Systems for secure policies-based information governance using a policy enforcement point (PEP)
The disclosure is directed to systems and methods for secure policies-based information governance. In various embodiments exemplary methods include displaying a Graphical User Interface (GUI), the graphical user interface receiving a business rule input from a business user; receiving a policy from a policy engine based on the business rule input, the policy engine generating a policy hierarchy; and defining a plurality of domain objects and a plurality of domain object representations in the Graphical User Interface (GUI) based on the policy and the policy hierarchy. Furthermore, exemplary methods include defining an extensible hierarchical domain model definition using the policy hierarchy, the extensible hierarchical domain model definition being modified using the plurality of domain object representations in the Graphical User Interface (GUI); and defining a Policy Enforcement Point (PEP) in an application based on the extensible hierarchical domain model definition.
1. A method for secure policies-based information governance, the method comprising:
displaying a Graphical User Interface (GUI), the graphical user interface receiving a business rule input from a business user;
receiving a policy from a policy engine based on the business rule input and at least one guardrail policy comprising a rule for overriding the business rule input by having a level of precedence higher than the business rule input, the policy engine generating a policy hierarchy that allows override operations on business rules using the at least one guardrail policy;
defining a plurality of domain objects and a plurality of domain object representations in the Graphical User Interface (GUI) using the policy, the at least one guardrail policy, and the policy hierarchy;
defining an extensible hierarchical domain model definition using the policy hierarchy, the extensible hierarchical domain model definition being modified using the plurality of domain object representations in the Graphical User Interface (GUI);
defining a Policy Enforcement Point (PEP) in an application based on the extensible hierarchical domain model definition;
providing a mapping from the Policy Enforcement Point (PEP) in the application to the plurality of domain object representations in the Graphical User Interface (GUI); and
receiving, by the Policy Enforcement Point (PEP), a user request to access a resource on the application, the user request comprising attributes of the user.
2. The method as recited in claim 1 , further comprising:
sending, by the Policy Enforcement Point (PEP), the user request to access the resource on the application to a Policy Decision Point (PDP); and
evaluating, by the Policy Decision Point (PDP), the user request to access the resource on the application, the evaluating using the extensible hierarchical domain model definition; the evaluating, by the Policy Decision Point (PDP), the user request to access the resource further comprising:
sending, by the Policy Decision Point (PDP), an attribute evaluation request regarding the attributes of the user to a Policy Information Point (PIP);
evaluating, using the Policy Information Point (PIP), the attributes of the user, the evaluating using the extensible hierarchical domain model definition;
replying, by the Policy Information Point (PIP), to the attribute evaluation request based on the evaluating, using the Policy Information Point (PIP), of the attributes of the user;
generating, by a Policy Decision Point (PDP), a decision regarding the user request to access the resource on the application based on the evaluating; and
enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource on the application.
3. The method as recited in claim 2 , wherein the evaluating, using the Policy Information Point (PIP), the attributes of the user comprises using at least one of a decision model template, a decision table template, and a domain.
4. The method as recited in claim 3 , wherein the evaluating, using the Policy Information Point (PIP), the attributes of the user comprises using the decision table template, the decision table template comprising:
information for presenting the decision table template to the business user using the Graphical User Interface (GUI);
attributes of the plurality of domain objects; and
formatting of the attributes of the plurality of domain objects for displaying on the Graphical User Interface (GUI).
5. The method as recited in claim 2 , further comprising generating a custom domain model;
wherein the evaluating, using the Policy Information Point (PIP), the attributes of the user comprises using the custom domain model.
6. The method as recited in claim 2 ,
wherein the decision regarding the user request to access the resource on the application is to deny access to the resource based on the policy;
wherein the enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource is denying access to the resource on the application.
7. The method as recited in claim 2 ,
wherein the decision regarding the user request to access the resource on the application is to grant access to the resource based on the policy;
wherein the enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource on the application is granting access to the resource on the application.
8. The method as recited in claim 1 , wherein the graphical user interface further comprises a policy designer screen for the business user, the policy designer screen receiving a disable policy enforcement point input, the disable policy enforcement point input disabling the Policy Enforcement Point (PEP) preventing the Policy Enforcement Point (PEP) from enforcing the policy.
9. The method as recited in claim 1 , wherein the graphical user interface further comprises a policy designer screen for the business user, the policy designer screen receiving an enable policy enforcement point input, the enable policy enforcement point input enabling the Policy Enforcement Point (PEP) allowing the Policy Enforcement Point (PEP) to enforce the policy.
10. A system for secure policies-based information governance, the system comprising:
a Graphical User Interface (GUI), the graphical user interface receiving a business rule input from a business user;
a policy engine generating a policy based on the business rule input and at least one guardrail policy comprising a rule for overriding the business rule input by having a level of precedence higher than the business rule input, the policy engine generating a policy hierarchy that allows override operations on business rules using the at least one guardrail policy;
at least one processor; and
a memory storing processor-executable instructions, wherein the at least one processor is configured to implement the following operations upon executing the processor-executable instructions:
defining a plurality of domain objects and a plurality of domain object representations in the Graphical User Interface (GUI) using the policy, the at least one guardrail policy, and the policy hierarchy;
defining an extensible hierarchical domain model definition using the policy hierarchy, the extensible hierarchical domain model definition being modified using the plurality of domain object representations in the Graphical User Interface (GUI);
defining a Policy Enforcement Point (PEP) in an application based on the extensible hierarchical domain model definition;
providing a mapping from the Policy Enforcement Point (PEP) in the application to the plurality of domain object representations in the Graphical User Interface (GUI); and
receiving, by the Policy Enforcement Point (PEP), a user request to access a resource on the application, the user request comprising attributes of the user.
11. The system as recited in claim 10 , wherein the at least one processor is further configured to implement the following operations upon executing the processor-executable instructions:
sending, by the Policy Enforcement Point (PEP), the user request to access the resource on the application to a Policy Decision Point (PDP); and
evaluating, by the Policy Decision Point (PDP), the user request to access the resource on the application, the evaluating using the extensible hierarchical domain model definition;
wherein the evaluating, by the Policy Decision Point (PDP), the user request to access the resource further comprises:
sending, by the Policy Decision Point (PDP), an attribute evaluation request regarding the attributes of the user to a Policy Information Point (PIP);
evaluating, using the Policy Information Point (PIP), the attributes of the user, the evaluating using the extensible hierarchical domain model definition; and
replying, by the Policy Information Point (PIP), to the attribute evaluation request based on the evaluating, using the Policy Information Point (PIP), of the attributes of the user; and
generating, by a Policy Decision Point (PDP), a decision regarding the user request to access the resource on the application based on the evaluating;
wherein the at least one processor is further configured to implement the following operations upon executing the processor-executable instructions:
enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource on the application.
12. The system as recited in claim 11 , wherein the evaluating, using the Policy Information Point (PIP), the attributes of the user comprises using at least one of a decision model template, a decision table template, and a domain.
13. The system as recited in claim 12 , wherein the evaluating, using the Policy Information Point (PIP), the attributes of the user comprises using the decision table template, the decision table template comprising:
information for presenting the decision table template to the business user using the Graphical User Interface (GUI);
attributes of the plurality of domain objects; and
formatting of the attributes of the plurality of domain objects for displaying on the Graphical User Interface (GUI).
14. The system as recited in claim 11 , wherein the at least one processor is further configured to implement the following operations upon executing the processor-executable instructions:
comprising generating a custom domain model;
wherein the evaluating, using the Policy Information Point (PIP), the attributes of the user comprises using the custom domain model.
15. The system as recited in claim 11 , wherein the decision regarding the user request to access the resource on the application is to deny access to the resource based on the policy;
wherein the enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource is denying access to the resource on the application.
16. The system as recited in claim 11 , wherein the decision regarding the user request to access the resource on the application is to grant access to the resource based on the policy;
wherein the enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource on the application is granting access to the resource on the application.
17. The system as recited in claim 10 , wherein the graphical user interface further comprises a policy designer screen for the business user, the policy designer screen receiving a disable policy enforcement point input, the disable policy enforcement point input disabling the Policy Enforcement Point (PEP) preventing the Policy Enforcement Point (PEP) from enforcing the policy.
18. The system as recited in claim 10 , wherein the graphical user interface further comprises a policy designer screen for the business user, the policy designer screen receiving an enable policy enforcement point input, the enable policy enforcement point input enabling the Policy Enforcement Point (PEP) allowing the Policy Enforcement Point (PEP) to enforce the policy.
19. A non-transitory computer readable medium having embodied thereon instructions being executable by at least one processor to perform operations for secure policies-based information governance, the operations comprising:
displaying a Graphical User Interface (GUI), the graphical user interface receiving a business rule input from a business user;
receiving a policy from a policy engine based on the business rule input and at least one guardrail policy comprising a rule for overriding the business rule input by having a level of precedence higher than the business rule input, the policy engine generating a policy hierarchy that allows override operations on business rules using the at least one guardrail policy;
defining a plurality of domain objects and a plurality of domain object representations in the Graphical User Interface (GUI) using the policy, the at least one guardrail policy, and the policy hierarchy;
defining an extensible hierarchical domain model definition using the policy hierarchy, the extensible hierarchical domain model definition being modified using the plurality of domain object representations in the Graphical User Interface (GUI);
defining a Policy Enforcement Point (PEP) in an application based on the extensible hierarchical domain model definition;
providing a mapping from the Policy Enforcement Point (PEP) in the application to the plurality of domain object representations in the Graphical User Interface (GUI); and
receiving, by the Policy Enforcement Point (PEP), a user request to access a resource on the application, the user request comprising attributes of the user.
20. The non-transitory computer readable medium of claim 19 , wherein the operations further comprise:
sending, by the Policy Enforcement Point (PEP), the user request to access the resource on the application to a Policy Decision Point (PDP); and
evaluating, by the Policy Decision Point (PDP), the user request to access the resource on the application, the evaluating using the extensible hierarchical domain model definition;
generating, by the Policy Decision Point (PDP), a decision regarding the user request to access the resource on the application based on the evaluating; and
enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource on the application;
wherein the decision regarding the user request to access the resource on the application is to deny access to the resource based on the policy;
wherein the enforcing, by the Policy Enforcement Point (PEP), the decision regarding the user request to access the resource is denying access to the resource on the application.