Computer-Implemented Method, Computer System, And Computer Program Product for Optimization Of Evaluation Of A Policy Specification

• US 20100306818A1
• Filed: 12/29/2009
• Published: 12/02/2010
• Est. Priority Date: 05/28/2009
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Manzoni, Vincenzo, Li, Keqin
• Granted Patent: US 8,769,606 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 16/88 Mark-up to mark-up conversion conversion for visualization in web browsing G06F16/9577
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present description relates to a computer-implemented method, computer system, and computer program product for optimization of evaluation of a policy specification. In one aspect, the computer-implemented method for optimization of evaluation of a policy specification may comprise receiving the policy specification represented as a tree, the tree comprising a plurality of nodes. A visiting history of the tree may be determined by computing a density at least for each node in a subset of the plurality of nodes having been visited. The density may be determined by a relationship between a position of a node v in the tree and a frequency F(v) in which the node v is visited. The tree may be transformed with respect to the visiting history into a similar tree such that sibling nodes in the subset of the plurality of nodes are sorted in decreasing order according to their density.

Claims

1. A computer-implemented method for optimization of evaluation of a policy specification, the method comprising:

receiving the policy specification represented as a tree, the tree comprising a plurality of nodes;

determining a visiting history of the tree, wherein the visiting history is determined by computing a density at least for each node in a subset of the plurality of nodes having been visited, wherein the density is determined by a relationship between a position of a node v in the tree and a frequency F(v) in which the node v is visited;

transforming the tree with respect to the visiting history into a similar tree such that sibling nodes in the subset of the plurality of nodes are sorted in decreasing order according to their density.

2. A method according to claim 1, wherein computing a density further comprises:

for each node in the subset, dividing the frequency F(v) in which a node v in a subtree st(v) rooted at said node v is visited by a size of said subtree |st(v)|.

3. A method according to claim 1, wherein a relationship between at least one policy and at least one rule of said policy in the policy specification is maintained in the similar tree.

4. A method according to claim 1, wherein a relationship between at least one policy set and at least one policy of said policy set in the policy specification is maintained in the similar tree.

5. A method according to claim 1, wherein the similar tree is a minimum cost tree of all similar trees of the tree.

6. A method according to claim 1, further comprising:

refreshing the visiting history automatically after a time stamp is exceeded; and

transforming the tree with respect to said refreshed visiting history.

7. A method according to claim 1, wherein the policy specification is implemented in XACML.

8. A computer program product comprising computer readable instructions, which when loaded and run in a computer and/or computer network system, causes the computer system and/or the computer network system to perform operations according to the method of claim 1.

9. A computer system to optimize evaluation of a policy specification, the system comprising a component operable to:

receive the policy specification represented as a tree, the tree comprising a plurality of nodes;

determine a visiting history of the tree, wherein the visiting history is determined by computing a density at least for each node in a subset of the plurality of nodes having been visited, wherein the density is determined by a relationship between a position of a node v in the tree and a frequency F(v) in which the node v is visited;

transform the tree with respect to the visiting history into a similar tree such that sibling nodes in the subset of the plurality of nodes are sorted in decreasing order according to their density.

10. A system according to claim 9, wherein the component operable to compute a density is further operable to:

for each node in the subset, divide the frequency F(v) in which a node v in a subtree st(v) rooted at said node v is visited by a size of said subtree |st(v)|.

11. A system according to claim 9, wherein a relationship between at least one policy and at least one rule of said policy in the policy specification is maintained in the similar tree.

12. A system according to claim 9, wherein a relationship between at least one policy set and at least one policy of said policy set in the policy specification is maintained in the similar tree.

13. A system according to claim 9, wherein the similar tree is a minimum cost tree of all similar trees of the tree.

14. A system according to claim 9, wherein the component is further operable to:

refresh the visiting history automatically after a time stamp is exceeded; and

transform the tree with respect to said refreshed visiting history.

15. A system according to claim 9, wherein the policy specification is implemented in XACML.