Orchestration of policy engines and format technologies

• US 8,141,125 B2
• Filed: 11/30/2006
• Issued: 03/20/2012
• Est. Priority Date: 11/30/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Maes, Stephane H.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): HERZOG, MADHURI R
• Application Number:
  US11/565,578
• Publication Number:
  US 20070150936A1
• Time in Patent Office: 1,937 Days
• Field of Search: 726/1, 706 45- 58
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Policies can combine the efficiency of rule sets with the flexible expression power of workflow engines, as well as advantages of other programming languages and engines. Consistent modelling of policy rules is provided across different levels, such as network, control, and service levels. In one system, a policy module can orchestrate rule set and workflow engines in order to evaluate different conditions of a policy. In another embodiment, a hybrid language can be used that allows rule set and other variables to be used in a business process container, workflow and other variables to be used in a rule set container, rule set and business process variables to be used in other containers. In this way, a subset of conditions in a policy can be evaluated using multiple languages and/or engines in order to enforce or evaluate a policy.

Claims

1. A method of applying a policy to a request, comprising:

acquiring a request by one of receiving and intercepting the request;

determining at least one policy to be applied to the request, the at least one policy including a plurality of conditions and a plurality of actions associated therewith;

based at least in part on the plurality of conditions and the plurality of actions associated with the at least one policy, passing control of evaluation and enforcement of the at least one policy to an associated container, wherein the associated container comprises at least one of;

a workflow engine, a rule set engine, or language engine; and

applying the at least one policy to the request using a common policy model framework implementing the associated container, wherein the common policy model framework is configured to handle the evaluation and the enforcement of the at least one policy across multiple disparate systems by implementing a common language comprising multiple languages, the common policy model framework further being configured such that a determination of an appropriate language and a setting of an appropriate context is done for each condition to be evaluated and each corresponding action to be executed in the at least one policy, the common policy model framework further providing for passing of control and values of the at least one policy for evaluation of a condition and execution of a corresponding action to the determined language, the at least one policy operable to be applied to the request without evaluating each condition and executing each action contained therein;

wherein a combination of at least two of a business process language, a rule set language, and another programming language is used to apply the at least one policy.

2. A method according to claim 1, wherein:

applying the at least one policy to the message further includes passing values for one of a condition being evaluated and an action being executed to one of a business process engine, a rule set engine, and another programming language engine.

3. A method according to claim 1, wherein:

the combination of at least two languages is part of a single hybrid language including syntax from the at least two languages.

4. A method according to claim 1, further comprising:

optimizing a topology of the at least one policy.

5. A method according to claim 1, wherein:

applying the at least one policy to the message further includes passing control to one of a rule set container having access to business process variables, a business process container having access to rule set variables, and another container having access to rule set and business process variables.

6. A method according to claim 1, wherein:

applying the at least one policy to the request further includes following one of a plurality of paths through the at least one policy, each path including at least a subset of the conditions and actions, wherein the followed path is determined in part by the evaluation of the conditions encountered along that path.

7. A method according to claim 1, further comprising:

pre-compiling at least a portion of the at least one policy.

8. A method according to claim 1, wherein:

applying the at least one policy includes one of evaluating and enforcing a complex policy.

9. A method according to claim 1, wherein:

applying the at least one policy further includes orchestrating at least two policy engines, each policy engine operable to evaluate a condition using a selected language.

10. A method according to claim 1, wherein:

applying the at least one policy further includes delegating functions of the evaluation to at least one separate resource.

11. A method according to claim 1, wherein:

applying the at least one policy further includes evaluating at least one condition with code separate from the rule set language and workflow language.

12. A method of applying a policy to a request, comprising:

acquiring a request by one of receiving and intercepting the request;

determining at least one policy to be applied to the request, the at least one policy including a plurality of conditions and a plurality of actions associated therewith;

based at least in part on the plurality of conditions and the plurality of actions associated with the at least one policy, passing control of evaluation and enforcement of the at least one policy to an associated container, wherein the associated container comprises at least one of;

a workflow engine, a rule set engine, or language engine; and

applying the at least one policy to the request by orchestrating a plurality of programming language engines executing the associated container, wherein the plurality of programming language engines are configured to handle the evaluation and the enforcement of the at least one policy across multiple disparate systems by combining the plurality of programming languages into a common programming language, such that a determination of an appropriate engine is done for each condition to be evaluated and each corresponding action to be executed in the at least one policy, the control and values of the at least one policy for evaluation of a condition and execution of a corresponding action being passed to the determined engine, the at least one policy operable to be applied to the request without evaluating each condition and executing each action contained therein,

wherein a combination of at least two of a business process engine, a rule set engine, and another programming language engine is used to apply the at least one policy.

13. A system for applying a complex policy to a request comprising:

a storage medium having non-transitory sets of computer-readable instructions stored thereon; and

a computer processor coupled to the storage medium, the computer processor configured to execute the sets of instructions in order to perform the following functions;

acquire the request by one of receiving and intercepting the request, and determining at least one policy to apply to the request, the at least one policy including a plurality of conditions and a plurality of actions;

based at least in part on the plurality of conditions and the plurality of actions associated with the at least one policy, pass control of evaluation and enforcement of the at least one policy to an associated container, wherein the associated container comprises a business process language and a rule set language;

apply the at least one policy to the request using a common policy model framework implementing the associated container, wherein the common policy model framework is configured to handle the evaluation and the enforcement of the at least one policy across multiple disparate systems by implementing a common language comprising the business process language and the rule set language;

evaluate a subset of the plurality of conditions in the at least one policy using the business process language; and

evaluate a subset of the plurality of conditions in the at least one policy using the rule set language,

wherein a combination of the business process language and the rule set language is operable to be used to evaluate the at least one policy, the at least one policy operable to be applied without evaluating each condition therein.

14. A system according to claim 13, wherein:

the rule set engine and the business process engine are portions of a hybrid engine.

15. A system according to claim 14, wherein:

the hybrid engine is operable to orchestrate the business process engine and rule set engine portions.

16. A system according to claim 14, wherein:

the hybrid engine is operable to use a complex language supporting at least rule set and business process variables.

17. A system according to claim 14, wherein:

the hybrid engine is operable to optimize a topology of the at least one policy.

18. A system according to claim 14, wherein:

the hybrid engine is operable to pass control of the at least one policy to one of a rule set container having access to business process variables and a workflow container having access to rule set variables.

19. A system according to claim 14, wherein:

the hybrid engine is operable to apply the at least one policy to the message by following one of a plurality of paths through the at least one policy, each path including at least a subset of the plurality of conditions and plurality of actions, wherein the followed path is determined in part by the evaluation of the subset of the plurality of conditions and execution of the subset of the plurality of actions encountered along that path.

20. A system according to claim 13, further comprising:

at least one additional engine operable to evaluate a subset of the plurality of conditions in the at least one policy using an additional language.

21. A system according to claim 20, wherein:

the rule set engine, business process engine, and at least one additional engine are portions of a hybrid engine.

22. A system according to claim 13, wherein:

the business process language and the rule set language are part of a hybrid language.

23. A system according to claim 13, further comprising:

a target resource corresponding to the request.

24. A system according to claim 22, wherein:

the target resource receives the request before the at least one policy is applied to the request.

25. A system according to claim 22, wherein:

the at least one policy is applied to the request before the request is received by the target resource.

26. A system according to claim 13, further comprising:

at least one resource operable to process a function for an evaluation delegated by one of the business process language and the rule set language.

27. A non-transitory computer program product embedded in a computer readable medium for applying a policy to a request, comprising:

computer program for acquiring a request by one of receiving and intercepting the request;

computer program for determining at least one policy to be applied to the request, the at least one policy including a plurality of conditions and a plurality of actions associated therewith;

computer program for, based at least in part on the plurality of conditions and the plurality of actions associated with the at least one policy, passing control of evaluation and enforcement of the at least one policy to an associated container, wherein the associated container comprises at least one of;

a workflow engine, a rule set engine, or language engine; and

computer program for applying the at least one policy to the request using a common policy model framework implementing the associated container, wherein the common policy model framework is configured to handle the evaluation and the enforcement of the at least one policy across multiple disparate systems by implementing a common language comprising multiple languages, the common policy model framework further being configured such that a determination of an appropriate language and a setting of an appropriate context is done for each condition to be evaluated and each corresponding action to be executed in the at least one policy, the common policy model framework further providing for the passing of control and values at least one policy for evaluation of a condition and execution of a corresponding action to the determined language, the at least one policy operable to be applied to the request without evaluating each condition and executing each action contained therein,

wherein a combination of at least two of a business process language, a rule set language, and another programming language is used to apply the at least one policy.

28. A method of applying a policy to a request, comprising:

acquiring a request by one of receiving and intercepting the request;

determining at least one policy to be applied to the request, the at least one policy including a plurality of conditions and a plurality of actions associated therewith;

based at least in part on the plurality of conditions and the plurality of actions associated with the at least one policy, passing control of evaluation and enforcement of the at least one policy to an associated container, wherein the associated container comprises at least one of;

a workflow engine, a rule set engine, or language engine; and

applying the at least one policy to the request by orchestrating a plurality of programming language engines executing the associated container, wherein the plurality of programming language engines are configured to handle the evaluation and the enforcement of the at least one policy across multiple disparate systems by combining the plurality of programming languages into a common programming language, such that a determination of an appropriate engine is done for each condition to be evaluated and each corresponding action to be executed in the at least one policy, the control and values at least one policy for evaluation of a condition and execution of a corresponding action being passed to the determined engine, the at least one policy operable to be applied to the request without evaluating each condition and executing each action contained therein,

wherein a combination of at least two of a business process engine, a rule set engine, and another programming language engine is used to apply the at least one policy.