System and method for translating mapping policy into code

Abstract

A system including at least one processor programmed to translate a policy into policy code, wherein: the policy is provided in a policy language; the policy code is in a programming language that is different from the policy language; and the policy includes a statement that maps an entity name to one or more metadata symbols to be associated with an entity in a target system against which the policy is to be enforced.

1 . A system comprising at least one processor programmed to:
 translate a policy into policy code, wherein:   the policy is provided in a policy language;   the policy code is in a programming language that is different from the policy language; and   the policy comprises a statement that maps an entity name to one or more metadata symbols to be associated with an entity in a target system against which the policy is to be enforced.   
     
     
         2 . The system of  claim 1 , wherein:
 the at least one processor is further programmed to resolve at least one metadata symbol of the one or more metadata symbols into a binary representation;   the binary representation of the at least one metadata symbol is included in the policy code.   
     
     
         3 . The system of  claim 1 , wherein:
 the at least one processor is further programmed to:   identify, from a target description describing the target system, an entity description describing the entity of the target system; and   use the entity description to associate the one or more metadata symbols with the entity of the target system.   
     
     
         4 . The system of  claim 3 , wherein:
 the target description comprises a plurality of entity descriptions organized into a plurality of modules.   
     
     
         5 . The system of  claim 4 , wherein:
 the plurality of modules comprises at least one instruction set architecture (ISA) module corresponding to an instruction set architecture of the target system; and   the at least one ISA module comprises entity descriptions of a plurality of ISA entities associated with the instruction set architecture of the target system.   
     
     
         6 . The system of  claim 4 , wherein:
 the plurality of modules comprises at least one system-on-chip (SOC) module corresponding to a hardware chip design of the target system; and   the at least one SOC module comprises entity descriptions of a plurality of SOC entities associated with the hardware chip design of the target system.   
     
     
         7 . The system of  claim 4 , wherein:
 the plurality of modules comprises at least one operating system (OS) module corresponding to an operating system of the target system; and   the at least one OS module comprises entity descriptions of a plurality of OS entities associated with the operating system of the target system.   
     
     
         8 . The system of  claim 4 , wherein:
 the plurality of modules comprises at least one user application module corresponding to at least one user application of the target system; and   the at least one user application module comprises entity descriptions of a plurality of user application entities associated with the at least one user application of the target system.   
     
     
         9 . The system of  claim 4 , wherein:
 the plurality of modules comprises at least one class module;   the at least one class module comprises an entity description of at least one class entity; and   the at least one class entity corresponds to a class of hardware and/or software entities of the target system that satisfy one or more defining criteria of the class.   
     
     
         10 . The system of  claim 9 , wherein:
 the at least one class entity corresponds to a class of hardware and/or software entities of the target system that are relevant for enforcing a selected policy.   
     
     
         11 . The system of  claim 9 , wherein:
 the at least one processor is further programmed to elaborate the class entity into a plurality of constituent entities.   
     
     
         12 . The system of  claim 4 , wherein:
 the plurality of modules comprises at least one transformation module;   the at least one transformation module comprises an entity description of at least one transformation entity; and   the at least one transformation entity corresponds to a transformation applied to software code to facilitate enforcement of one or more policies.   
     
     
         13 . The system of  claim 1 , wherein:
 the entity name has a structure according to a hierarchical namespace; and   the at least one processor is programmed to use the structure to map the entity name to the one or more metadata symbols.   
     
     
         14 .- 23 . (canceled) 
     
     
         24 . The system of  claim 1 , wherein the at least one processor is further programmed to:
 load a first value from a memory, wherein the first value is associated with at least one first primitive metadata label;   load a second value from the memory, wherein the second value is associated at least one second primitive metadata label; and   combine the at least one first primitive metadata label and the at least one second primitive metadata label into a composite metadata label, at least in part by performing an operation on the first value and the second value.   
     
     
         25 . The system of  claim 24 , wherein:
 the at least one processor is further programmed to allocate a region of the memory for use in creating composite metadata labels; and   the first and second values are loaded from the region of the memory.   
     
     
         26 . (canceled) 
     
     
         27 . The system of  claim 24  further comprising policy enforcement hardware, wherein:
 the operation performed on the first value and the second value causes the policy enforcement hardware to evaluate one or more rules; and 
 evaluation of the one or more rules causes the policy enforcement hardware to combine the at least one first primitive metadata label and the at least one second primitive metadata label into the composite metadata label. 
 
     
     
         28 . The system of  claim 27 , wherein:
 loading the first value causes the policy enforcement hardware to read the first primitive metadata label from a first metadata memory location associated with a first memory location from which the first value is loaded; and   loading the second value causes the policy enforcement hardware to read the second primitive metadata label from a second metadata memory location associated with a second memory location from which the second value is loaded.   
     
     
         29 . The system of  claim 24 , wherein:
 the operation performed on the first value and the second value results in a third value; and   the third value is associated with the composite metadata label.   
     
     
         30 . (canceled) 
     
     
         31 . The system of  claim 29 , wherein:
 the operation performed on the first value and the second value comprises a first operation;   the at least one processor is further programmed to:   load a fourth value from the memory; and   tag the fourth value with the composite metadata label, at least in part by performing a second operation on the third value and the fourth value.   
     
     
         32 .- 33 . (canceled) 
     
     
         34 . A method performed by a system comprising at least one processor, the method comprising an act of:
 translating a policy into policy code, wherein:   the policy is provided in a policy language;   the policy code is in a programming language that is different from the policy language; and   the policy comprises a statement that maps an entity name to one or more metadata symbols to be associated with an entity in a target system against which the policy is to be enforced.   
     
     
         35 . At least one computer-readable medium having encoded thereon instructions which, when executed by at least one processor, cause the at least one processor to:
 translate a policy into policy code, wherein:   the policy is provided in a policy language;   the policy code is in a programming language that is different from the policy language; and   the policy comprises a statement that maps an entity name to one or more metadata symbols to be associated with an entity in a target system against which the policy is to be enforced.\