Policy application across multiple nodes

• US 20050188072A1
• Filed: 02/20/2004
• Published: 08/25/2005
• Est. Priority Date: 02/20/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Christensen, Erik B., Levin, David, Lee, Alfred IV, Wong, Sara
• Granted Patent: US 7,496,649 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method includes retrieving an intermediate node policy characterizing communication properties supported by an intermediate node, the intermediate node being between a source node and a destination node in a communication path. The method includes forming a first policy-compliant message in accordance with the intermediate node policy, the first policy-compliant message including a request for a destination node policy characterizing communication properties supported by the destination node. A system includes a policy retriever comparing a source policy to one to an intermediate policy to determine whether the source policy is compatible with the intermediate policy. A message generator generates a policy request message by applying the intermediate policy to a request for a policy related to a destination node.

Claims

1. A method comprising:

retrieving an intermediate node policy characterizing communication properties supported by an intermediate node, the intermediate node being between a source node and a destination node in a communication path;

forming a first policy-compliant message in accordance with the intermediate node policy, the first policy-compliant message including a request for a destination node policy characterizing communication properties supported by the destination node.

2. A method as recited in claim 1 further comprising:

transmitting the first policy-compliant message to the intermediate node;

receiving the destination node policy;

forming a second policy-compliant message in accordance with both the intermediate node policy and the destination node policy.

3. A method as recited in claim 1 wherein the forming operation further comprises forming a first policy-compliant message including a source node policy characterizing communication properties supported by the destination node.

4. A method as recited in claim 1 further comprising:

retrieving the destination node policy;

forming a second policy-compliant message, the second policy-compliant message including an underlying message, the second policy-compliant message conforming to the destination node policy;

forming a third policy-compliant message, the third policy-compliant message including the second policy-compliant message, the third policy-compliant message conforming to the intermediate node policy.

5. A method as recited in claim 2 further comprising determining whether the destination node policy specifies an additional intermediate node.

6. A method as recited in claim 2 further comprising:

determining whether the destination node policy specifies an additional intermediate node;

if the destination node policy specifies an additional intermediate node retrieving a policy from the additional intermediate node.

7. A method as recited in claim 2 further comprising:

determining whether the destination node policy specifies an additional intermediate node;

if the destination node policy specifies an additional intermediate node forming a third policy-compliant message in accordance with the intermediate node policy, the third policy-compliant message including a request for an additional intermediate node policy characterizing communication properties supported by the additional intermediate node.

8. A method as recited in claim 1 further comprising determining whether the intermediate node policy is compatible with a source node policy characterizing communication properties supported by the source node.

9. A method as recited in claim 1 further comprising determining whether the intermediate node policy is compatible with a source node policy characterizing communication properties supported by the source node, wherein the determining operation comprises receiving a notification from a service that the intermediate node policy is compatible with the source node policy.

10. A method as recited in claim 1 wherein the retrieving operation comprises incrementally receiving the intermediate node policy.

11. A method as recited in claim 1 wherein the retrieving operation comprises receiving the intermediate node policy from a node other than the intermediate node.

12. A method as recited in claim 1 wherein the retrieving operation comprises reading the intermediate node policy from a cache memory at the source node.

13. A computer program product encoding a computer program for executing on a computer system a computer process, the computer process comprising:

retrieving an intermediate node policy and a destination node policy, the intermediate node policy characterizing communication properties supported by an intermediate node and the destination node policy characterizing communication properties supported by a destination node, the intermediate node being between a source node and the destination node in a communication path;

applying the intermediate node policy and the destination node policy to an underlying message in order of the destination node policy followed by the intermediate node policy.

14. A computer program product as recited in claim 13 wherein the applying operation comprises:

creating a first policy-compliant message including the underlying message, the first policy-compliant message being created according to the destination policy;

creating a second policy-compliant message including the first policy-compliant message, the second policy-compliant message being created according to the intermediate policy.

15. A computer program product as recited in claim 13 further comprising selecting a policy expression from the intermediate node policy.

16. A computer program product as recited in claim 13 further comprising determining whether the intermediate node policy is compatible with a source node policy characterizing communication properties supported by the source node.

17. A computer program product as recited in claim 13 further comprising determining whether the destination node policy specifies an additional intermediate node in the communication path.

18. A computer program product as recited in claim 13 further comprising:

determining whether the destination node policy specifies an additional intermediate node in the communication path;

if the destination node policy specifies an additional intermediate node in the communication path, retrieving a policy from the additional intermediate node.

19. A computer program product as recited in claim 13 wherein the retrieving operation comprises forming a request message, the request message including a request for the destination node policy and conforming to the intermediate node policy.

20. A computer program product as recited in claim 13 wherein the retrieving operation comprises retrieving one or more of the intermediate node policy and the destination node policy from a node other than the intermediate node, the destination node, and the source node.

21. A computer program product as recited in claim 13 wherein the retrieving operation comprises requesting each of the intermediate node policy and the destination node policy in order of the intermediate node followed by the destination node.

22. A computer program product as recited in claim 13 wherein the retrieving operation comprises incrementally receiving at least one of the intermediate node policy and the destination node policy.

23. A computer program product as recited in claim 13 wherein the retrieving operation comprises reading at least one of the intermediate node policy and the destination node policy from a cache memory at the source node.

24. A computer program product as recited in claim 13 further comprising determining whether a message from the intermediate node conforms to a source node policy characterizing communication properties supported by the source node.

25. A system comprising:

a source node policy having protocol parameters related to a source node;

a policy retriever retrieving an intermediate node policy having protocol parameters related to an intermediate node between the source node and a destination node in a communication path;

a message generator generating a request message in accordance with the intermediate node policy, the request message including a request for a destination node policy having protocol parameters related to the destination node.

26. A system as recited in claim 25 wherein the policy retriever compares the source node policy to the intermediate node policy to determine whether the source node policy is compatible with the intermediate node policy.

27. A system as recited in claim 25 wherein the policy retriever selects a policy expression from the intermediate node policy based on the source node policy.

28. A system as recited in claim 25, wherein the message generator further transmits a message to the intermediate node, the message including at least a portion of the source node policy.

29. A system as recited in claim 25, wherein the policy retriever determines whether the intermediate node policy or the destination node policy specifies an additional intermediate node in the communication path.

30. A system as recited in claim 25, further comprising a policy generator generating the source node policy, wherein generating comprises generating a plurality of policy expressions and at least one relationship operator associated with the plurality of policy expressions.

31. A system as recited in claim 30, wherein the policy generator generates a usage attribute related to one of the plurality of policy expressions.

32. A system as recited in claim 25, wherein the source policy comprises one or more policy expressions specifying at least one of:

a security protocol;

a routing parameter;

an encryption algorithm;

an audit trail;

a privacy parameter.

33. A system as recited in claim 25, wherein the source node policy comprises:

a plurality of policy expressions specifying protocol parameters;

one or more operators related to the plurality of policy expressions, the one or more operators specifying a relationship between the plurality of policy expressions.

34. A system as recited in claim 25, wherein the source node policy comprises an input policy characterizing input protocol parameters and an output policy characterizing output protocol parameters.

35. A system comprising:

a policy retriever retrieving a plurality of policies, each policy characterizing protocol parameters related to one of a plurality of nodes, the plurality of nodes including at least one intermediate node and a destination node;

means for applying each of the plurality of policies to a message transmitted to the destination node, such that the message conforms to each of the plurality of policies.

36. A system as recited in claim 35 wherein the means for applying comprises a message generator selecting a policy expression from each of the plurality of policies, each selected policy expression being compatible with a source policy related to a source node.