Method and rule-repository for generating security-definitions for heterogeneous systems

1. A method for generating system-specific security-definitions for a plurality of heterogeneous subsystems by using a computing system that includes at least one processor, the system-specific security-definitions associated with respective subsystems of the plurality of heterogeneous subsystems, the plurality of heterogeneous subsystems including a first heterogeneous subsystem, the method comprising:

storing a plurality of natural-language security-definitions in a rule-repository that is stored in a storage medium;

storing a plurality of machine-readable security-definitions in the rule-repository stored on the storage medium, the plurality of machine-readable security-definitions including a first machine-readable security-definition;

storing, in the rule-repository stored on the storage medium, a first mapping of each one of the plurality of natural-language security-definitions onto at least one of the plurality of machine-readable security-definitions;

storing, in the rule-repository stored on the storage medium, a second mapping that associates the first machine-readable security-definition to an indication of a first system-specific security-definition;

associating a respective rule-converter to each one of the plurality of heterogeneous subsystems;

generating, via the computing system, the first system-specific security-definition for the first heterogeneous subsystem from at least the first machine-readable security-definition by using the respective rule-converter associated with the first heterogeneous subsystem, wherein the generating is based on the second mapping,

storing a new system-specific security-definition in the rule-repository; and

generating, via the computing system, a second machine-readable security-definition from the new system-specific security-definition by the respective rule-converter according to the second mapping.

2. The method of claim 1 , further comprising:

selecting at least one of the natural-language security-definitions; and

retrieving the first system-specific security-definitions according to the first and second mapping.

3. The method of claim 2 , further comprising:

updating the first system-specific security-definition;

selecting the updated first system-specific security-definition; and

retrieving a natural-language security-definition which has updated the selected system-specific security-definition.

4. The method of claim 1 , further comprising:

selecting at least one of the system-specific security-definitions; and

retrieving affected natural-language security-definitions according to the first and second mapping.

5. The method of claim 1 , further comprising:

updating a second natural-language security-definition and/or a second machine-readable security-definition; and

updating a corresponding system-specific security-definitions by the one or more rule-converters in accordance with the updated second natural-language security-definition and/or the second machine-readable security-definition.

6. The method of claim 1 , wherein the plurality of natural-language security-definitions, the plurality of machine-readable security-definitions and/or the first system-specific security-definition comprise a time-stamp.

7. The method of claim 1 , wherein the first machine-readable security-definition comprises any of the group of constructs comprising users, roles, resources and/or access-privileges.

8. The method of claim 1 , wherein the first machine-readable security-definition is defined in XACML.

9. The method of claim 1 , wherein the second mapping is a l:n mapping, a l:l mapping, or a n:m mapping.

10. A computing apparatus for generating system-specific security-definitions for a plurality of heterogeneous subsystems, the system-specific security-definitions associated with respective subsystems of the plurality of heterogeneous subsystems, the plurality of heterogeneous subsystems including a first heterogeneous subsystem, the apparatus comprising:

a storage medium system; and

a processing system that includes at least one processor, the processing system configured to:

store a plurality of natural-language security-definitions in a rule-repository storage medium;

store a plurality of machine-readable security-definitions in the rule-repository storage medium, the plurality of machine-readable security-definitions including a first machine-readable security-definition;

store, in the rule-repository storage medium, a first mapping of each one of the plurality of natural-language security-definitions onto at least one of the plurality of machine-readable security-definitions;

store, in the rule-repository storage medium, a second mapping that associates the first machine-readable security-definition to an indication of a first system-specific security-definition;

associate a respective rule-converter to each one of the plurality of heterogeneous subsystems;

generate, via the computing system, the first system-specific security-definition for the first heterogeneous subsystem from at least the first machine-readable security-definition by using the respective rule-converter associated with the first heterogeneous subsystem, wherein the generating is based on the second mapping,

store a new system-specific security-definition in the rule-repository; and

generate a second machine-readable security-definition from the new system-specific security-definition by the respective rule-converter according to the second mapping.

11. The apparatus of claim 10 , wherein the one or more rule-converters are adapted for generating, for each construct of the one or more machine-readable security-definitions at least one corresponding construct specific to the one or more system-specific security-definitions.

12. The apparatus of claim 10 , wherein the first and/or the second mapping is stored in the one or more natural-language security-definitions and/or the one or more machine-readable security-definitions.

13. The apparatus of claim 10 , wherein the first and/or the second mapping is stored in at least one separate mapping document.

14. The apparatus of claim 10 , wherein the plurality of natural-language security-definitions, the plurality of machine-readable security-definitions, and the first system-specific security-definition are stored in an XML format.

15. The computing apparatus of claim 10 , wherein the second mapping is a l:n mapping, a l:l mapping, or a n:m mapping.

16. A non-transitory computer readable storage medium storing instructions for use with a computing system for generating system-specific security-definitions for a plurality of heterogeneous subsystems, the computing system including at least one processor, the system-specific security-definitions associated with respective subsystems of the plurality of heterogeneous subsystems, the plurality of heterogeneous subsystems including a first heterogeneous subsystem, the stored instructions comprising instructions that are configured to:

store a plurality of natural-language security-definitions in a rule-repository storage medium;

store a plurality of machine-readable security-definitions in the rule-repository storage medium, the plurality of machine-readable security-definitions including a first machine-readable security-definition;

store, in the rule-repository storage medium, a first mapping of each one of the plurality of natural-language security-definitions onto at least one of the plurality of machine-readable security-definitions;

store, in the rule-repository storage medium, a second mapping that associates the first machine-readable security-definition to an indication of a first system-specific security-definition;

associate a respective rule-converter to each one of the plurality of heterogeneous subsystems;

generate, via the computing system, the first system-specific security-definition for the first heterogeneous subsystem from at least the first machine-readable security-definition by using the respective rule-converter associated with the first heterogeneous subsystem, wherein the generating is based on the second mapping,

store a new system-specific security-definition in the rule-repository; and

generate a second machine-readable security-definition from the new system-specific security-definition by the respective rule-converter according to the second mapping.

17. The medium of claim 16 , wherein the second mapping is a l:n mapping, a l:l mapping, or a n:m mapping.