ORCHESTRATION OF POLICY ENGINES AND FORMAT TECHNOLOGIES

• US 20070150936A1
• Filed: 11/30/2006
• Published: 06/28/2007
• Est. Priority Date: 11/30/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Maes, Stephane
• Granted Patent: US 8,141,125 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Policies can combine the efficiency of rule sets with the flexible expression power of workflow engines, as well as advantages of other programming languages and engines. Consistent modelling of policy rules is provided across different levels, such as network, control, and service levels. In one system, a policy module can orchestrate rule set and workflow engines in order to evaluate different conditions of a policy. In another embodiment, a hybrid language can be used that allows rule set and other variables to be used in a business process container, workflow and other variables to be used in a rule set container, rule set and business process variables to be used in other containers. In this way, a subset of conditions in a policy can be evaluated using multiple languages and/or engines in order to enforce or evaluate a policy.

Claims

1. A method of applying a policy to a message, comprising:

acquiring a message by one of receiving and intercepting the message;

determining at least one policy to be applied to the request, the policy including a plurality of conditions and a plurality of actions associated therewith; and

applying the policy to the request using a common policy model framework, the common policy model framework being configured such that a determination of an appropriate language and a setting of an appropriate context is done for each condition to be evaluated and each corresponding action to be executed in the policy, the policy model further providing for the passing of control and values for the respective execution or evaluation to the determined language, the policy operable to be applied to the message without evaluating each condition and executing each action contained therein,

wherein a combination of at least two of a business process language, a rule set language, and another programming language is used to apply the policy.

2. A method according to claim 1, wherein:

applying the policy to the message further includes passing values for one of a condition being evaluated and an action being executed to one of a business process engine, a rule set engine, and another programming language engine.

3. A method according to claim 1, wherein:

the combination of at least two languages is part of a single hybrid language including syntax from the at least two languages.

4. A method according to claim 1, further comprising:

optimizing a topology of the policy.

5. A method according to claim 1, wherein:

applying the policy to the message further includes passing control to one of a rule set container having access to business process variables, a business process container having access to rule set variables, and another container having access to rule set and business process variables.

6. A method according to claim 1, wherein:

applying the policy to the request further includes following one of a plurality of paths through the policy, each path including at least a subset of the conditions and actions, wherein the followed path is determined in part by the evaluation of the conditions encountered along that path.

7. A method according to claim 1, further comprising:

pre-compiling at least a portion of the policy.

8. A method according to claim 1, wherein:

applying the policy includes one of evaluating and enforcing the complex policy.

9. A method according to claim 1, wherein:

applying the policy further includes orchestrating at least two policy engines, each policy engine operable to evaluate a condition using a selected language.

10. A method according to claim 1, wherein:

applying the policy further includes delegating functions of the evaluation to at least one separate resource.

11. A method according to claim 1, wherein:

applying the policy further includes evaluating at least one condition with code separate from the rule set language and workflow language.

12. A method of applying a policy to a message, comprising:

acquiring a message by one of receiving and intercepting the message;

determining at least one policy to be applied to the request, the policy including a plurality of conditions and a plurality of actions associated therewith; and

applying the policy to the request by orchestrating a plurality of programming language engines, such that a determination of an appropriate engine is done for each condition to be evaluated and each corresponding action to be executed in the policy, the control and values for the respective execution or evaluation being passed to the determined engine, the policy operable to be applied to the message without evaluating each condition and executing each action contained therein,

wherein a combination of at least two of a business process engine, a rule set engine, and another programming language engine is used to apply the policy.

13. A system for applying a complex policy to a message comprising:

a module for acquiring the message by one of receiving and intercepting the message, and determining at least one policy to apply to the request, the policy including a plurality of conditions and a plurality of actions;

a business process engine operable to evaluate a subset of the conditions in the policy using a business process language; and

a rule set engine operable to evaluate a subset of the conditions in the policy using a rule set language,

wherein a combination of the workflow language and the rule set language is operable to be used to evaluate the policy, the policy operable to be applied without evaluating each condition therein.

14. A system according to claim 13, wherein:

the rule set engine and the business process engine are portions of a hybrid engine.

15. A system according to claim 14, wherein:

the hybrid engine is operable to orchestrate the workflow engine and rule set engine portions.

16. A system according to claim 14, wherein:

the hybrid engine is operable to use a complex language supporting at least rule set and workflow variables.

17. A system according to claim 14, wherein:

the hybrid engine is operable to optimize a topology of the policy.

18. A system according to claim 14, wherein:

the hybrid engine is operable to pass control of the policy application to one of a rule set container having access to business process variables and a workflow container having access to rule set variables.

19. A system according to claim 14, wherein:

the hybrid engine is operable to apply the policy to the message by following one of a plurality of paths through the policy, each path including at least a subset of the conditions and actions, wherein the followed path is determined in part by the evaluation of the conditions and execution of actions encountered along that path.

20. A system according to claim 13, further comprising:

at least one additional engine operable to evaluate a subset of the conditions in the policy using an additional language.

21. A system according to claim 20, wherein:

the rule set engine, business process engine, and at least one additional engine are portions of a hybrid engine.

22. A system according to claim 13, wherein:

the workflow language and the rule set language are part of a hybrid language.

23. A system according to claim 13, wherein:

the request module is part of one of the workflow engine and the rule set engine.

24. A system according to claim 13, further comprising:

a target resource corresponding to the message.

25. A system according to claim 22, wherein:

the target resource receives the request before the policy is applied to the message.

26. A system according to claim 22, wherein:

the complex policy is applied to the request before the request is received by the target resource.

27. A system according to claim 13, further comprising:

at least one resource operable to process a function for an evaluation delegated by one of the workflow engine and the rule set engine.

28. A computer program product embedded in a computer readable medium for applying a policy to a message, comprising:

computer program code for acquiring a message by one of receiving and intercepting the message;

computer program code for determining at least one policy to be applied to the request, the policy including a plurality of conditions and a plurality of actions associated therewith; and

computer program code for applying the policy to the request using a common policy model framework, the common policy model framework being configured such that a determination of an appropriate language and a setting of an appropriate context is done for each condition to be evaluated and each corresponding action to be executed in the policy, the policy model further providing for the passing of control and values for the respective execution or evaluation to the determined language, the policy operable to be applied to the message without evaluating each condition and executing each action contained therein,

wherein a combination of at least two of a business process language, a rule set language, and another programming language is used to apply the policy.

29. A method of applying a policy to a message, comprising:

computer program code for acquiring a message by one of receiving and intercepting the message;

computer program code for determining at least one policy to be applied to the request, the policy including a plurality of conditions and a plurality of actions associated therewith; and

computer program code for applying the policy to the request by orchestrating a plurality of programming language engines, such that a determination of an appropriate engine is done for each condition to be evaluated and each corresponding action to be executed in the policy, the control and values for the respective execution or evaluation being passed to the determined engine, the policy operable to be applied to the message without evaluating each condition and executing each action contained therein,

wherein a combination of at least two of a business process engine, a rule set engine, and another programming language engine is used to apply the policy.