Policy analysis tool

• US 20050097353A1
• Filed: 10/08/2004
• Published: 05/05/2005
• Est. Priority Date: 10/10/2003
• Status: Abandoned Application

• Current Assignee: BEA Systems Incorporated (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Xu, Mingde, Byrne, David, Howes, Jason, Patrick, Paul, Riendeau, Richard J., Yagen, Kenneth D., Falco, Mark A.
• Application Number:
  US10/961,808
• Publication Number:
  US 20050097353A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for searching a first set of policies, comprising, accessing the first set of policies wherein each policy in the first set of policies includes the following policy components, a resource, a subject, and one of an action and a role name, and wherein the subject includes at least one of, a user and a group, specifying one or more search criteria wherein the one or more search criteria includes one or more values for policy components and wherein the one or more values can include one or more wild cards, finding in the first set of policies a second set of policies that satisfy the one or more search criteria, and wherein a policy can be used to control access to a resource.

Claims

1. A method for searching a first set of policies, comprising:

accessing the first set of policies wherein each policy in the first set of policies includes the following policy components;

a resource, a subject, and one of an action and a role name, and wherein the subject includes at least one of;

a user and a group;

specifying one or more search criteria wherein the one or more search criteria includes one or more values for policy components and wherein the one or more values can include one or more wild cards;

finding in the first set of policies a second set of policies that satisfy the one or more search criteria; and

wherein a policy can be used to control access to a resource.

2. The method of claim 1, further comprising:

determining a set of roles corresponding to the subject component of the one or more search criteria.

3. The method of claim 1 wherein:

the resource is part of a resource hierarchy.

4. The method of claim 1 wherein:

the resource is part of a resource hierarchy; and

the resource hierarchy represents an application.

5. The method of claim 1, wherein:

the second set of policies include all policies delegated to one of;

a user, a group and a role.

6. The method of claim 1 wherein:

the policy components can include a delegator.

7. The method of claim 6 wherein:

the second set of policies include all policies delegated by a specific user, group or role.

8. The method of claim 1 wherein:

a constraint is included in one or more of;

the policy components and the at least one search criteria.

9. The method of claim 1, further comprising:

dynamically updating the second set of policies as the search criteria are modified.

10. The method of claim 1, wherein:

a wild card matches any value.

11. A user interface capable of performing the method of claim 1.

12. A method for searching a first set of policies, comprising:

accessing the first set of policies wherein each policy in the first set of policies includes the following policy components;

a resource, a subject, and one of an action and a role name, and wherein the subject includes at least one of;

a user and a group;

specifying one or more search criteria wherein the one or more search criteria includes one or more values for policy components and wherein the one or more values can include one or more wild cards;

finding in the first set of policies a second set of policies that satisfy the one or more search criteria;

wherein a policy can be used to control access to a resource; and

wherein the resource is part of a resource hierarchy.

13. The method of claim 12, further comprising:

determining an set of roles corresponding to the subject component of the one or more search criteria.

14. The method of claim 12 wherein:

the resource hierarchy represents an application.

15. A user interface capable of performing the method of claim 12.

16. A machine readable medium having instructions stored thereon to cause a system to:

access the first set of policies wherein each policy in the first set of policies includes the following policy components;

a resource, a subject, and one of an action and a role name, and wherein the subject includes at least one of;

a user and a group;

specify one or more search criteria wherein the one or more search criteria includes one or more values for policy components and wherein the one or more values can include one or more wild cards;

find in the first set of policies a second set of policies that satisfy the one or more search criteria; and

wherein a policy can be used to control access to a resource.

17. The machine readable medium of claim 16 wherein:

the resource is part of a resource hierarchy.

18. The machine readable medium of claim 16 wherein:

the resource is part of a resource hierarchy; and

the resource hierarchy represents an application.

19. The machine readable medium of claim 16, wherein:

the second set of policies include all policies delegated to specific user, group or role.

20. The machine readable medium of claim 16 wherein:

the policy components can include a delegator.

21. The machine readable medium of claim 20 wherein:

the second set of policies include all policies delegated by a specific user, group or role.

22. The machine readable medium of claim 16 wherein:

the policy components and the at least one search criteria include a constraint.

23. The machine readable medium of claim 16, further comprising instructions stored thereon to cause the system to:

dynamically update the second set of policies as the search criteria are modified.

24. The machine readable medium of claim 16,;

wherein;

a wild card matches any value.

25. A computer signal embodied in a transmission medium, comprising:

a code segment including instructions for accessing the first set of policies wherein each policy in the first set of policies includes the following policy components;

a resource, a subject, and one of an action and a role name, and wherein the subject includes at least one of;

a user, a group and a role;

a code segment including instructions for specifying one or more search criteria wherein the one or more search criteria includes one or more values for policy components and wherein the one or more values can include one or more wild cards;

a code segment including instructions for finding in the first set of policies a second set of policies that satisfy the one or more search criteria and the set of roles; and

wherein a policy can be used to control access to a resource.