System and method for translating mapping policy into code

1. A system comprising at least one processor programmed to:

translate a policy into policy code, wherein:

the policy is provided in a policy language;

the policy code is in a programming language that is different from the policy language; and

the policy comprises a statement that maps an entity name to one or more metadata symbols;

search a target description for at least one entity matching the entity name, wherein:

the target description comprises descriptions of a plurality of entities; and

each entity of the plurality of entities represents a respective component of a target system against which the policy is to be enforced; and

use a description of the at least one entity matching the entity name to associate, with the at least one entity, the one or more metadata symbols to which the entity name is mapped by the policy, wherein:

the policy code is executed on the target system to enforce the policy.

2. The system of claim 1 , wherein:

the at least one processor is further programmed to resolve a first metadata label into a binary representation, the first metadata label comprises at least one metadata symbol of the one or more metadata symbols;

the at least one processor is further programmed to resolve a second metadata label into the same binary representation, the second metadata label being syntactically different from the first metadata label; and

the binary representation of the first and second metadata labels is included in the policy code.

3. The system of claim 1 , wherein:

the at least one entity comprises a software entity;

the description of the at least one entity comprises an address range for code and/or data of the software entity; and

the one or more metadata symbols are associated with the at least one entity at least in part by annotating the code and/or the data of the software entity with at least one metadata symbol of the one or more metadata symbols.

4. The system of claim 1 , wherein:

the descriptions of the plurality of entities are organized into a plurality of modules.

5. The system of claim 4 , wherein:

the plurality of modules comprises at least one instruction set architecture (ISA) module corresponding to an instruction set architecture of the target system; and

the at least one ISA module comprises entity descriptions of a plurality of ISA entities associated with the instruction set architecture of the target system.

6. The system of claim 4 , wherein:

the plurality of modules comprises at least one system-on-chip (SOC) module corresponding to a hardware chip design of the target system; and

the at least one SOC module comprises entity descriptions of a plurality of SOC entities associated with the hardware chip design of the target system.

7. The system of claim 4 , wherein:

the plurality of modules comprises at least one operating system (OS) module corresponding to an operating system of the target system; and

the at least one OS module comprises entity descriptions of a plurality of OS entities associated with the operating system of the target system.

8. The system of claim 4 , wherein:

the plurality of modules comprises at least one user application module corresponding to at least one user application of the target system; and

the at least one user application module comprises entity descriptions of a plurality of user application entities associated with the at least one user application of the target system.

9. The system of claim 4 , wherein:

the plurality of modules comprises at least one class module;

the at least one class module comprises an entity description of at least one class entity; and

the at least one class entity corresponds to a class of hardware and/or software entities of the target system that satisfy one or more defining criteria of the class.

10. The system of claim 9 , wherein:

the at least one class entity corresponds to a class of hardware and/or software entities of the target system that are relevant for enforcing a selected policy.

11. The system of claim 9 , wherein:

the at least one processor is further programmed to elaborate the class entity into a plurality of constituent entities.

12. The system of claim 4 , wherein:

the plurality of modules comprises at least one transformation module;

the at least one transformation module comprises an entity description of at least one transformation entity; and

the at least one transformation entity corresponds to a transformation applied to software code to facilitate enforcement of one or more policies.

13. A method performed by a system comprising at least one processor, the method comprising acts of:

translating a policy into policy code, wherein:

the policy is provided in a policy language;

the policy code is in a programming language that is different from the policy language; and

the policy comprises a statement that maps an entity name to one or more metadata symbols;

searching a target description for at least one entity matching the entity name, wherein:

the target description comprises descriptions of a plurality of entities; and

each entity of the plurality of entities represents a respective component of a target system against which the policy is to be enforced; and

using a description of the at least one entity matching the entity name to associate, with the at least one entity, the one or more metadata symbols to which the entity name is mapped by the policy, wherein:

the policy code is executed on the target system to enforce the policy.

14. The method of claim 13 , further comprising:

programming the at least one processor to resolve a first metadata label into a binary representation, the first metadata label comprises at least one metadata symbol of the one or more metadata symbols;

programming the at least one processor to resolve a second metadata label into the same binary representation, the second metadata label being syntactically different from the first metadata label; and

wherein the binary representation of the first and second metadata labels is included in the policy code.

15. The method of claim 13 , wherein:

the at least one entity comprises a software entity;

the description of the at least one entity comprises an address range for code and/or data of the software entity; and

the one or more metadata symbols are associated with the at least one entity at least in part by annotating the code and/or the data of the software entity with at least one metadata symbol of the one or more metadata symbols.

16. The method of claim 13 , wherein:

the descriptions of the plurality of entities are organized into a plurality of modules.

17. The method of claim 16 , wherein:

the plurality of modules comprises at least one instruction set architecture (ISA) module corresponding to an instruction set architecture of the target system; and

the at least one ISA module comprises entity descriptions of a plurality of ISA entities associated with the instruction set architecture of the target system.

18. The method of claim 16 , wherein:

the plurality of modules comprises at least one system-on-chip (SOC) module corresponding to a hardware chip design of the target system; and

the at least one SOC module comprises entity descriptions of a plurality of SOC entities associated with the hardware chip design of the target system.

19. The method of claim 16 , wherein:

the plurality of modules comprises at least one operating system (OS) module corresponding to an operating system of the target system; and

the at least one OS module comprises entity descriptions of a plurality of OS entities associated with the operating system of the target system.

20. The method of claim 16 , wherein:

the plurality of modules comprises at least one user application module corresponding to at least one user application of the target system; and

the at least one user application module comprises entity descriptions of a plurality of user application entities associated with the at least one user application of the target system.

21. The method of claim 16 , wherein:

the plurality of modules comprises at least one class module;

the at least one class module comprises an entity description of at least one class entity; and

the at least one class entity corresponds to a class of hardware and/or software entities of the target system that satisfy one or more defining criteria of the class.

22. The method of claim 21 , wherein:

the at least one class entity corresponds to a class of hardware and/or software entities of the target system that are relevant for enforcing a selected policy.

23. The method of claim 21 , wherein:

the at least one processor is further programmed to elaborate the class entity into a plurality of constituent entities.

24. The method of claim 16 , wherein:

the plurality of modules comprises at least one transformation module;

the at least one transformation module comprises an entity description of at least one transformation entity; and

the at least one transformation entity corresponds to a transformation applied to software code to facilitate enforcement of one or more policies.

25. At least one non-transitory computer-readable medium having encoded thereon instructions which, when executed by at least one processor, cause the at least one processor to:

translate a policy into policy code, wherein:

the policy is provided in a policy language;

the policy code is in a programming language that is different from the policy language; and

the policy comprises a statement that maps an entity name to one or more metadata symbols;

search a target description for at least one entity matching the entity name, wherein:

the target description comprises descriptions of a plurality of entities; and

each entity of the plurality of entities represents a respective component of a target system against which the policy is to be enforced; and

use a description of the at least one entity matching the entity name to associate, with the at least one entity, the one or more metadata symbols to which the entity name is mapped by the policy, wherein:

the policy code is executed on the target system to enforce the policy.