Apparatus and method for security policy management

1. An apparatus for security policy management, comprising a processor configured to:

generate a rule set by converting predefined access policy security rules acquired from one or more systems into a document in a standard format;

extract a network topology from a network diagram concerning the one or more systems; and

generate a standard policy for plural systems by adding up unions of the generated rule set, each of the unions being applied to each of the plural systems, and the extracted network topology,

wherein the standard policy is represented as follows:

P

i

=

∑

j

=

1

k

⁢

R

i

,

j

⋃

T

i

,

wherein R i,j is a security rule one system, T i the network topology, and P i is the standard policy,

wherein when a new system (n+1) is added to the one system, the processor is further configured to perform a first consistency verification process which is represented as follows:

R

n

+

1

⋐

∑

j

=

1

k

⁢

R

i

,

j

⋃

T

i

,

wherein R n+1 is a security rule of the new system,

wherein, when the one system is changed to another system, the processor performs a second consistency verification process which is represented as follows:

R

n

′

⋐

∑

j

=

1

k

⁢

R

i

,

j

⋃

T

i

,

wherein R n ′ is a security rule of the changed system,

wherein the processor is further configured to determine whether the security rule of the new system or the security rule of the changed system is included as a part of the standard policy,

wherein the processor automatically collects security rules from the one or more systems and integrates the collected security rules in the standard format to accurately analyze conflicts between network access policies and errors in the network access policies, and

wherein the processor is further configured to generate the rule set by converting the acquired access policy security rules into an XML format by adding a verified standard policy file in a lowermost part of the acquired access policy security rules for each of one or more systems and to store the converted rules.

2. The apparatus of claim 1 , wherein the security rules have types corresponding to one or more of an access control server system, a configuration of a PC, and a document file.

3. The apparatus of claim 1 , wherein the processor is further configured to extract the network topology in the XML format and to store the extracted network topology.

4. The apparatus of claim 3 , wherein the network topology includes a kind and a configuration of multiple electric power devices existing at a site and information about a network between the multiple electric power devices.

5. The apparatus of claim 1 , wherein the processor is further configured to generate the standard policy in the XML format and to store the generated standard policy.

6. The apparatus of claim 1 , wherein the processor is further configured to revise the standard policy by defining the security rule of the new system or the security rule of the changed system as an exception to the standard policy when it is determined that the security rule of the new system or the security rule of the changed system is incapable of being included as a part of the standard policy.

7. The apparatus of claim 1 , wherein:

when it is determined that the security rule of the new system or the security rule of the changed system is incapable of being included as a part of the standard policy, the processor is further configured to mark a section that is incapable of being included as a part of the standard policy in the security rule of the new system or in the security rule of the changed system and then provides the security rule to an administrator.

8. The apparatus of claim 1 , wherein the processor is further configured to transfer the standard policy to one or more systems when it is determined that the security rule of the new system or the security rule of the changed system is capable of being included as a part of the standard policy.

9. A method for security policy management, comprising:

generating, by a processor, a rule set by converting predefined access policy security rules acquired from one or more systems into a document in a standard format;

extracting, by the processor, a network topology from a network diagram concerning the one or more systems; and

generating, by the processor, a standard policy for plural systems by adding up unions of the generated rule set, each of the unions being applied to each of the plural systems, and the extracted network topology,

wherein the standard policy is represented as follows:

P

i

=

∑

j

=

1

k

⁢

R

i

,

j

⋃

T

i

,

wherein R i,j is a security rule one system, T i the network topology, and P i is the standard policy,

wherein when a new system (n+1) is added to the one system, the processor is further configured to perform a first consistency verification process which is represented as follows:

R

n

+

1

⋐

∑

j

=

1

k

⁢

R

i

,

j

⋃

T

i

,

wherein R n+1 is a security rule of the new system,

wherein, when the one system is changed to another system, the processor performs a second consistency verification process which is represented as follows:

R

n

′

⋐

∑

j

=

1

k

⁢

R

i

,

j

⋃

T

i

,

wherein R n ′ is a security rule of the changed system,

wherein the processor is further configured to determine whether the security rule of the new system or the security rule of the changed system is included as a part of the standard policy, and

wherein the processor automatically collects security rules from the one or more systems and integrates the collected security rules in the standard format to accurately analyze conflicts between network access policies and errors in the network access policies,

wherein the generating of the rule set is configured to generate the rule set by converting the acquired access policy security rules into an XML format by adding a verified standard policy file in a lowermost part of the acquired access policy security rules for each of one or more systems and to store the converted rules.

10. The method of claim 9 , wherein the security rules have types corresponding to one or more of an access control server system, a configuration of a PC, and a document file.

11. The method of claim 9 , wherein the extracting of the network topology is configured to extract the network topology in the XML format and to store the extracted network topology.

12. The method of claim 11 , wherein the network topology includes a kind and a configuration of multiple electric power devices existing at a site and information about a network between the multiple electric power devices.

13. The method of claim 9 , wherein the generating of the standard policy is configured to generate the standard policy in the XML format and to store the generated standard policy.

14. The method of claim 9 , further comprising:

if it is determined in the checking of the consistency that the security rule of the new system or the security rule of the changed system is incapable of being included as a part of the standard policy,

revising, by the processor, the standard policy by defining the security rule of the new system or the security rule of the changed system as an exception to the standard policy.

15. The method of claim 9 , further comprising:

if it is determined in the checking of the consistency that the security rule of the new system or the security rule of the changed system is incapable of being included as a part of the standard policy,

marking, by the processor, a section that is incapable of being included as a part of the standard policy in the security rule of the new system or in the security rule of the changed system and then providing the security rule to an administrator.

16. The method of claim 9 , further comprising:

if it is determined in the checking of the consistency that the security rule of the new system or the security rule of the changed system is capable of being included as a part of the standard policy,

transferring, by the processor, the standard policy to the one or more systems.