Instrumentation and monitoring of service level agreement (SLA) and service policy enforcement

• US 9,363,289 B2
• Filed: 02/12/2013
• Issued: 06/07/2016
• Est. Priority Date: 02/12/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Burke, Thomas C., De Armas, Mario E., Gago, Oswaldo, Muralidharan, Srinivasan, Shah, Gaurang, Smith, Maria E.
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): Bukhari, Sibte
• Application Number:
  US13/764,895
• Publication Number:
  US 20140230006A1
• Time in Patent Office: 1,211 Days
• Field of Search: 709/203, 726/1
• US Class Current: 1/1
• CPC Class Codes: H04L 41/5019 Ensuring fulfilment of SLA
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Source policy identification information of a registry service policy is captured. The source policy identification information includes a source policy identifier (ID), a source policy name, and a source policy uniform resource locator (URL). The captured source policy identification information is correlated with configured policy enforcement processing rules and processing actions using a source policy reference key. Per-transaction service policy enforcement information that documents policy enforcement activities performed by a policy enforcement point (PEP) is captured. The captured per-transaction service policy enforcement information is correlated with the captured source policy identification information using the source policy reference key.

Claims

1. A method, comprising:

capturing, via a processor, source policy identification information of a registry service policy that comprises a source policy identifier (ID), a source policy name, and a source policy uniform resource locator (URL);

correlating the captured source policy identification information with configured policy enforcement processing rules and processing actions using a source policy reference key;

capturing per-transaction service policy enforcement information that documents policy enforcement activities performed by a policy enforcement point (PEP), comprising on a per-transaction basis;

capturing performed policy enforcement processing rules and processing actions;

extracting a source policy reference key associated with the performed policy enforcement processing rules and processing actions used for policy enforcement; and

storing the extracted source policy reference key and mediation enforcement metrics, where the mediation enforcement metrics comprise the performed policy enforcement processing rules and processing actions used for the policy enforcement of the transaction; and

the method further comprising;

correlating the captured per-transaction service policy enforcement information with the captured source policy identification information using the extracted source policy reference key;

receiving a query from a policy monitoring point (PMP) for the correlated per-transaction service policy enforcement information of at least one transaction; and

providing the correlated per-transaction service policy enforcement information of the at least one transaction in response to the query from the PMP.

2. The method of claim 1, where correlating the captured source policy identification information with the configured policy enforcement processing rules and processing actions using the source policy reference key comprises:

compiling an abstract syntax tree (AST) representation of the registry service policy by recursively traversing the AST representation to identify policy assertions within the AST representation of the registry service policy; and

mapping the identified policy assertions within the AST representation of the registry service policy to the captured source policy identification information within a shared policy table.

3. The method of claim 2, where mapping the identified policy assertions within the AST representation of the registry service policy to the captured source policy identification information within the shared policy table comprises:

creating the configured policy enforcement processing rules and processing actions from the AST representation of the registry service policy; and

storing, during policy normalization to correlate the configured policy enforcement processing rules and processing actions with the registry service policy, identifiers of the configured policy enforcement processing rules and processing actions with the source policy identification information as an entry within the shared policy table, where the entry is indexed using the source policy reference key.

4. The method of claim 1, where storing the extracted source policy reference key and the mediation enforcement metrics comprises storing the extracted source policy reference key and mediation enforcement metrics within a per-transaction service data table.

5. The method of claim 1, where correlating the captured per-transaction service policy enforcement information with the captured source policy identification information using the extracted source policy reference key comprises adding an entry for each transaction within a policy enforcement data model.

6. A system, comprising:

a memory; and

a processor programmed to;

capture source policy identification information of a registry service policy that comprises a source policy identifier (ID), a source policy name, and a source policy uniform resource locator (URL);

correlate the captured source policy identification information with configured policy enforcement processing rules and processing actions within the memory using a source policy reference key;

capture per-transaction service policy enforcement information that documents policy enforcement activities performed by a policy enforcement point (PEP), comprising the processor being programmed to, on a per-transaction basis;

capture performed policy enforcement processing rules and processing actions;

extract a source policy reference key associated with the performed policy enforcement processing rules and processing actions used for policy enforcement; and

store the extracted source policy reference key and mediation enforcement metrics within a per-transaction service data table within the memory, where the mediation enforcement metrics comprise the performed policy enforcement processing rules and processing actions used for the policy enforcement of the transaction; and

where the processor is further programmed to;

correlate the captured per-transaction service policy enforcement information with the captured source policy identification information within the memory using the extracted source policy reference key;

receive a query from a policy monitoring point (PMP) for the correlated per-transaction service policy enforcement information of at least one transaction; and

provide the correlated per-transaction service policy enforcement information of the at least one transaction in response to the query from the PMP.

7. The system of claim 6, where in being programmed to correlate the captured source policy identification information with the configured policy enforcement processing rules and processing actions within the memory using the source policy reference key, the processor is programmed to:

compile an abstract syntax tree (AST) representation of the registry service policy by recursively traversing the AST representation to identify policy assertions within the AST representation of the registry service policy; and

map the identified policy assertions within the AST representation of the registry service policy to the captured source policy identification information within a shared policy table within the memory.

8. The system of claim 7, where in being programmed to map the identified policy assertions within the AST representation of the registry service policy to the captured source policy identification information within the shared policy table within the memory, the processor is programmed to:

create the configured policy enforcement processing rules and processing actions from the AST representation of the registry service policy; and

store, during policy normalization to correlate the configured policy enforcement processing rules and processing actions with the registry service policy, identifiers of the configured policy enforcement processing rules and processing actions with the source policy identification information as an entry within the shared policy table within the memory, where the entry is indexed using the source policy reference key.

9. The system of claim 6, where in being programmed to correlate the captured per-transaction service policy enforcement information with the captured source policy identification information within the memory using the extracted source policy reference key, the processor is programmed to add an entry for each transaction within a policy enforcement data model.

10. A computer program product, comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, where the computer readable program code when executed on a computer causes the computer to;

capture source policy identification information of a registry service policy that comprises a source policy identifier (ID), a source policy name, and a source policy uniform resource locator (URL);

correlate the captured source policy identification information with configured policy enforcement processing rules and processing actions using a source policy reference key;

capture per-transaction service policy enforcement information that documents policy enforcement activities performed by a policy enforcement point (PEP), comprising the computer readable program code when executed on the computer causing the computer to, on a per-transaction basis;

capture performed policy enforcement processing rules and processing actions;

extract a source policy reference key associated with the performed policy enforcement processing rules and processing actions used for policy enforcement; and

store the extracted source policy reference key and mediation enforcement metrics, where the mediation enforcement metrics comprise the performed policy enforcement processing rules and processing actions used for the policy enforcement of the transaction; and

where the computer readable program code when executed on the computer further causes the computer to;

correlate the captured per-transaction service policy enforcement information with the captured source policy identification information using the extracted source policy reference key;

receive a query from a policy monitoring point (PMP) for the correlated per-transaction service policy enforcement information of at least one transaction; and

provide the correlated per-transaction service policy enforcement information of the at least one transaction in response to the query from the PMP.

11. The computer program product of claim 10, where in causing the computer to correlate the captured source policy identification information with the configured policy enforcement processing rules and processing actions using the source policy reference key, the computer readable program code when executed on the computer causes the computer to:

compile an abstract syntax tree (AST) representation of the registry service policy by recursively traversing the AST representation to identify policy assertions within the AST representation of the registry service policy; and

map the identified policy assertions within the AST representation of the registry service policy to the captured source policy identification information within a shared policy table.

12. The computer program product of claim 11, where in causing the computer to map the identified policy assertions within the AST representation of the registry service policy to the captured source policy identification information within the shared policy table, the computer readable program code when executed on the computer causes the computer to:

create the configured policy enforcement processing rules and processing actions from the AST representation of the registry service policy; and

store, during policy normalization to correlate the configured policy enforcement processing rules and processing actions with the registry service policy, identifiers of the configured policy enforcement processing rules and processing actions with the source policy identification information as an entry within the shared policy table, where the entry is indexed using the source policy reference key.

13. The computer program product of claim 10, where in causing the computer to store the extracted source policy reference key and the mediation enforcement metrics, the computer readable program code when executed on the computer causes the computer to store the extracted source policy reference key and mediation enforcement metrics within a per-transaction service data table.

14. The computer program product of claim 10, where in causing the computer to correlate the captured per-transaction service policy enforcement information with the captured source policy identification information using the extracted source policy reference key, the computer readable program code when executed on the computer causes the computer to add an entry for each transaction within a policy enforcement data model.