Policy management in an interoperability network

• US 20050080914A1
• Filed: 06/01/2004
• Published: 04/14/2005
• Est. Priority Date: 10/14/2003
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: GrandCentral Communications Incorporated (Alphabet Inc.)
• Inventors: Lerner, Alexander, Dewey, Michael K.
• Granted Patent: US 8,453,196 B2
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Methods and apparatus are described for facilitating communication among a plurality of entities via an interoperability network. Each entity has policy data corresponding thereto governing interaction with the entity via the interoperability network. A message is transmitted from a first one of the entities to a second one of the entities. The first entity has first policy data corresponding thereto and the second entity has second policy data corresponding thereto. The transmitted message was handled in the network according to combined policy data representing a combination of the first and second policy data.

Claims

1. An interoperability network for facilitating communication among a plurality of entities, each entity having policy data corresponding thereto governing interaction with the entity via the interoperability network, the network comprising:

at least one data store having the policy data for all of the entities stored therein;

at least one computing device which is operable to handle a message in the network with reference to first policy data corresponding to a first one of the entities to which the message relates, the at least one computing device further being operable to combine the first policy data with second policy data corresponding to a second one of the entities to which the message relates thereby resulting in first combined policy data, the at least one computing device further being operable to handle the message in the network with reference to the first combined policy data.

2. The network of claim 1 wherein the at least one computing device is further operable to associate the first policy data and the first combined policy data with the message such that the first policy data and the first combined policy data are transmitted with the message in the network.

3. The network of claim 2 wherein the at least one computing device comprises a plurality of components, each of the components being configured to handle the message with reference to only a portion of the first policy data or the first combined policy data, handling of the message with reference to all of the first policy data or first combined policy data being thereby distributed among the components.

4. The network of claim 1 wherein the at least one computing device is further operable to determine that the message relates to the second entity and combine the first and second policy data in response thereto.

5. The network of claim 1 wherein the first and second policy data correspond to first and second policy trees, respectively, the at least one computing device further being operable to combine the first and second policy data by logically combining the first and second policy trees.

6. The network of claim 1 wherein the at least one computing device is further operable to detect a run-time policy violation of the combined policy data.

7. The network of claim 6 wherein the at least one computing device is further operable to generate a policy violation message corresponding to the policy violation, and to transmit the policy violation message to either or both of the first and second entities.

8. The network of claim 6 wherein the at least one computing device is further operable to reject the message upon detecting the policy violation.

9. The network of claim 6 wherein the at least one computing device is further operable to forward the message to a web site associated with one of the first and second entities upon detecting the policy violation.

10. The network of claim 1 wherein the at least one computing device is further operable to store policy audit data for any of the entities associated with the network, the policy audit data comprising information relating to compliance of any of the entities with any of the policy data.

11. The network of claim 10 wherein the at least one computing device is further operable to generate reports using the policy audit data.

12. The network of claim 11 wherein the reports relate to business agreements between particular ones of the entities.

13. The network of claim 1 wherein the at least one computing device is further operable to facilitate configuration of the policy data associated with any of the entities.

14. The network of claim 13 wherein the at least one computing device is operable to facilitate configuration of the policy data by facilitating presentation of graphical user interfaces to users associated with the entities.

15. The network of claim 1 wherein the plurality of entities may comprise any of organizations, individuals, computing platforms, software applications, and services.

16. The network of claim 1 wherein the at least one computing device is further operable to combine at least one of the first, second, and first combined policy data with third policy data corresponding to a third one of the entities to which the message relates thereby resulting in second combined policy data, the at least one computing device further being operable to handle the message in the network with reference to the second combined policy data.

17. The network of claim 16 wherein the at least one computing device is further operable to associate the second combined policy data with the message such that the second combined policy data are transmitted with the message in the network.

18. The network of claim 17 wherein the at least one computing device comprises a plurality of components, each of the components being configured to handle the message with reference to only a portion of the second combined policy data, handling of the message with reference to all of the second combined policy data being thereby distributed among the components.

19. The network of claim 1 wherein the policy data relate to any of security, message format, network protocols, routing, organizations, users, and roles.

20. The network of claim 1 wherein each policy defined by the policy data is characterized by a scope, the scope comprising one of a connection scope, a call scope, and a session scope.

21. The network of claim 20 wherein the connection scope relates to connections between the entity corresponding to the policy data and the network, the call scope relates to calls between two of the entities, and the session scope relates to entire sessions involving at least two of the entities.

22. The network of claim 20 wherein the at least one computing device is further operable to extend the scope associated with a first policy defined by the first policy data.

23. The network of claim 22 wherein the at least one computing device is operable to extend the scope associated with the first policy by including a token in the message, the token being obtained from a second message in the network.

24. The network of claim 1 wherein the first, second, and combined policy data each comprise at least one policy assertion, the at least one computing device being operable to evaluate the message for compliance with the at least one policy assertion at some point within the network.

25. The network of claim 24 wherein the at least one policy assertion comprises a plurality of policy assertions, the at least one computing device being operable to evaluate different ones of the policy assertions at different points within the network.

26. A method for facilitating communication among a plurality of entities, each entity having policy data corresponding thereto governing interaction with the entity via the interoperability network, the method comprising:

storing the policy data for all of the entities;

handling a message in the network with reference to first policy data corresponding to a first one of the entities to which the message relates;

combining the first policy data with second policy data corresponding to a second one of the entities to which the message relates thereby resulting in first combined policy data; and

handling the message in the network with reference to the first combined policy data.

27. The method of claim 26 further comprising associating the first policy data and the first combined policy data with the message such that the first policy data and the first combined policy data are transmitted with the message in the network.

28. The method of claim 27 wherein the at least one computing device comprises a plurality of components, the method further comprising handling the message at each of the components with reference to only a portion of the first policy data or the first combined policy data, thereby distributing handling of the message with reference to all of the first policy data or first combined policy data among the components.

29. The method of claim 26 further comprising determining that the message relates to the second entity and combining the first and second policy data in response thereto.

30. The method of claim 26 wherein the first and second policy data correspond to first and second policy trees, respectively, and wherein combining the first and second policy data comprises logically combining the first and second policy trees.

31. The method of claim 26 further comprising detecting a run-time policy violation of the combined policy data.

32. The method of claim 31 further comprising generating a policy violation message corresponding to the policy violation, and transmitting the policy violation message to either or both of the first and second entities.

33. The method of claim 31 further comprising rejecting the message upon detecting the policy violation.

34. The method of claim 31 further comprising forwarding the message to a web site associated with one of the first and second entities upon detecting the policy violation.

35. The method of claim 26 further comprising storing policy audit data for any of the entities associated with the network, the policy audit data comprising information relating to compliance of any of the entities with any of the policy data.

36. The method of claim 35 further comprising generating reports using the policy audit data.

37. The method of claim 36 wherein the reports relate to business agreements between particular ones of the entities.

38. The method of claim 26 further comprising facilitating configuration of the policy data associated with any of the entities.

39. The method of claim 38 wherein facilitating configuration of the policy data comprises facilitating presentation of graphical user interfaces to users associated with the entities.

40. The method of claim 26 wherein the plurality of entities may comprise any of organizations, individuals, computing platforms, software applications, and services.

41. The method of claim 26 further comprising combining at least one of the first, second, and first combined policy data with third policy data corresponding to a third one of the entities to which the message relates thereby resulting in second combined policy data, and handling the message in the network with reference to the second combined policy data.

42. The method of claim 41 further comprising associating the second combined policy data with the message such that the second combined policy data are transmitted with the message in the network.

43. The method of claim 42 wherein the at least one computing device comprises a plurality of components, the method further comprising handle the message at each of the components with reference to only a portion of the second combined policy data, thereby distributing handling of the message with reference to all of the second combined policy data among the components.

44. The method of claim 26 wherein the policy data relate to any of security, message format, network protocols, routing, organizations, users, and roles.

45. The method of claim 26 wherein each policy defined by the policy data is characterized by a scope, the scope comprising one of a connection scope, a call scope, and a session scope, wherein the connection scope relates to connections between the entity corresponding to the policy data and the network, the call scope relates to calls between two of the entities, and the session scope relates to entire sessions involving at least two of the entities, the method further comprising extending the scope associated with a first policy defined by the first policy data.

46. The method of claim 45 wherein extending the scope associated with the first policy comprises including a token in the message, the token being obtained from a second message in the network.

47. The method of claim 26 wherein the first, second, and combined policy data each comprise at least one policy assertion, the method further comprising evaluating the message for compliance with the at least one policy assertion at some point within the network.

48. The method of claim 47 wherein the at least one policy assertion comprises a plurality of policy assertions, the method further comprising evaluating different ones of the policy assertions at different points within the network.

49. A computer-implemented method for facilitating communication among a plurality of entities via an interoperability network, each entity having policy data corresponding thereto governing interaction with the entity via the interoperability network, the method comprising transmitting a message from a first one of the entities to a second one of the entities, the first entity having first policy data corresponding thereto and the second entity having second policy data corresponding thereto, the message having been handled in the network according to combined policy data representing a combination of the first and second policy data.