TECHNIQUES OF OPTIMIZING POLICIES IN AN INFORMATION MANAGEMENT SYSTEM

• US 20070156670A1
• Filed: 12/22/2006
• Published: 07/05/2007
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Blue Jungle
• Inventors: Lim, Keng
• Granted Patent: US 8,150,816 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

In an information management system, policies are optimized before they are associated to a device in order to increase evaluation speed or reduce space requirements, or both. Optimization techniques may include common subexpression elimination, constant folding, constant propagation, comparison optimization, dead code or subexpression removal, map or lookup table generation, policy rewriting, redundant policy elimination, heuristic-based policy ordering, or policy-format transformation, and combinations of these.

Claims

1. A method of managing information comprising:

providing a plurality of rules and a plurality of abstractions, wherein a rule comprises an expression having a variable, and the variable is defined in a first abstraction;

determining a subset of the plurality of rules and abstractions relevant to a target;

modifying the subset of rules and abstractions, wherein the modified subset of rules and abstractions are logically equivalent to the subset of rules and abstractions;

associating the modified subset of rules and abstractions to the target; and

for the target, controlling access to the information based on the modified subset of rules and abstractions.

2. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises:

determining a characteristic of the target;

removing a portion of at least one of the plurality of rules based on the characteristic of the target.

3. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises:

determining a characteristic of the target; and

removing a portion of at least one of the plurality of abstractions based on the characteristic of the target.

4. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises removing constant subexpressions from the rules.

5. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises replacing a constant subexpression in a rule with a constant.

6. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises removing constant subexpressions from the abstractions.

7. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises replacing a constant subexpression in an abstraction with a constant.

8. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises removing a subexpression having a variable from a rule when the subexpression evaluates to a constant.

9. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises removing a subexpression of a rule when the subexpression evaluates to a Boolean true.

10. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises removing a subexpression from a rule when the subexpression evaluates to a Boolean false.

11. The method of claim 1 wherein the modifying the subset of rules and abstractions comprises replacing a variable in a rule with a constant when a value of the variable evaluates to a constant.

12. The method of claim 1 further comprising:

providing a rule having a first variable defined in a first abstraction, wherein the first abstraction has a second variable defined in a second abstraction; and

evaluating the second variable, wherein the second variable evaluates to a constant, and the modifying the subset of rules and abstractions comprises;

removing the second variable from the first abstraction.

13. The method of claim 1 further comprising:

providing a rule having a first variable defined in a first abstraction, wherein the first abstraction has a second variable defined in a second abstraction; and

evaluating the second variable, wherein the second variable evaluates to a constant, and the modifying the subset of rules and abstractions comprises;

replacing the second variable from the first abstraction with the constant.

14. The method of claim 2 wherein the characteristic of the target comprises at least one of a device type of the target, a user associated with the target, a group associated with the target, an application executing on the target, or a capability of the target.

15. A method of managing information comprising:

providing a plurality of rules, wherein a rule comprises an expression;

determining a subset of the plurality of rules relevant to a target;

for the subset of the plurality of rules relevant to the target, modifying the subset of rules by removing portions of the expression not relevant to the target;

associating the modified subset of rules to the target; and

for the target, controlling access to the information based on the modified subset of rules.

17. The method of claim 15 wherein the for the subset of the plurality of rules relevant to the target, modifying the subset of rules by removing portions of the expression not relevant to the target is replaced by

for the subset of the plurality of rules relevant to the target, modifying the subset of rules by replacing a portion of the expression not relevant to the target with a constant.

16. A method of managing information comprising:

providing a plurality of rules, wherein a rule comprises an expression;

determining a subset of the plurality of rules relevant to a target;

for the subset of the plurality of rules relevant to the target, modifying the subset of rules by removing portions of the expression not relevant to the target;

associating the modified subset of rules to the target; and

for the target, controlling application usage based on the modified subset of rules.

18. A method of managing information comprising:

providing a plurality of rules, wherein a rule comprises an expression;

determining a subset of the plurality of rules relevant to a target;

for the subset of the plurality of rules relevant to the target, identifying a common subexpression;

assigning the common subexpression to a variable;

in the subset of the plurality of rules, replacing the common subexpression with the variable;

associating the modified subset of the plurality of rules to the target; and

for the target, controlling access to the information based on the modified subset of the plurality of rules.

19. The method of claim 18 wherein the access to the information comprises sending an e-mail message.

20. The method of claim 18 wherein the access to the information comprises editing a cell in a spreadsheet.

21. A method of managing information comprising:

providing a plurality of rules and a plurality of abstractions, wherein a rule comprises an expression;

determining a subset of the plurality of rules and a subset of the plurality of abstractions relevant to a target;

for the subset of the plurality of rules and the subset of the plurality of abstractions relevant to the target, identifying a common subexpression;

assigning the common subexpression to a variable;

in the subset of the plurality of rules and the subset of the plurality of abstractions, replacing the common subexpression with the variable;

associating the modified subset of the plurality of rules and the subset of the plurality of abstractions to the target; and

for the target, controlling access to the information based on the modified subset of the plurality of rules and the subset of the plurality of abstractions.

22. The method of claim 21 wherein the access to the information comprises forwarding an e-mail message.

23. The method of claim 21 wherein the access to the information comprises saving a document.