JP4111151B2 - Policy analysis system and method, and policy analysis program - Google Patents

Description

  The present invention relates to a policy analysis system, a policy analysis method, and a policy analysis program, and in particular, a policy analysis system, a policy analysis method, and a policy that can detect a set of policies that may simultaneously access the same resource. It relates to an analysis program.

  An example of a conventional policy analysis system is described in Non-Patent Document 1. Conventionally, a method for managing and controlling a distributed system composed of a network and a computer by using a policy composed of rules that describe actions to be taken when a certain condition is satisfied has been adopted. A policy analysis system is used. In policy management, the behavior of the distributed system is monitored and controlled according to a plurality of policies. At this time, there is a possibility that there is an error in the policy for controlling the system. However, since such an error may cause an abnormal behavior of the distributed system, it is desirable to detect it early. A policy analysis system is used to detect such an erroneous policy.

  Here, FIG. 8 shows an outline of the configuration of a distributed system with policy control, and FIG. 9 shows the configuration of a conventional policy analysis system. As shown in FIG. 8, a distributed system including a server computer 102, a device 103 (such as a network device), and a client terminal 104 connected via a network 105 (including a backbone 105a, a server network 105b, and an access network 105c) The policy server 101 in which the policy is stored is connected, and the policy server 101 provides a policy for controlling devices such as each server. The policy server itself is a policy analysis system for analyzing the policy. As shown in FIG. 9, the policy analysis system includes an input device 130, a policy collision analysis device 110 built in the CPU, a storage device 120, and an output device 140. The policy collision analyzer 110 includes a policy manager 111 that implements each process, a domain duplication checker 112, and a collision checker 113. In addition, a policy storage unit 121 is formed in the storage device 120.

  Here, the input device 130 is used to give a set of policies to be analyzed to the policy collision analysis device 110 in which each processing unit is formed. For example, using an input device 130 such as a computer keyboard, a human starts a conventional policy analysis system and designates an analysis target. The policy manager 111 acquires the policy designated as the analysis target from the storage unit 120. The policy to be acquired has a structure as shown in FIG. 10A (reference numeral D101). When the domain duplication checker 112 receives a set of all policies acquired by the policy manager 111, the domain duplication checker 112 checks whether or not the domains overlap. Then, the domain duplication checker 112 generates an intermediate result management table D103 (FIG. 10C) in which a set of policies with overlapping domains is recorded as a result of the check, and passes it to the collision checker 113. The collision checker 113 checks whether or not a collision occurs in the overlapping policy of the domain specified in each row of the intermediate result management table D103, and stores a set of policies in which the policy collision occurs. A management table D104 (see FIG. 10D) is generated and passed to the output device 140. The output device 140 is, for example, a computer monitor, and outputs a result management table D104 as a result of policy collision analysis.

  Next, the configuration of policy D101 will be described in detail. The policy D101 includes an identifier assigned to identify the policy, a policy type, a condition clause describing a condition that the policy is ignited, an operator who should execute the command specified in the command clause, and a command in the command clause And a command clause to be executed when the policy fires. Further, there are four types of policies: a duty policy, a prohibition duty policy, a permission policy, and a prohibition policy. The obligation policy is used to indicate that the subject is obliged to perform the command specified in the command clause. The prohibition obligation policy is used to indicate that the subject must not perform the command specified in the command clause. The permission policy is used to indicate that the subject may perform the command specified in the command clause. The forbidden policy is used to indicate that the object should not perform the instruction specified in the instruction clause. Generally, the permission policy and the prohibition policy are used for access control, and the duty policy and the prohibition duty policy are used for a monitoring / management system such as failure monitoring and response. The prohibition policy and the prohibition obligation policy are similar in concept, but have different uses. Therefore, the processing of the processing system that interprets and executes the policy differs between the prohibition policy and the prohibition obligation policy. Also, the main actor and target are specified by a character string called a domain name. The domain name will be explained in detail next. Note that a more general policy configuration is described in Non-Patent Document 2. In this document, a policy is composed of a conditional clause and a command clause.

  Further, the domain name described above is a character string for designating an object representing the policy operator and the object as a set, and is similar to the directory name of the file system. The domain name is associated with data of an acyclic effective graph structure having only one root node. FIG. 9B shows an example of the data. The data of the acyclic effective graph structure is composed of a root node, a node, and an effective edge, and the node stores a reference to an object representing an operation main or an object. For example, in a policy, when a domain name “/ A / D” is given as an operation and the domain name is associated with the data shown in FIG. 9B, it is indicated by / A / D. The reference of the object held by the node D is processed as a set of objects representing the operation subject. As another example, it is assumed that a domain name “/ B” is given as an operation principal in a certain policy. It can be seen from the data shown in FIG. 9B that “/ B” refers to the node C. Therefore, the set of objects of the main actor represented by the domain name “/ B” is obtained by the sum of the object references of the node B and the node C. Thus, a domain represents a set of objects having a hierarchical structure.

  The operation of the conventional policy analysis system having such a configuration will be described with reference to FIG. 9A described above, the data structure diagram of FIG. 10, and the flowchart showing the overall operation of the system of FIG. .

  First, the input device 130 gives a set of policies to be analyzed by the policy collision analysis device 110. When the policy manager 111 reads the policy table D102 (see FIG. 10B), which is a set of designated policies, from the policy storage unit 121 storing policy data, the policy table D102 is stored in the domain duplication checker 112. (Step S101). The domain duplication checker 112 calculates a set of all policies satisfying the following conditions from all the policies included in the policy table D102, creates an intermediate result management table D103, and collides with the policy table D102. It passes to the container 113 (step S102). The condition that is satisfied in the set of policies to be obtained is that the product set of the set of objects specified by the domain names of all the policy operators included in the set of policies is not empty and is included in the set of policies. The intersection of the object sets specified by the target domain name is not empty, and all the command clauses included in the policy set contain at least one instruction with the same name. Is. A set of policies satisfying such a property is a set of policies in which three of “operator”, “target”, and “instruction” may overlap.

  Upon receiving the intermediate result management table D103, the collision inspector 113 sets the policy type combination for each row of the intermediate result management table D103 for the set of policies specified in each row. If it corresponds to one of the obligation policy and the prohibition obligation policy, (2) the permission policy and the prohibition policy, and (3) the obligation policy and the prohibition policy, a set of such policies is found, and The set of identifiers is added to the result management table D104, the finally obtained result management table D104 is passed to the output device 140, and the output device 140 outputs the result to a monitor or the like (step S103). The type of policy can be determined by specifying the policy from the identifier using the policy table D102.

  The result management table D104 obtained in this way represents a set of policies that cannot be interpreted at the same time, before actually processing such policies and causing the policy management system to behave improperly. In addition, an operator or the like can detect and eliminate an illegal policy.

Emil C. Lupu, Morris Sloman, Conflicts in Policy-Based Distributed Systems Management, IEE・ Transactions on Software Engineering (IEEE Transanctionson Software Engineering), USA, 1999, Vol. 25, No. 6, pp. 852-869 B. Moore, et al., Policy Core Information Model, RFC3060, Internet Engineering Task Force, 2001

  However, the policy analysis system shown in the above conventional example has the following disadvantages. First, the first problem is that a set of policies that can access the same resource in parallel cannot be found. That is, in the above conventional example, only a plurality of policies corresponding to any one of (1) mandatory policy and prohibited policy, (2) permitted policy and prohibited policy, and (3) mandatory policy and prohibited policy are detected. However, it merely detects a policy with a contradictory control command, and does not consider whether or not a plurality of policies access the same target. For this reason, it is impossible to detect a set of policies that access the same resource in parallel, and it is not possible to effectively eliminate a policy that causes a problem in a system that is a management target of the policy management system. Therefore, there arises a problem that it is impossible to stabilize the system that is the target of policy management. For example, in Non-Patent Document 1, a policy that causes access to a resource is an obligation policy. However, in this document, no consideration is given as to whether an obligation policy and another obligation policy access the same resource. Not done. In such a case, a set of policies that access the same resource in parallel causes a problem in the system managed by the policy management system. Therefore, it is necessary to detect such a set of policies by policy analysis. is there.

  The second problem is that a set of policies that may access the same resource in parallel is discovered, and the obtained set is a set of policies that may actually operate safely. There is a high possibility that a policy is included, and a policy is unnecessarily detected, and a normal policy may be excluded. This is because the policy conditional clause is not taken into consideration in the policy analysis. Therefore, policies that clearly do not access the same resource in parallel (almost simultaneously) than the conditions described in the conditional clause are not dangerous and should be excluded from the set of policy analysis results. is there.

  In order to solve such a problem, an object of the present invention is to provide a policy analysis system capable of finding a set of policies that may access the same resource in parallel. Another object of the present invention is to provide a policy analysis system capable of analyzing a conditional clause and detecting and excluding a policy that is clearly not accessed in parallel. Objective.

Therefore, in the present invention, among a plurality of policies that are more configured to control command information representing a control command for the resource specifying information and the resource that specifies the resources to be controlled, it can be accessed for the same resource policy A policy analysis system for analyzing and detecting
For each resource that is subject to policy control, command information that indicates a control command based on a policy that can be operated on the resource, and command type information that indicates whether each control command changes the state of the resource. And resource information storage means stored in association with each other in advance,
Based on the policy to be analyzed and the information in the resource information storage means, the resource targeted by each policy and the control command for the resource are determined from the control command information included in the policy, and the control command A command checking means for determining a corresponding command type from the command type information ;
Based on this determination result, among the two or more policies that target the same resource, 2 that satisfies the condition that at least one of the control commands included in at least one policy changes the state of the target resource Duplicate inspection means for detecting the above policy,
It has the structure of having.

At this time, in addition to the above structure, duplicate checking means is desirable when the information on two or more of the policy which the detected output to the external unit, and the configuration of.

  With such a configuration, first, a resource targeted by the policy and its command are extracted. For each resource, refer to the instruction type information indicating whether or not each instruction changes the state of the resource, and the policy is accessed for the same resource and the state of the resource is changed. A set of policies to be detected is detected. As a result, it is possible to find a policy that has the possibility of accessing the same resource in parallel, and it is possible to output these and notify an operator or the like. For this reason, measures such as correcting or deleting such a policy can be taken, and stabilization of a distributed system or the like incorporating policy control can be achieved.

Further, in addition to the above configuration, the policy includes operating condition information that is a condition for operating the policy, and based on the operating condition information, the policy is simultaneously selected from two or more policies detected by the duplication inspection means. It is desirable to provide a condition inspection means for detecting a policy that may operate . Similarly, the policy includes operating condition information that is a condition for operating the policy, and based on the operating condition information, the operating condition is the same among two or more policies detected by the duplicate inspection means. It is desirable to have a condition inspection means for detecting a certain policy.

  At this time, it has an output means for outputting predetermined information to an operator or other externally connected device, and the condition inspection means outputs information on the detected policy to the outside via the output means. It may be.

  By adopting such a configuration, the conditions under which the policy operates are inspected, it is possible to effectively detect a policy that can be accessed simultaneously with respect to the same resource, and it is possible to detect a dangerous policy with higher accuracy. Therefore, unnecessary work such as deleting a policy that does not need to be deleted can be eliminated, and a more stable operating state of a system in which policy control is incorporated can be maintained.

Further, in the present invention, among a plurality of policies that are more configured to control command information representing a control command for the resource specifying information and the resource that specifies the resources to be controlled, it can be accessed for the same resource policy Is a policy analysis method for analyzing and detecting
Instruction information indicating control instructions operable in the resource and stored in the storage unit in association with each resource in advance, and an instruction type indicating whether or not the state of the resource is changed by the control instruction Based on the information and the policy to be analyzed, a resource targeted by each policy and a control command for the resource are determined from the control command information, and a command type corresponding to the control command is determined from the command type information. Order inspection process;
A policy extraction step of extracting two or more policies targeting the same resource based on the determination result;
A duplicate inspection process for detecting two or more policies that satisfy a condition that at least one of the control commands included in at least one of the extracted policies changes a state of a target resource;
The policy analysis method of the structure of having was provided.

Then, after the duplication inspection step, the possibility of operating in parallel among two or more policies detected in the duplication inspection step based on the operation condition information that is a condition under which the policy included in the policy operates . It is desirable to use a method having a condition inspection process for detecting a certain policy. Similarly, after the duplication inspection step, the operation conditions are the same among two or more policies detected in the duplication inspection step based on the operation condition information that is a condition for operating the policy included in the policy. It is desirable that the method has a condition inspection process for detecting a policy.

Furthermore, in the present invention, among a plurality of policies that are more configured to control command information representing a control command for the resource specifying information and the resource that specifies the resources to be controlled, it can be accessed for the same resource policy To a computer that analyzes and detects
For each resource that is subject to policy control, command information that indicates a control command based on a policy that can be operated on the resource, and command type information that indicates whether each control command changes the state of the resource. Resource information storage means for storing in association with each other in advance,
Based on the policy to be analyzed and the information in the resource information storage means, the resource targeted by each policy and the control command for the resource are determined from the control command information included in the policy, and the control command Instruction inspection means for determining corresponding instruction types from the instruction type information ;
Based on this determination result, among the two or more policies that target the same resource, 2 that satisfies the condition that at least one of the control commands included in at least one policy changes the state of the target resource Duplicate inspection means for detecting the above policy,
We also provide a policy analysis program to achieve this.

Further, the above program can be operated in parallel among two or more policies detected by the duplication checking means based on operating condition information that is a condition for operating the policy included in the policy. It is also a policy analysis program for realizing a condition inspection means for detecting a policy having a characteristic. Similarly, based on operating condition information that is a condition for operating the policy included in the policy, a policy having the same operating condition is detected from two or more policies detected by the duplication inspection means. It is also a policy analysis program for realizing the condition checking means on a computer.

  Even with such a configuration, the above object can be achieved because it functions in the same manner as described above.

  Since the present invention is configured and functions as described above, according to this, it is possible to find a policy having a possibility of accessing the same resource in parallel, and to output these and notify an operator or the like. It becomes possible. For this reason, measures such as correcting or deleting such a policy can be taken, and stabilization of a distributed system or the like incorporating policy control can be achieved.

  The policy analysis system according to the present invention is a policy management system in which a policy server is installed in a predetermined system (for example, see FIG. 8) such as a distributed system using a network in which computers and devices are connected to a network. A policy analysis system for analyzing a policy in order to avoid a collision of these policies when it is performed. Therefore, the policy analysis system may be installed in a policy server installed in a distributed system or the like, or may be separately configured by a computer connected so that the policy in the policy server can be referred to. . The policy in the present invention is a rule that describes an action to be taken when a certain condition is satisfied. For example, the policy is data that describes a control command for a server or device in the distributed system.

  The policy analysis system then collects such policies when a plurality of policies access the same resource and any one of these control commands changes the state of the resource. Is detected. Thus, the system that is the target of policy control is stabilized by changing or eliminating these detected policies. Hereinafter, the configuration and operation of the policy analysis system will be described through each embodiment.

  A first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a functional block diagram showing the configuration of the policy analysis system. 2 to 3 are explanatory diagrams showing the structure of data used in this system. 4 to 6 are flowcharts showing the operation of this system.

(Constitution)
As shown in FIG. 1, the policy analysis system according to the present embodiment includes an input device 30 such as a computer keyboard used for designating a set of policies to be analyzed, and a parallel set from a set of policies. The policy parallel access analysis device 10 having a function of calculating a set of all policies that may access the same resource and a storage device 20 that is a volatile or nonvolatile storage area built in the computer And an output device 40 such as a computer monitor. Here, the policy parallel access analysis device 10 is realized by incorporating a policy analysis program prepared in advance in a CPU of a computer. That is, the following processing units (each device) are built in the CPU by the program. Hereinafter, each configuration will be described in detail.

  First, the storage device 20 is formed with a policy storage unit 21 storing a policy used for policy management and a type information storage unit 22 storing a type information used for describing the policy. . And policy D1 shown to Fig.2 (a) is an example of a structure of a policy. As shown in this figure, the policy D1 includes an identifier, a conditional clause, and an instruction clause. The identifier is an integer or a character string used to distinguish the policy from other policies. In the conditional clause, a conditional expression for igniting the policy is described. That is, the policy execution system that interprets the policy evaluates all policies when an event occurs, and executes the command clause of the policy if the conditional expression is true. The command section describes a command that is a control command for a resource to be controlled by the policy, and a sequence of resources to which the command is applied. For example, the command “t1.invoke1 (param1);” is interpreted as applying the command invoke1 with the argument param1 to the target t1. Note that t1 is defined in advance in the server that manages the policy, in the policy storage unit, and in the policy data, and a variable that indicates the target such as t1 is assigned a “type” to be described later in advance. And In the present invention, it is also defined in the policy analysis system.

  In addition, the type information management table D6 (see FIG. 3C) stored in the type information storage unit 22 formed in the storage device 20 represents information on each resource that is the target of policy control. That is, each resource is represented by a “type” name, and command information indicating a control command based on an operable policy in each type is associated with command type information indicating the type of the command. Therefore, the type information is composed of two sets of columns of “instruction” that can be provided by the policy and “type” of the instruction for each “type name” which is a character string for indicating the type. Is done. The “type” is information indicating how the command affects the target (resource, type), and specifically, a command for changing the state of the target device. This is command type information that distinguishes whether or not. Here, the type indicating that the command is for changing the target state is referred to as “W”, and the type indicating the command for not changing the state of the device is referred to as “R”. In addition, you may include a thing with unknown attribute in a classification as "U". However, since it is sufficient to handle an unknown attribute equivalent to “W”, only “W” and “R” are handled here. Specifically, it is assumed that the device to be managed is a Web server and the model name is WebServer. Assume that the Web server has a command “getPerformance” indicating the current operation rate and an “addAccessList” for adding a request source to which the Web server can publish content. Since getPerformace only reads the device status, it does not change the device status. Accordingly, “W” is assigned to getPerformace as a type. On the other hand, “add” is assigned as the type to addAccessList to update the access list. When this type information is shown using the type information management table D6 shown in FIG. 3C, {WebServer | (getPerformance, R), (addAccessList, W)} is obtained. In this way, it is assumed that type information corresponding to a device to be managed is given in advance and stored in the type information storage unit 22.

  The policy parallel access analysis apparatus 10 described above includes a policy manager 11, an instruction checker 12, a type information manager 13, and a target duplication checker 14. The policy manager 11 reads the policy designated as the analysis target from the policy storage unit 21 and passes the read data to the instruction checker 12. At this time, an example of the configuration of the policy table D2 which is data read from the policy storage unit 21 and passed to the instruction checker 12 is shown in FIG. Upon receiving the policy table D2, the instruction checker 12 acquires “type” information corresponding to the target resource appearing in the policy from the type information manager 13, and analyzes each policy to obtain FIG. The intermediate result management table D3 shown in (c) is generated, and the generated intermediate result management table D3 and policy table D2 are passed to the target duplication checker 14. At this time, the instruction checker 12 constitutes a processing unit in which a correspondence relationship between a variable (domain name or the like) of a resource subject to policy control and a type is stored in advance. Therefore, the type name can be acquired from the variable to be controlled included in the command clause in the policy table D2. When the type information management unit 13 receives a type information acquisition request from the instruction checker 12, the type information management table 13 reads the specified type information from the type information storage unit 22 and includes all the requested type information. D6 is passed to the instruction checker 12. When the target duplication checker 14 receives the intermediate result management table D3 from the instruction checker 12, the target duplication checker 14 checks whether the target of the instruction is duplicated, and finally may access the same resource in parallel. When a result management table D5 (see FIG. 3B), which is a table of a set of policies, is generated, the result is output to the output device 40 and output. Detailed functions of the devices 11, 12, 13, and 14 serving as the processing units described above will be described together with the following description of operations.

(Operation)
Next, the operation of the policy analysis system configured as described above will be described with reference to FIGS. FIG. 4 is a flowchart showing an outline of the operation of the entire system. FIG. 5 is a flowchart showing the detailed operation of step S4 of FIG. FIG. 6 is a flowchart showing details of the operation in step S5 of FIG.

  First, a human or another system uses the input device 30 to specify a set of policies to be analyzed. The policy manager 11 reads the policy table D2 including the policy specified as the analysis target from the policy storage unit 21, and passes the policy table D2 to the instruction checker 12 (step S1).

  Subsequently, the instruction checker 12 obtains all the model names used in the policies included in the policy table D2 (step S2). That is, the type name corresponding to the variable representing each resource that is the target of the instruction included in the instruction section is obtained. At this time, for example, type names are set in advance for each resource, and such information is programmed in the instruction checker 12.

  Subsequently, the instruction checker 12 acquires the type information management table D6 from the type information manager 13 using the type name. When the type information manager 13 receives a set of type names to be acquired from the instruction checker 12, the type information manager 13 reads the type information corresponding to the type name from the type information storage unit 22, and uses the result as a type information management table D6. It passes to the inspection device 12 (step S3). Then, the instruction checker 12 analyzes each policy of the policy table D2 using the type information management table D6, creates an intermediate result management table D3 that summarizes the analysis results, and creates the policy table D2 and the intermediate result management table D3. It is passed to the target collision inspector 14 (step S4).

  Subsequently, when the target duplication checker 14 receives the policy table D2 and the intermediate result management table D3, it calculates a set of policies in which resources (types) to be controlled are duplicated, and creates a result management table D5. , To the output device 40 (step S5). Here, each row of the result management table D5 represents a set of policy identifiers that may access the same resource in parallel. The output display 40 outputs the result management table D5 as an analysis result to a monitor screen or a printer (step S6). The output device 40 may obtain the policy table D2 from the policy manager 11, obtain the policy indicated by the identifier shown in the result management table D5, and display the policy itself instead of the identifier as the analysis result. .

  Next, the operation of processing by the instruction checker 12 in step S4 shown in FIG. 4 will be described in detail with reference to FIG. At the time of step S4, the instruction checker 12 has a policy table D2 containing the data of the policy to be analyzed, and a type information management table D6 containing information on the types appearing in each policy of the policy table. Yes.

  First, the instruction checker 12 takes out one policy that has not been checked yet from the policies included in the policy table D2 (No determination at step A1, step A2). If all the policies have been inspected, the process ends (affirmative determination in step A1) and the process proceeds to the target duplication inspection process in step S5. Next, the instruction checker 12 initializes the instruction check table D4 shown in FIG. 3A (step A3). The instruction check table D4 is a table composed of two sets of type name and type, and is data built in the instruction checker 12. In the initialization of the instruction check table D4, all type names appearing in the policy selected in step A2 are embedded as elements of the left term, and the types of the right term are all null. Then, the instruction checker 12 checks all instructions appearing in the policy selected in step A2. If all the instructions have already been inspected (Yes in Step A4), the process proceeds to Step A10 described later.

  If all the instructions have not been inspected (No in Step A4), one instruction that has not been inspected is selected (Step A5). At this time, it is assumed that all commands appearing in the policy are associated with a type representing a device to which the command is applied. Then, the type of the instruction is obtained from the selected instruction and the type to which the instruction is applied, using the type information management table D6. If the type is “W” (an instruction to change the state of the target resource), the process proceeds to step A9 (affirmative determination in step A6). On the other hand, if the type is not “W”, the type associated with the type name of the type is checked using the instruction check table D4. If the type is “W” (Yes in step A7), step Move to A4. If the type name type is not “W” in Step A7 (No in Step A7), the type name type in the instruction check table D4 is set to “R” (Step A8). Here, when the type obtained in step A6 is “W”, the type name type of the type in the instruction check table D4 is set to “W” (step A9).

  When all the instructions appearing in the policy selected in step A2 are checked (affirmed in step A4), the type name whose type is null is deleted from the instruction check table D4, and selected in step A2. The policy identifier is added as a new term to the intermediate result management table D3 with the left term and the result of the instruction check table D4 as the right term (step A10), and the process returns to step A1. In this manner, when the instruction checker 12 generates the intermediate result management table D4 in which the type is assigned to the type appearing in each policy to be investigated, it passes it to the target duplication checker 14 together with the policy table D2.

  Next, the processing operation by the target duplication checker 14 shown in step S5 of FIG. 4 will be described in detail with reference to FIG. First, the target duplication checker 14 has a policy table D2 and an intermediate result management table D3 at the time of step S5 in FIG.

  First, the target duplication checker 14 checks all types appearing in the right term of the intermediate result management table D3 (step B1). If there is a type that has not been checked yet (No in Step B1), select one type that has not been checked, create one flag that has any of True and False, and set the flag value Set to False and create one empty list (step B2). Next, all policies are inspected using the selected mold (step B3). If all the policies have been inspected (Yes in step B3), the process proceeds to step B9. If there is a policy that has not been inspected yet, one uninspected policy is selected (step B4).

  Then, the intermediate result management table D3 is examined from the policy identifier selected in step B4, and if the type name selected in step B2 is not included in the corresponding right term (determination is negative in step B5), step Return to B3. If the type name is included (Yes in step B5), the type is checked from the intermediate result management table D3 (step B6). If the type is “W”, the process proceeds to step B7 (in step B6). Affirmative). In other cases (negative determination in step B6), the process proceeds to step B8. In step B7, if the type is “W”, the flag is set to True (step B7). Thereafter, the policy identifier is added to the list prepared in step B2 (step B8), and the process returns to step B3.

  When all the policies have been inspected in step B3 (positive determination in step B3), the flag is inspected (step B9). If not true, the process returns to step B1 (negative determination in step B9). If the flag is True (Yes in Step B9) and the number of elements in the list is two or more (Yes in Step B10), the process proceeds to Step B11, otherwise (No in Step B10). Return to Step B1. In step B11, the list including the policy identifier is added as a new row to the result management table D5, and the process returns to step B1.

  When all the molds have been inspected (Yes in step B1), the result management table D5 is transmitted to the output device 40. At this time, each row of the result management table accesses the same target in parallel, and any of the instructions that cause access may change the “W” attribute, that is, the state of the target. This is a list of policy identifiers.

  By doing so, in this embodiment, by analyzing the type appearing in each policy and the attribute information of the instruction, a plurality of policies access the type representing the same object in parallel, and Since it is configured to calculate the entire set of policy identifiers for which the instruction corresponding to one or more of the accesses changes the target state, the possibility of accessing the same resource in parallel A set of policies can be obtained. By outputting such a result, the operator can take measures such as changing or deleting the conditions of such a policy or the contents of the control command, and stabilize the system to which the policy is given. Can do. The detected policy may be dealt with such as being automatically deleted from the policy server by the computer. Alternatively, the operation may be temporarily stopped.

  Next, a second embodiment of the present invention will be described with reference to FIG. FIG. 7A is a functional block diagram showing the configuration of the policy analysis system in this embodiment, and FIG. 7B is a diagram showing the structure of data used in the system.

(Constitution)
The policy analysis system according to the present embodiment has substantially the same configuration as the system according to the first embodiment described above, but differs in that the policy parallel access analysis device 10 ′ includes a condition checker 15. Along with this, the target duplication tester 14 ′ and the output device 40 ′ are slightly different. This will be described in detail below.

  The target duplication checker 14 ′ in this embodiment transmits a result management table D 3 and a policy table D 2 to the condition checker 15. The output device 40 ′ receives the condition analysis table D 7 (see FIG. 7B) from the condition checker 15. The other basic operations of the device 14 'and the device 40' are the same as those in the first embodiment.

  When the condition checker 15 receives the result management table D3 and the policy table D2 from the target duplication checker 14 ′, it analyzes the condition clause of each policy specified by the identifier and does not access the policy in parallel. The group is removed from the result management table D5, and a condition analysis table D7 shown in FIG. 7B is created. Then, the created condition analysis table D7 is transmitted to the output device 40 '. The condition checker 15 analyzes the condition clause of each policy, and removes the policy group that can guarantee that the access will not be performed in parallel according to the definition of the condition clause. It has a function for obtaining an analysis result with higher accuracy than the result management table D5 obtained according to the form. High accuracy means that the obtained analysis result includes a high rate of policy sets that actually access the same resource in parallel.

(Operation)
Next, the operation of the present embodiment will be described in detail. Here, the operation of the condition checker 15 will be mainly described. This operation is a process sandwiched between steps S5 and S6 in FIG. 4, and the other processes are the same as in the case of the first embodiment, and are therefore omitted.

  First, the condition checker 15 receives the result management table D5 and the policy table D2 from the target duplication checker 14 '. Since the result management table D5 at this time does not consider the condition of the conditional clause, it includes a set of policies that are not actually accessed in parallel due to the definition of the conditional clause.

  Subsequently, the condition inspector 15 extracts and inspects a set of policy identifiers included in each row of the result management table D5. When all lines have been examined, the process ends. If there is an uninspected row, an uninspected row is selected from the result management table D5. Then, the policy specified by each identifier included in the selected row is extracted from the policy table D2, and the condition clause of each policy is acquired. At this time, the conditional clause includes a name indicating the type of event accepted by the policy. When an event having an execution system that interprets and processes the policy is received, a policy having a conditional clause including the event name similar to the name of the event type is fired. Therefore, a set of policies that can be fired at the same time satisfies the condition that an event having the same name is included in the conditional clause.

  Accordingly, each conditional clause is examined from the policy extracted from the policy table D2, all the sets of policies having the conditional clause including the event of the same name are obtained, and the policy identifier of each set is stored in the condition analysis table D7. Add each one. At this time, in addition to the name of the type of event to be accepted, the acceptance condition may be specified in more detail for the attribute value included in the event. For example, it is assumed that there is an event named “SomeEvent”, and the type of the name has “someValue” as an attribute. Using such an event, for example, there is a description such as “on SomeEvent {someValue> 10}” in the conditional clause. This conditional clause accepts SomeEvent, and the value of someValue included in SomeEvent is 10 If it is large, it is interpreted as firing. In this way, when more detailed conditions are described in the conditional clause, attribute names and comparison operators that appear in the conditional clause, and when there are multiple conditions, a logical operator that combines the conditions is added. By analyzing, it is possible to discover policy combinations that do not ignite at the same time and exclude such combinations from the analysis results. For example, there are two conditional clauses, the event names accepted by each conditional clause are the same, the event name is “E1”, and the attribute name of E1 is “param”. At this time, one conditional clause is “on E1 {param> 10}”, and the other conditional clause is “on E1 {param <10}”. Such policies clearly do not ignite at the same time. Thus, by obtaining a conditional expression that does not clearly fire at the same time, it is possible to obtain a more accurate set of conditional clauses that may fire simultaneously.

  Then, the condition checker 15 finishes the process when all the rows of the result management table D7 are checked, and passes the condition analysis table D7 to the output device 40 '. If there is an uninspected row, an uninspected row is selected from the result management table D5, and the same inspection as described above is repeated.

  In this way, by including the condition checker 15 that determines whether or not the policy conditional clauses may be true at the same time, the possibility of accessing the same resource in parallel obtained by the first embodiment described above. From a set of policies, a set of policies that are determined not to access the same resource in parallel by definition of the policy condition clause can be removed, and a more accurate analysis result can be calculated. Therefore, it is possible to improve the probability of detecting an inappropriate policy in the control target, and to take measures such as deleting or changing only such a policy. Further stability of distributed systems subject to policy control, etc. Can be achieved.

  The policy analysis system according to the present invention is incorporated in a policy-controlled network system or the like, so that the network system or the like can be stabilized and can be used industrially.

It is a functional block diagram which shows the structure of the policy analysis system in Example 1. FIG. It is a figure which shows the structure of the data used with the policy analysis system disclosed in FIG. 2A shows the data structure of the policy, FIG. 2B shows the data structure of the policy set, and FIG. 2C shows the data structure of the intermediate result management table. It is a figure which shows the structure of the data used with the policy analysis system disclosed in FIG. 3A shows the data structure of the instruction check table, FIG. 3B shows the data structure of the result management table, and FIG. 3C shows the data structure of the type information management table. It is a flowchart which shows the outline | summary of operation | movement of the policy analysis system disclosed in FIG. 5 is a flowchart showing a detailed operation of instruction inspection processing disclosed in FIG. 4. 5 is a flowchart showing a detailed operation of target duplication inspection disclosed in FIG. 4. FIG. 7A is a functional block diagram illustrating the configuration of the policy analysis system according to the second embodiment. FIG. 7B is a diagram showing a data structure of a condition analysis table that is data used in the system. It is the block diagram which showed the outline of the structure of the distributed system with policy control in a prior art example. FIG. 9A is a functional block diagram showing the configuration of a conventional policy analysis system. FIG. 9B is an explanatory diagram for explaining the policy handling. FIGS. 10A to 10D are diagrams showing the structure of data used in the policy analysis system in the conventional example. It is a flowchart which shows operation | movement of the policy analysis system in a prior art example.

Explanation of symbols

10 Policy parallel access analyzer 11 Policy manager 12 Instruction checker (command check means)
13-type information manager 14 Target duplicate checker (Duplicate check means)
15 Condition checker (condition check means)
20 storage device 21 policy storage unit 22 type information storage unit (resource information storage means)
30 Input device 40 Output device (output means)

Claims (11)

Among a plurality of policies that are more configured to control command information representing a control command for the resource specifying information and the resource that specifies the resources to be controlled, detecting and analyzing the policy may be accessed for the same resources A policy analysis system,
For each resource to be controlled by the policy, command information indicating a control command by the policy that can be operated by the resource, and a command type indicating whether each control command changes the state of the resource. The instruction type information includes resource information storage means stored in association with each other in advance,
Based on the policy to be analyzed and the information in the resource information storage means, the resource targeted by each policy and the control command for the resource are determined from the control command information included in the policy, and Command inspection means for determining the command type corresponding to the control command from the command type information ;
Based on this determination result, among the two or more policies that target the same resource, 2 that satisfies the condition that at least one of the control commands included in at least one policy changes the state of the target resource Duplicate inspection means for detecting the above policy,
A policy analysis system characterized by comprising: Before SL duplication checker means, policy analysis system according to claim 1, wherein said information relating to the detected two or more of the policy was a function of outputting to the external, characterized in that. The policy includes operating condition information that is a condition for operating the policy,
The condition inspection means for detecting a policy that may operate in parallel among the two or more policies detected by the duplication inspection means based on the operating condition information. 1. The policy analysis system according to 1. The policy includes operating condition information that is a condition for operating the policy,
The condition inspection means for detecting a policy having the same operation condition among two or more policies detected by the duplication inspection means based on the operation condition information. Policy analysis system. Having an output means for outputting predetermined information to an operator or other externally connected device;
5. The policy analysis system according to claim 3, wherein the condition checking unit has a function of outputting information on the detected policy to the outside via the output unit. Among a plurality of policies that are more configured to control command information representing a control command for the resource specifying information and the resource that specifies the resources to be controlled, the policy may be accessed for the same resources, analyzed by computer A policy analysis method for detecting
Preliminarily associated and stored for each resource, the command information indicating a control command operable by the resource, and the command type information indicating the command type whether or not to change the state of the resource by the control command and analysis Based on the target policy, a resource targeted by each policy and a control command for the resource are determined from the control command information, and a command type corresponding to the control command is determined from the command type information. Order inspection process to
A policy extraction step of extracting two or more policies targeting the same resource based on the determination result;
Among these extracted policies, a duplicate inspection process for detecting two or more policies satisfying the condition that at least one of the control commands included in at least one policy changes the state of the target resource,
A policy analysis method comprising: A condition for detecting a policy that may operate in parallel among two or more policies detected in the duplication inspection step based on operating condition information that is a condition for operating the policy included in the policy. The policy analysis method according to claim 6, further comprising an inspection step.   A condition inspection step for detecting a policy having the same operation condition among two or more policies detected in the duplication inspection step based on operation condition information which is a condition for operating the policy included in the policy. The policy analysis method according to claim 6, further comprising: Among a plurality of policies that are more configured to control command information representing a control command for the resource specifying information and the resource that specifies the resources to be controlled, detecting and analyzing the policy may be accessed for the same resources On the computer,
For each resource to be controlled by the policy, command information indicating a control command by the policy that can be operated by the resource, and a command type indicating whether each control command changes the state of the resource. Instruction type information and resource information storage means for pre-associating and storing,
Based on the policy to be analyzed and the information in the resource information storage means, the resource targeted by each policy and the control command for the resource are determined from the control command information included in the policy, and Command checking means for determining the command type corresponding to the control command from the command type information;
Based on this determination result, among the two or more policies that target the same resource, 2 that satisfies the condition that at least one of the control commands included in at least one policy changes the state of the target resource Duplicate inspection means for detecting the above policy,
Policy analysis program for implementing the. A condition for detecting a policy that may operate in parallel among two or more policies detected by the duplication checking means based on operating condition information that is a condition for operating the policy included in the policy Inspection means,
The policy analysis program according to claim 9 for realizing the above on the computer. Condition checking means for detecting a policy having the same operating condition among two or more policies detected by the duplication checking means based on operating condition information which is a condition for operating the policy included in the policy. ,
The policy analysis program according to claim 9 for realizing the above on the computer.

Images