Method to automatically map business function level policies to it management policies
View Patent ↗A method, system, computer program product, and computer program storage device for transforming a high-level policy associated with a high layer to a low-level policy associated with a low layer. Mapping between high-level objects in a high layer and low-level objects in a low layer is derived by an automated discovery tool. The high-level policy is mapped to the low-level policy according to the mapping (e.g., by substituting the high-level objects with the low-level objects and by performing a syntax transformation). In one embodiment, a low-level policy is transformed to a high-level policy according to the mapping. As exemplary embodiments, policy transformations in traffic shaping and data retention are disclosed.
1. A computer-implemented method for classifying network traffic comprising:
finding a list of pairs ((a 1 , p 1 ), . . . , (a n , p n )) as a high-level policy, where a i is an application name and a corresponding p i is a priority of the application a i ;
mapping the application a i to an IP address and a port number by finding a list of triples ((IPa 1 , pa 1 , in 1 ), . . . , (IPa n , pa, in n )) of low-level objects, where IPa i is a range of IP address associated with the application a i , pa i is a range of port numbers associated with the application a i , and in i is an indicator associated with the application a i ; and
obtaining a low-level policy as (((IPa 1 , pa 1 , in 1 ), p 1 ), . . . , ((IPa n , pa, in n ), p n )) from the mapping and the high-level policy, where IPa i is a range of IP address associated with the application a i , pa i is a range of port numbers associated with the application a i , in i is an indicator associated with the application a i , and p i is a priority of the application a i ,
wherein a computing system including a processor and a memory device connected to the processor performs the finding the list of pairs ((a 1 , p 1 ), . . . , (a n , p n )), the mapping and the obtaining.
2. The computer-implemented method according to claim 1 , further comprising:
finding a multi-tier dependency in a middle-level objects through which the application a i are transmitted from a business layer to an IT (Information Technology) layer, the multi-tier dependency being expressed by a set {m 1 , m 2 , m 3 , . . . , m k }, where m i indicating a middle-level object between the business layer and the IT layer;
constructing a mapping from the high-level policy to a low-level policy by combining the multi-tier dependency and the list of pairs of low-level objects as M(a i )={(IPm 1 , pm i , inm 1 ), (IPm 2 , pm 2 , inm 2 ), (IPm 3 , pm 3 , inm 3 ), . . . , (IPm k , pm k , inm k )}, where M(a i ) indicating mapping associated with the application a i from the high-level policy to the low-level policy, IPm 1 indicating a range of IP address at a middle-level object m 1 , pm 1 indicating a range of port numbers at a middle-level object m 1 , inm 1 indicating an indicator at a middle-level object m 1 , IPm 2 indicating a range of IP address at a middle-level object m 2 , pm 2 indicating a range of port numbers at a middle-level object m 2 , inm 2 indicating an indicator at a middle-level object m 2 , IPm 3 indicating a range of IP address at a middle-level object m 3 , pm 3 indicating a range of port numbers at a middle-level object m 3 , inm 3 indicating an indicator at a middle-level object m 3 , IPm k indicating a range of IP address at a middle-level object m k , an pm k indicating a range of port numbers at a middle-level object m k , inm k indicating an indicator at a middle-level object m n ; and
deriving the low-level policy from the mapping M(a i ) and the high-level policy, the low-level policy stating ((M(a 1 ), p 1 ), . . . , (M(a n ), a n )), where M(a 1 ) indicating mapping associated with the application a 1 , p 1 is a priority of the application a 1 , M(a n ) indicating mapping associated with the application a n , and p n is a priority of the application a n ,
wherein a computing system including a processor and a memory device connected to the processor performs the finding the multi-tier dependency, the constructing the mapping, and the deriving.
3. A computer-implemented system for classifying network traffic comprising:
a computing system including at least one processor and at least one memory device connected to the at least one processor,
wherein the computing system is configured to:
find a list of pairs ((a 1 , p 1 ), . . . , (a n , p n )) as a high-level policy, where a i is an application name and a corresponding p i is a priority of the application a i ;
map the application a i to an IP address and a port number by finding a list of triples ((IPa 1 , pa 1 , in 1 ), . . . , (IPa n , pa n , in n )) of low-level objects, where IPa 1 is a range of IP address associated with the application a i , pa i is a range of port numbers associated with the application a i , in i is an indicator associated with the application a i ; and
obtain a low-level policy as (((IPa 1 , pa 1 , in 1 ), p 1 ), . . . , (IPa n , pa, in n ), p n )) from the mapping and the high-level policy, where IPa i is a range of IP address associated with the application a i , pa i is a range of port numbers associated with the application a i , in i is an indicator associated with the application a i , and p i is a priority of the application a i .
4. The computer-implemented system according to claim 3 , wherein the computing system is further configured to:
find a multi-tier dependency in a middle-level objects through which the application a i are transmitted from a business layer to an IT (Information Technology) layer, the multi-tier dependency being expressed by a set {m 1 , m 2 , m 3 , . . . , m k }, where m i indicating a middle-level object between the business layer and the IT layer;
construct a mapping from the high-level policy to a low-level policy by combining the multi-tier dependency and the list of pairs of low-level objects as M(a i )={(IPm 1 , pm i , inm 1 ), (IPm 2 , pm 2 , inm 2 ), (IPm 3 , pm 3 , inm 3 ), . . . , (IPm k , pm k , inm k )}, where M(a i ) indicating mapping associated with the application a i from the high-level policy to the low-level policy, IPm 1 indicating a range of IP address at a middle-level object m 1 , pm 1 indicating a range of port numbers at a middle-level object m 1 , inm 1 indicating an indicator at a middle-level object m 1 , IPm 2 indicating a range of IP address at a middle-level object m 2 , pm 2 indicating a range of port numbers at a middle-level object m 2 , inm 2 indicating an indicator at a middle-level object m 2 , IPm 3 indicating a range of IP address at a middle-level object m 3 , pm 3 indicating a range of port numbers at a middle-level object m 3 , inm 3 indicating an indicator at a middle-level object m 3 , IPm k indicating a range of IP address at a middle-level object m k , an pm k indicating a range of port numbers at a middle-level object m k , inm k indicating an indicator at a middle-level object m n ; and
derive the low-level policy from the mapping M(a i ) and the high-level policy, the low-level policy stating ((M(a 1 ), p 1 ), (M(a n ), p n )), where M(a 1 ) indicating mapping associated with the application a 1 , p 1 is a priority of the application a 1 , M(a n ) indicating mapping associated with the application a n , and p n is a priority of the application a n .
5. A computer program product comprising a non-transitory computer usable medium having computer readable program code means embodied therein for classifying network traffic, the computer program code means in said computer program product comprising computer readable program code means for causing a computer to effect steps of:
finding a list of pairs ((a 1 , p 1 ), . . . , (a n , p n )) as a high-level policy, where a i is an application name and a corresponding p i is a priority of the application a i ;
mapping the application a i to an IP address and a port number by finding a list of triples ((IPa 1 , pa 1 ,in 1 ), . . . , (IPa n , pa, in n )) of low-level objects, where IPa i is a range of IP address associated with the application a i , pa i is a range of port numbers associated with the application a i , and in i is an indicator associated with the application a i ; and
obtaining a low-level policy as (((IPa 1 , pa 1 , in 1 ), p 1 ), . . . , ((IPa n , pa, in n ), p n )) from the mapping and the high-level policy, where IPa i is a range of IP address associated with the application a i , pa i is a range of port numbers associated with the application a i , in i is an indicator associated with the application a i , and p i is a priority of the application a i .
6. The computer program product according to claim 5 , wherein the steps further comprise:
finding a multi-tier dependency in a middle-level objects through which the application a i are transmitted from a business layer to an IT (Information Technology) layer, the multi-tier dependency being expressed by a set {m 1 , m 2 , m 3 , . . . , m k }, where m i indicating a middle-level object between the business layer and the IT layer;
constructing a mapping from the high-level policy to a low-level policy by combining the multi-tier dependency and the list of pairs of low-level objects as M(a i )={(IPm 1 , pm i , inm 1 ), (IPm 2 , pm 2 , inm 2 ), (IPm 3 , pm 3 , inm 3 ), . . . , (IPm k , pm k , inm k )}, where M(a i ) indicating mapping associated with the application a i from the high-level policy to the low-level policy, IPm 1 indicating a range of IP address at a middle-level object m 1 , pm 1 indicating a range of port numbers at a middle-level object m 1 , inm 1 indicating an indicator at a middle-level object m 1 , IPm 2 indicating a range of IP address at a middle-level object m 2 , pm 2 indicating a range of port numbers at a middle-level object m 2 , inm 2 indicating an indicator at a middle-level object m 2 , IPm 3 indicating a range of IP address at a middle-level object m 3 , pm 3 indicating a range of port numbers at a middle-level object m 3 , inm 3 indicating an indicator at a middle-level object m 3 , IPm k indicating a range of IP address at a middle-level object m k , an pm k indicating a range of port numbers at a middle-level object m k , inm k indicating an indicator at a middle-level object m n ; and
deriving the low-level policy from the mapping M(a i ) and the high-level policy, the low-level policy stating ((M(a 1 ), p 1 ), . . . , (M(a n ), p n )), where M(a 1 ) indicating mapping associated with the application a 1 , p 1 is a priority of the application a 1 , M(a n ) indicating mapping associated with the application a n , and p n is a priority of the application a n .