Intelligent Policy Deployment

• US 20120233216A1
• Filed: 05/22/2012
• Published: 09/13/2012
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Nextlabs
• Inventors: Lim, Keng
• Granted Patent: US 9,531,595 B2
• Time in Patent Office: Days
• US Class Current: 707/781
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64

Abstract

In an information management system, relevant policies are deployed to targets while policies which are not relevant are not. By deploying relevant policies, this reduces the amount of space requirements at the target to store the policies and the amount of data that needs to be sent to the target. Also, execution speed at the target may increase since the target does not need to evaluate policies that are not relevant.

Claims

1. A method comprising:

providing a plurality of policies, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, and each policy comprises a conditional statement having a policy abstraction and a corresponding action that will be performed when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored separately from the policy;

using at least one processor, analyzing a first policy to determine whether that policy is relevant to a specific target profile with a set of specific target attributes; and

determining the first policy comprising a corresponding first conditional statement and a first action is relevant when a value of at least one of the specific target attributes is used during an evaluation of the first policy and allowing the first action to be performed at the first specific target.

2. The method of claim 1 comprising:

after the first action is allowed to be performed at the first specific target, altering the first conditional statement and without transferring the first policy to the first specific target.

3. The method of claim 2 comprising:

after altering the first conditional statement at the server and without transferring the first policy to the first specific target, evaluating the first conditional statement which results in allowing performing of the first action at the first specific target.

4. The method of claim 1 comprising:

when the policy is determined to be relevant, transferring the policy to a specific target having the specific target profile; and

when the policy is determined to not be relevant, not transferring the policy to the specific target having the specific target profile.

5. The method of claim 1 wherein the altering the first conditional statement and without transferring the first policy to the first specific target comprises adding an event to the first policy that will trigger an evaluation of the first conditional statement, wherein the event cannot occur at the first specific target.

6. The method of claim 5 further comprising after the adding an event to the first policy, transferring the first policy to the second specific target, wherein the event can occur at a second specific target.