which indicates an install destination resource in which said resource is installed;

policy retrieving means for receiving the resource identifier, reading out the install destination resource identifier which is correlated to said received resource identifier from resource management means which stores the resource identifier and the install destination resource identifier which indicates the install destination resource in which the resource identified by said resource identifier is installed with a mapping between them, and reading out said software policy which is correlated to said received resource identifier and said read out install destination resource identifier from said policy storage means; and

policy update means for updating said read out software policy, correlating said updated software policy to said received resource identifier and said read out install destination resource identifier, and storing said updated software policy to said policy storage means.