JP2000235497A - Policy macro method and storage medium stored with policy macro program is stored - Google Patents

Abstract

PROBLEM TO BE SOLVED: To decrease the description quantity of a policy description which is described by using a policy macro description including name information, tag information, mapping destination information, substitution information, substitution object tag information, script information, and script object tag information of a new policy. description. SOLUTION: A policy macro system comprises a policy management part 101, a macro registration part 102, a policy registration part 103, cybercommunity environment 104, and an administrator 100. The new policy description used to manage the cybercommunity environment 104 is changed into an equivalent existent policy description, which is applied to the cybercommunity environment. In this case, the policy macro description including the name information of the new policy description, the tag information that the new policy description has, mapping destination information, script object tag information, script information, and script object tag information is used. Therefore, when the new policy description is introduced, the policy description can individtrally be handled and the description quantity of the policy description which is described is reduced.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a policy macro method and a storage medium storing a policy macro program, and more particularly to a policy management method for a cyber communication environment administrator who uses a policy description to newly introduce the policy description. By automatically generating an existing policy description using the conversion rules given by the policy macro description, it is possible to individually handle newly introduced policy descriptions and reduce the amount of policy descriptions to be described. The present invention relates to a storage method for storing a macro method and a policy macro program.

[0002]

2. Description of the Related Art First, a cyber community environment will be described. The cyber community environment is an environment in which agents acting on behalf of users are distributed and arranged on computers connected by a network to execute specific processing. In this environment, the agents and the elements that make up the cyber community environment can be generalized as objects in object-oriented technology. Here, it is assumed that the object holds a state internally and discloses a method, and when the method is activated, a side effect and a result are returned.

Conventionally, in order to manage the cyber community environment, SecPol: Specifica at Imperial College, UK
tion and Analysis of Security Policy for distribut
As represented by the ed System, policy descriptions are used. The policy description includes a permission policy description as shown in FIG. 12, a prohibition policy description as shown in FIG.
And a withdrawal policy description as shown in FIG. In this policy description,% event% is a numeric string,% subject% and% target% are objects,% action% is a character string representing the method invocation on the object,% precondition% Describes a character string representing a condition between properties in the object.

[0004] The policy description is called an existing policy description. The permission policy description and the prohibition policy description are such that when the condition described in% precondition% is satisfied in the cyber community environment, the object described in% subject% is replaced with the object described in% operation%. Allow and prohibit method invocation.

[0005] In the cyber community environment, when the condition described in% precondition% is satisfied at the event trigger described in% event% in the cyber community environment,
The object described in% Target% obligates the method to be invoked on the object described in% Operation%.
On the other hand, the withdrawal policy description withdraws the method invocation on the object obligated by the obligatory policy description under the same conditions.

[0006]

However, the operation of the cyber community environment at the initial stage of operation can be sufficiently covered by the existing policy description. However, as the operation of the environment progresses, a request from a service provided in the environment is required. Various mechanisms are introduced. For example, considering a cyber community environment that provides company organization services, in the initial stage of operation, the number of agents participating in the environment is small, and there is no need for a tree structure to manage agents, but as the number of agents increases, the number of agents increases. Is required, and the tree structure is introduced.

As described above, a new policy description is required to manage a newly introduced mechanism. The policy description is called a new policy. The new policy description can be described by the existing policy description. However, if the mechanism to be managed becomes complicated, there is a problem that the amount of description by the existing policy description becomes redundant. In addition, there is a request from the administrator of the environment that the policy description for managing the mechanism is individually handled in response to a newly introduced mechanism for ease of maintenance. There is a problem that it is not practical to prepare all policy descriptions on the environment side because it depends on the service domain provided.

The present invention has been made in view of the above points, and when an administrator introduces a new policy description, the administrator can individually handle the new policy description and reduce the amount of policy description to be described. It is an object of the present invention to provide a policy macro method and a storage medium storing a policy macro program, which can reduce the burden on the user.

[0009]

Means for Solving the Problems The present invention (claim 1) provides:
In a policy macro method for changing a new policy description used for managing a cyber community environment to an equivalent existing policy description and applying the same to the cyber community environment,
A policy macro description including name information of the new policy description, tag information of the new policy description, mapping destination information, replacement information, replacement target tag information, script information, and script target tag information is used.

FIG. 1 is a diagram for explaining the principle of the present invention. According to the present invention (claim 2), when the administrator of the cyber community environment requests macro registration, the name information of the new policy description and the tag information of the new policy description are extracted from the policy macro description (step 1) and extracted. The document type definition of the new policy description is automatically generated from the generated tag information (step 2), the document type definition and the policy macro description are stored (step 3), and when the administrator issues a request for applying the new policy description, A document type definition corresponding to the new policy description is searched (step 4), the new policy description is parsed by the document type definition (step 5), and a policy macro description corresponding to the new policy description is searched (step 6). Then, using the policy description template of the conversion destination from the policy macro description, the replacement information and the replacement target tag information are extracted from the policy macro description ( Step 7) In the policy description template, as a tag value of the tag information to be replaced, the result of replacing the part to be replaced with the replacement information with the tag value described in the new policy description is set (step 8), and the policy macro The script information and the script target tag information are extracted from the description (step 9), and a portion to be replaced with the script information is replaced with a tag value described in the new policy description as a tag value of the script target tag information in the policy description template. (Step 10)
The result set by the script engine is set (step 11), and the policy description template is applied to the cyber community environment as an existing policy description (step 1).
2).

According to the present invention (claim 3), a storage medium storing a policy macro program applied to the cyber community environment by changing a new policy description used for managing the cyber community environment to an equivalent existing policy description. Then, a new policy description is created using a policy macro description including name information of the new policy description, tag information of the new policy description, mapping destination information, replacement information, replacement target tag information, script information, and script target tag information. Has a process of changing to an equivalent existing policy description and applying it to the cyber community environment.

[0012] The present invention (claim 4) provides a process of extracting name information of a new policy description and tag information of the new policy description from a policy macro description when a manager of a cyber community environment requests macro registration; A process for automatically generating a document type definition of a new policy description from the extracted tag information, a process for storing a document type definition and a policy macro description, and a process for generating a new policy description when an administrator issues a request for applying the new policy description. A process of searching for a document type definition corresponding to the description, a process of parsing a new policy description based on the document type definition, a process of searching for a policy macro description corresponding to the new policy description, and a conversion destination policy from the policy macro description. Extract replacement information and replacement target tag information from the policy macro description using a description template Process to set the result of replacing the place to be replaced with the replacement information with the tag value described in the new policy description as the tag value of the replacement target tag information in the policy description template, and the script from the policy macro description. A process of extracting information and script target tag information, a process of replacing a portion to be replaced with script information as a tag value of script target tag information in a policy description template with a tag value described in a new policy description, It has a process of setting the result of execution by the engine, and a process of applying the policy description template as an existing policy description to the cyber community environment.

As described above, according to the present invention, when a conversion rule from a new policy description to an existing policy description is described in a policy macro description, and the new policy description is applied to a cyber community environment, the equivalent of the policy macro description is obtained. By automatically generating a new existing policy description and applying it to the environment, it is possible to reduce the amount of policy description described by the administrator, and to prepare maintenance by handling new policy descriptions individually. .

[0014]

FIG. 2 shows a policy macro module according to the present invention. The policy macro system shown in FIG.
It comprises a policy management unit 101, a macro registration unit 102, a policy registration unit 103, a cyber community environment 104, and an administrator 100.

The operation of the above configuration will be described below. FIG. 3 is a sequence chart showing the operation of the policy macro system of the present invention. The detailed operation in the figure will be described with reference to FIGS. FIG. 4 is a flow chart showing a procedure for registering a policy macro description according to the present invention, and FIGS.
9 is a flowchart of the application of a new policy description according to the present invention. Hereinafter, a description will be given using both sequence charts and flowcharts. The step numbers in each procedure correspond to FIG. 3 and FIGS. 4 to 7.

Step 101) First, the administrator 100 describes a policy macro description 107 corresponding to a policy description newly added, transmits a macro registration request to the policy management unit 101, and makes a registration request for the policy macro description. . Step 102) Upon receiving the macro request, the policy management unit 101 extracts the name information of the new policy description 107 and the tag information of the new policy description from the policy macro description.

Step 103) A document type definition 106 of the new policy description is generated from the information, and the policy registration unit 10
3 sends a document type definition registration request to the document type definition 10
Register 6. Step 104) The policy management unit 101 transmits a macro description registration request to the macro registration unit 102, and registers the policy macro description 105.

Step 105) The administrator 100 describes the new policy description 107, transmits a policy application request to the policy management unit 101, and requests application of the new policy description. Step 106) Upon receiving the policy registration request, the policy management unit 101 examines the policy description requested to be registered, and determines whether the policy description is an existing policy description or a new policy description.

Step 107) In the case of a new policy description, the policy management unit 101 transmits a document type definition search request to the policy registration unit 103, and requests a document type definition corresponding to the new policy description. Step 108) Upon receiving the document type definition search request, the policy registration unit 103 searches the document type definition 106 corresponding to the new policy description.

Step 109) If the search is successful, the policy registration unit 103 transmits a successful search to the policy management unit 101, and returns the document type definition 106. Step 110) When the policy management unit 101 receives the search request, the new policy description is parsed using the document type definition 106, and the tag value described in the new policy description is extracted. To send a macro description search request to search for a macro description corresponding to the new policy description.

Step 111) Macro registration unit 102
Receives the macro description search request, searches the policy macro description 105 corresponding to the new policy. Step 112) If the search is successful, the macro registration unit 102 transmits a successful search to the policy management unit 101, and returns the policy macro description 105. Step 113) When the policy management unit 101 receives the search success, the mapping destination information is extracted from the policy macro description, and steps 114 to 119 are repeated by the number of the mapping destination information.

Step 114) The mapping destination policy name information is extracted from the mapping destination information, and a policy description template corresponding to the mapping destination policy name information is prepared. Step 115) Replacement information and replacement target tag information are extracted from the mapping destination information, and Step 116 is repeated by the number of replacement information.

Step 116) In the policy template, as the tag value corresponding to the tag information to be replaced, a value obtained by replacing% tag% with the tag value extracted in step 110 in the replacement information is set. Step 117) In the mapping destination information, script information and script target tag information are extracted, and step 118 is repeated by the number of script information.

Step 118) In the policy description template, as a tag value corresponding to the script target tag information, the tag information is replaced with the tag value extracted in step 110 in the script information, and the output executed by the script engine is replaced. Set. Step 119) The policy description template is applied to the cyber community environment 104 as an existing policy, and the process proceeds to step 114.

As described above, first, according to the procedure of the policy macro description registration shown in FIG.
Registers a policy macro description corresponding to the policy description that the user wants to newly use. As a result, the policy description can be used. Next, the administrator of the environment applies the policy description to the cyber community environment 104 in accordance with the procedure for applying the new policy description shown in FIGS.

[0026]

Embodiments of the present invention will be described below with reference to the drawings. In the following embodiment, the example of the policy macro description shown in FIG. 8 is registered using the procedures shown in FIGS.
11 is converted into the new policy equivalent description example shown in FIG. 10 and applied to the cyber community environment. The new policy description shown in FIG. 9 is a “delegation policy” for delegating authority between positions in a tree structure for managing agents, and is a delegation source (a part surrounded by tags <delegation destinations> and tags </ delegation destinations>). )) To the agent of the position described in the delegation destination (the part between the tag <delegation destination> and the tag </ delegation destination>), the authority (tag <authority> to tag </ authority> (Part surrounded by>).

FIG. 10 shows the new policy description in the form of an equivalent existing policy description. FIG. 10 shows that “section manager U” and “section manager W” included in the position “section manager” are settled on the settlement server (). This means that the activation of the method is permitted, and the activation of the settlement () method on the settlement server is prohibited for the “manager T” included in the position “manager”. First, an example of policy macro description registration will be described.

As an example of registering a policy macro, an example of registering a policy macro shown in FIG. 8 will be described. Step 101) The administrator 100 describes the policy macro description shown in FIG. 8 and transmits a macro registration request to the policy management unit 101. Step 102) The policy management unit 101 receives the macro registration request. Here, as the name information of the new policy description, “delegation”, “delegation destination”, and “authority” are extracted as the tag information of the new policy description.

Step 103) The document type definition shown in FIG. 11 is generated from the information extracted in step 102, and the document type definition is registered in the policy registration unit 103. In the example of the document type definition, the description <! DOCTYPE delegation [...]> has the name information of the new policy description: delegation as the name of the root element, and the description <! ELEMENT Delegation (Delegation Destination, Delegation Destination, Authority)> As a tag, tag information of a new policy description: Delegation Destination, Delegation Destination, Authority, and tag <Delegation by ELEMENT Delegation Destination (#PCDATA)> The value of destination> represents that the value is described as a character string.

Step 104) Policy management unit 101
Registers the policy macro description in the macro registration unit 102. Next, an example of application of the new policy description will be described. As an example of application of a new policy description, an example in which a new policy description example shown in FIG. 9 is applied will be described.

Step 105) The administrator 100 checks FIG.
The new policy description example shown in FIG.
Require application. Step 106) The policy management unit 101 examines the example of the policy description, extracts that the name of the policy description is “transfer”, and determines that the policy description is not an existing policy description but a new policy description. I do.

Step 107) Policy management unit 101
Requests the policy registration unit 103 for a document type definition corresponding to “transfer”. Step 108) The policy registration unit 103 receives the document type definition search request and searches for a document type definition corresponding to “transfer”. In this example, since the registration has been completed in step 103, the search is successful.

Step 109) Policy registration unit 103
Sends a successful search to the policy management unit 101 and returns the document type definition shown in FIG. Step 110) The policy management unit 101 receives the search success and parses the new policy description shown in FIG. 9 using the document type definition shown in FIG. As a result, “settlement server. Settlement ();” is extracted as the value of the tag <delegate>, the section manager as the value of the tag <delegate>, and the value of the tag <authority>, and registered as a macro. Part 102
Request search for a macro description corresponding to "transfer".

Step 111) Macro registration unit 102
Receives the macro description search request and searches for a macro description corresponding to “delegation”. In this example, the search is successful because it has been registered in step 104. Step 112) The macro registration unit 102 transmits a successful search to the policy management unit 101, and returns the macro description shown in FIG.

Step 113) Policy management unit 101
Receives the search success, and from the macro description shown in FIG.
As the mapping destination information, <mapping destination = "permitted"> ... </ mapping>
And <mapping destination = “prohibited”>... </ Mapping>. In the present embodiment, an example in which steps 114 to 119 are applied to <mapping destination = “permitted”>.

Step 114) In the mapping destination information, "permission" is extracted as the mapping destination policy name information, and an authorization policy template shown in FIG. 12 is prepared as a policy description template corresponding to "permission". Step 115) In the mapping destination information,% authority% and “true” are extracted as replacement information, and an operation and a precondition are extracted as replacement target tag information.

In the present embodiment, an example is shown in which step 116 is applied to <replacement tag = “operation”>% authority% </ replacement>. Step 116) In the permission policy template shown in FIG. 12, the replacement server information is a tag value obtained by extracting the replacement information:% authority% as the element value corresponding to the operation in step 110. Set the value replaced with settlement () ;. Specifically, the description is as follows.

<Operation> Settlement server. Settlement (); </ operation> Step 117) In the mapping destination information, the following description is extracted as script information. The subject is extracted as the script target tag information. In the present embodiment, an example in which step 118 is applied to <script tag = “subject”>.

Step 118) In the script information, the% delegation destination% is replaced with the “section manager” which is the tag value extracted in step 110. Specifically, the description is as follows. For each agent in section manager Echo agent + “;” Next In this embodiment, it is assumed that the position: section manager includes “section manager U” and “section manager W”. In the permission policy template shown in FIG. 12, the result of executing the description by the script engine is set as the element value corresponding to the script target tag information subject. Specifically, the description is as follows.

<Subject> Section manager U; Section manager W; </ subject> Step 119) Mapping destination information <Mapping destination = “permitted”>... </ Mapping> is applied as follows from Steps 114 to 118. The permission policy description is applied to the cyber community environment 104 as an existing policy description.

<Permission><Subject> U section manager; W section manager; </ subject><Operation> Payment server. Settlement (); </ operation><precondition> true </ precondition></permission> In the present invention, the above-described flowcharts of FIGS. 4 to 7 are constructed as a program, and a disk device, a floppy disk, The present invention can be easily realized by storing it in a portable storage medium such as a CD-ROM and installing it in a computer when implementing the present invention.

The present invention is not limited to the above-described embodiment, but can be variously modified and applied within the scope of the claims.

[0043]

As described above, according to the present invention, in the management of a cyber community environment using a policy description, an administrator registers a conversion rule from a new policy description to an existing policy description by a policy macro description. Then, when applying the new policy description to the environment, an equivalent existing policy description is automatically generated using the policy macro description and applied to the cyber community environment. As a result, the new policy description is individually captured, and the above-described FIGS.
As shown by 0, the amount of policy description to be described is reduced, and as a result, the burden on the administrator is reduced.

[Brief description of the drawings]

FIG. 1 is a diagram for explaining the principle of the present invention.

FIG. 2 is a policy macro module diagram of the present invention.

FIG. 3 is a sequence chart showing an operation of the policy macro module of the present invention.

FIG. 4 is a flowchart of policy macro description registration according to the present invention.

FIG. 5 is a flowchart (part 1) of the application of a new policy description according to the present invention.

FIG. 6 is a flowchart (part 2) of applying a new policy description according to the present invention.

FIG. 7 is a flowchart (part 3) of applying a new policy description according to the present invention.

FIG. 8 is an example of a policy macro description according to an embodiment of the present invention.

FIG. 9 is a description example of a new policy according to an embodiment of the present invention.

FIG. 10 is an example of a new policy equivalent description according to an embodiment of the present invention.

FIG. 11 is an example of a document type definition according to an embodiment of the present invention.

FIG. 12 is an example of a permission policy template.

FIG. 13 is an example of a prohibited policy template.

FIG. 14 is an example of an obligation policy template.

FIG. 15 is an example of a withdrawal policy template.

[Explanation of symbols]

 100 Administrator 101 Policy Management Unit 102 Macro Registration Unit 103 Policy Registration Unit 104 Cyber Community Environment 105 Policy Macro Description 106 Document Type Definition 107 New Policy Description

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Tomotaka Uchihashi 3-19-2 Nishi-Shinjuku, Shinjuku-ku, Tokyo Japan Telegraph and Telephone Co., Ltd. No. 2 Nippon Telegraph and Telephone Corporation F-term (reference) 5B081 CC00

Claims (4)

[Claims] 1. A policy macro method for changing a new policy description used for managing a cyber community environment to an equivalent existing policy description and applying the same to the cyber community environment, comprising: a name information of the new policy description; Using a policy macro description including tag information, mapping destination information, replacement information, tag information to be replaced, script information, and tag information to be scripted. 2. When a manager of the cyber community environment requests macro registration, the name information of the new policy description and the tag information of the new policy description are extracted from the policy macro description, and the extracted tag information Automatically generates a document type definition of the new policy description from the document, stores the document type definition and the policy macro description, and, when the administrator issues a request for applying the new policy description, a document corresponding to the new policy description. Searching for a type definition, parsing the new policy description according to the document type definition, searching for a policy macro description corresponding to the new policy description, and converting the policy macro description using a destination policy description template. Extracting replacement information and replacement target tag information from the policy macro description; As a tag value of the replacement target tag information, a result of replacing a portion to be replaced with the replacement information with a tag value described in the new policy description is set, and script information and script target tag information are extracted from the policy macro description. In the policy description template, a portion to be replaced with the script information is replaced with a tag value described in the new policy description as a tag value of the script target tag information, and a result executed by a script engine is set. The policy description template as an existing policy description,
The policy macro method according to claim 1, wherein the policy macro method is applied to the cyber community environment. 3. A storage medium in which a new policy description used for managing a cyber community environment is changed to an equivalent existing policy description and a policy macro program applied to the cyber community environment is stored. Equivalent existing policy description using the policy macro description including the name information of the new policy description, the tag information of the new policy description, the mapping destination information, the replacement information, the replacement target tag information, the script information, and the script target tag information A storage medium storing a policy macro program characterized by having a process applied to the cyber community environment. 4. When a manager of the cyber community environment requests macro registration, a process of extracting name information of the new policy description and tag information of the new policy description from a policy macro description. A process of automatically generating a document type definition of the new policy description from the tag information, a process of storing the document type definition and the policy macro description, and a step of: A process of searching for a document type definition corresponding to the policy description; a process of parsing the new policy description based on the document type definition; a process of searching for a policy macro description corresponding to the new policy description; and the policy macro description From the policy macro description using the policy description template of the conversion destination from And a process of extracting tag information to be replaced, and a result of replacing a portion to be replaced with the replacement information with a tag value described in the new policy description as a tag value of the tag information to be replaced in the policy description template. A process of setting script information and script target tag information from the policy macro description; and a step of replacing the script information tag information with the script information as a tag value of the script target tag information in the policy description template. A process of replacing with a tag value described in a new policy description, a process of setting a result executed by a script engine, and the policy description template as an existing policy description,
4. The storage medium storing the policy macro program according to claim 3, further comprising: a process applied to the cyber community environment.