Using deltas for efficient policy distribution

• US 7,437,441 B1
• Filed: 02/28/2003
• Issued: 10/14/2008
• Est. Priority Date: 02/28/2003
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Healy, Michael J., James, David C., Kumar, Deepak, Parupudi, Gopal, Drew, Daniel N. J., Osborne, Kenneth Mark
• Primary Examiner(s): DUONG, OANH L
• Application Number:
  US10/376,426
• Time in Patent Office: 2,055 Days
• Field of Search: 709223-226, 709/229, 709/201, 709/203, 709/246, 709/248, 370/395.21
• US Class Current: 709/223
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present disclosure relates to mapping, tracking, and distributing policy to client devices. Policy, in particular lists of policy assignments are sent to client devices. A determination is made as to the changes or deltas between policy assignments that have been sent to client devices and policy assignments that must be sent to client devices. Identifying the delta policy assignments avoids the need be sent to client devices. Identifying the delta policy assignments avoids the need to send policy assignments that have not change and do not need to be sent to client devices. A server computer determines applicability of policy assignments to particular client devices, tracks if and when policy assignments have been deleted and allows the client to either receive a partial list of policy assignments that are required to update policy or a full list of policy assignments. Full, partial or not list policy assignment depends when a particular client device was last provided a policy assignment.

Claims

1. A method to distribute policy to a client device comprising:

receiving a request from a client device for a list of policy assignments;

determining if the client device is requesting the list of policy assignments for a first time, and if the request is made for the first time, then sending a full list of policy assignments;

determining if the client device is out of synchronization with a policy server or a management point, and if the client device is out of synchronization, then sending the full list of policy assignments;

determining if the client device has been updated before a last maintenance cycle was run, and if the client device was updated before the last maintenance cycle was run, then sending the full list of policy assignments;

determining whether an update to the list of policy assignments has been made since a time that a cookie was sent by the client device, and if updates have been made to the list of policy assignments, then sending only updated policy assignments; and

tracking the full list of policy assignments and the updated policy assignments sent to the client device.

2. The method of claim 1 wherein the full list of policy assignments and the updated policy assignments include information as to where policy objects are retrieved by the client device.

3. The method of claim 2 wherein the information is a uniform resource locator.

4. The method of claim 1 wherein the request is in the form of a cookie.

5. The method of claim 4 wherein the cookie contains a value for the last update time for the client device.

6. The method of claim 4 wherein a null value for the cookie sends a full list of policy assignments to the client device.

7. The method of claim 4 wherein a zero value for the cookie sends a full list of policy assignments to the client device.

8. The method of claim 1 wherein the tracking comprises maintaining a mapping between a plurality of policy assignments and a plurality of client devices.

9. The method of claim 8 wherein the mapping comprises when client devices were updated with policy assignments.

10. The method of claim 8 wherein the mapping comprises a time when a policy assignment is deleted.

11. The method of claim 1 further comprising receiving the full list of policy assignments from a database.

12. A management point configured to perform a method comprising the steps of:

receiving a request from a client device for a list of policy assignments;

determining if the client device is requesting the list of policy assignments for a first time, and if the request is made for the first time, then sending a full list of policy assignments;

determining if the client device is out of synchronization with a policy server or a management point, and if the client device is out of synchronization, then sending the full list of policy assignments;

determining if the client device has been updated before a last maintenance cycle was run, and if the client device was updated before the last maintenance cycle was run, then sending the full list of policy assignments;

determining whether an update to the list of policy assignments has been made since a time that a cookie was sent by the client device, and if updates have been made to the list of policy assignments, then sending only updated policy assignments; and

tracking the full list of policy assignments and the updated policy assignments sent to the client device.

13. A policy server configured to perform a method comprising the steps of:

receiving a request from a client device for a list of policy assignments;

determining if the client device is requesting the list of policy assignments for a first time, and if the request is made for the first time, then sending a full list of policy assignments;

determining if the client device is out of synchronization with a policy server or a management point, and if the client device is out of synchronization, then sending the full list of policy assignments;

determining if the client device has been updated before a last maintenance cycle was run, and if the client device was updated before the last maintenance cycle was run, then sending the full list of policy assignments;

determining whether an update to the list of policy assignments has been made since a time that a cookie was sent by the client device, and if updates have been made to the list of policy assignments, then sending only updated policy assignments; and

tracking the full list of policy assignments and the updated policy assignments sent to the client device.

14. One or more computer-readable media containing computer program instructions for providing a list of policy assignments to a client device, the computer program instructions comprising instructions for:

mapping a list of policy assignments to a client device;

receiving a request from the client device for policy assignments;

determining if the client device is requesting the policy assignments for a first time, and if the request is made for the first time, then sending a full list of policy assignments;

determining if the client device is out of synchronization with a policy server or a management point, and if the client device is out of synchronization, then sending the full list of policy assignments;

determining if the client device has been updated before a last maintenance cycle was run, and if the client device was updated before the last maintenance cycle was run, then sending the full list of policy assignments;

determining whether an update to the list of policy assignments has been made since a time that a cookie was sent by the client device, and if updates have been made to the list of policy assignments, then sending only updated policy assignments; and

tracking the full list of policy assignments and the updated policy assignments sent to the client device.

15. A server comprising:

a memory;

a processor; and

a policy manager module stored in them memory and executable on the processor to receive a request from one or more client devices for one or more lists of policy assignments, wherein the policy manager;

determines if the one or more client devices is requesting the one or more lists of policy assignments for a first time, and if the request is made for the first time, then sending a full list of policy assignments,

determines if the one or more client devices is out of synchronization with a policy server or a management point, and if the one or more client devices is out of synchronization, then sending the full list of policy assignments,

determines if the one or more client devices have been updated before a last maintenance cycle was run, and if the one or more client devices were updated, then sending the full list of policy assignments,

determines if the list of policy assignments has been updated since a time that a cookie was sent by the client device, and if updates have been made to the list of policy assignments, then sending only updated policy assignments, and

tracks the full list of policy assignments and the updated policy assignments that are sent to the one or more client devices.

16. The server of claim 15 wherein the policy manager module further permanently deletes policy assignments have been identified s deleted after a predetermined time period.

17. The server of claim 16 wherein client devices that are updated outside of the predetermined time period are given a full list of policy assignments, and client devices within the predetermined time period are given either given a limited list of policy assignments or no list.