Automated and adaptive model-driven security system and method for operating the same

1. A method of managing implementation of policies in an information technologies system, the method comprising:

receiving into a processor at least one policy function stored in at least one memory;

receiving into the processor at least one refinement template from the at least one memory; and

receiving into the processor at least one output policy function from the at least one memory,

receiving into the processor a policy input indicating a high-level policy for the IT system, the policy input being compliant with the at least one policy function;

based on the received policy input, automatically or semi-automatically generating via the processor a rule and/or configuration by:

replacing at least one policy function in the policy input with the at received least one policy function, the generated rule and/or configuration being compliant with the received policy input; or

replacing at least one value or value placeholder in the policy input with a corresponding value;

distributing, via the processor, the rule and/or configuration to the at least one memory of the IT system or another at least one memory to thereby enable implementation of the policies;

wherein the rule and/or configuration includes the at least one output policy function.

2. The method of claim 1 , further comprising:

calculating automatically or semi-automatically, based on the received at least one policy function, a refinement chain by determining a matching of a policy function input and policy function output combination based on the at least one refinement template,

wherein the refinement chain maps between at least one policy function and at least one other policy function and forms at least one path for selection as refinement, and

wherein the generated rule and/or configuration is generated by using the calculated refinement chain during the generation.

3. The method of claim 1 , further comprising:

calculating automatically or semi-automatically, based on the received at least one policy function, a refinement chain by determining a matching of a policy function input and policy function output combination based on the at least one refinement template; and

if one or more refinement chains exist, storing information in the at least one memory about at least one refined policy function being part of the at least refinement chain and/or about how to refine the policy function,

wherein the refinement chain maps between at least one policy function input and at least one policy function output and forms at least one path for selection as refinement.

4. The method of claim 1 , wherein the at least one policy function relates to non-functional system characteristics for the IT system, the non-functional system characteristics including security, compliance, Quality of Service, and/or assurance.

5. The method of claim 1 , wherein the at least one refinement template defines how to map between at least one input policy function and at least one output policy function or defines at least one refinement of at least one input policy function to at least one output policy function in a one-to-one, one-to-many, many-to-one, or many-to-many relationship.

6. The method of claim 1 , wherein the at least one refinement template is stacked into multi-step refinement chains if inputs and outputs of the at least one refinement template match inputs and outputs of the multi-step refinement chains.

7. The method of claim 1 , wherein generating the rule and/or configuration includes filling in a reference to a policy function implementation or filling in at least one output value provided by a policy function implementation.

8. The method of claim 1 , wherein the generated rule and/or configuration is selectively distributed only to the at least one memory of the IT system or the another at least one memory where the generated rule and/or configuration is actually processed.

9. The method of claim 1 , wherein the policy input is received into the processor in a format that is not machine-enforceable at an enforcement entity of the IT system.

10. An information technologies (IT) policy management system, comprising:

at least one memory that stores at least one policy function; and

a processor that is configured to:

receive at least one refinement template from the at least one memory;

receive at least one output policy function from the at least one memory;

receive the at least one policy function, the at least one refinement template, and the at least one output policy function from the at least one memory;

receive a policy input indicating a high-level policy for the IT system, the policy input being compliant with the at least one policy function;

based on the received policy input, automatically or semi-automatically generates a rule and/or configuration by:

replacing at least one policy function in the policy input with the at received least one policy function, the generated rule and/or configuration being compliant with the received policy input; or

replacing at least one value or value placeholder in the policy input with a corresponding value; and

distributes the rule and/or configuration to the at least one memory of the IT system or another at least one memory to thereby enable implementation of the policies, wherein

the rule and/or configuration includes the at least one output policy function.

11. The system of claim 10 , wherein

the processor is further configured to calculate automatically or semi-automatically, based on the received at least one policy function, a refinement chain by determining a matching of a policy function input and policy function output combination based on the at least one refinement template,

the refinement chain maps between at least one policy function and at least one other policy function and forms at least one path for selection as refinement, and

the generated rule and/or configuration is generated by using the calculated refinement chain during the generation.

12. The system of claim 10 , wherein

the processor is further configured to calculate automatically or semi-automatically, based on the received at least one policy function, a refinement chain by determining a matching of a policy function input and policy function output combination based on the at least one refinement template; and

if one or more refinement chains exist, storing information in the at least one memory about at least one refined policy function being part of the at least refinement chain and/or about how to refine the policy function,

wherein the refinement chain maps between at least one policy function input and at least one policy function output and forms at least one path for selection as refinement.

13. The system of claim 10 , wherein the at least one policy function relates to non-functional system characteristics for the IT system, the non-functional system characteristics including security, compliance, Quality of Service, and/or assurance.

14. The system of claim 10 , wherein the at least one refinement template defines how to map between at least one input policy function and at least one output policy function or defines at least one refinement of at least one input policy function to at least one output policy function in a one-to-one, one-to-many, many-to-one, or many-to-many relationship.

15. The system of claim 10 , wherein the at least one refinement template is stacked into multi-step refinement chains if inputs and outputs of the at least one refinement template match inputs and outputs of the multi-step refinement chains.

16. The system of claim 10 , wherein generating the rule and/or configuration includes filling in a reference to a policy function implementation or filling in at least one output value provided by a policy function implementation.

17. The system of claim 10 , wherein the generated rule and/or configuration is selectively distributed only to the at least one memory of the IT system or the another at least one memory where the generated rule and/or configuration is actually processed.

18. The system of claim 10 , wherein the policy input is received into the processor in a format that is not machine-enforceable at an enforcement entity of the IT system.