Inspecting code and reducing code size associated to a target

• US 8,640,191 B2
• Filed: 04/09/2012
• Issued: 01/28/2014
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Nextlabs
• Inventors: Lim, Keng
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US13/442,781
• Publication Number:
  US 20120198516A1
• Time in Patent Office: 659 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

Code is associated to a target based on an inspection of the code. A target may be a device or a user. A number of code components may be inspected at one time and then transferred or otherwise associated to a target based on the target'"'"'s profile. A code component may be a policy of an information management system.

Claims

1. A method comprising:

providing a plurality of policies stored at a server, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, wherein each policy comprises a code component comprising a conditional expression having a policy abstraction and a corresponding action that will be performed when the conditional expression is satisfied, and each policy abstraction has a corresponding definition statement;

receiving at the server an indication that a first device exists;

retrieving a first set of specific target attributes of the first device;

determining the first set of specific target attributes of the first device corresponds to a first specific target profile, wherein the target profile corresponds to at least two policies of the plurality of policies;

at the server, analyzing a first policy of the plurality of policies to determine whether the first policy is relevant to the first specific target profile with the first set of specific target attributes without inspecting a first code component of the first policy;

at the server, upon determining the first policy is relevant to the first specific target profile, inspecting the first code component of the first policy;

at the server, when the first policy is determined to be relevant to the first specific target profile, based upon the inspecting of the first code component of the first policy, altering the first code component of the first policy to obtain a modified first code component of the first policy;

when the first policy is determined to be relevant to the first specific target profile, transferring the first policy to a first specific target with the first specific target profile by transferring the modified first code component to the first specific target; and

when the first policy is determined not to be relevant to the first specific target profile, not transferring the first policy to the first specific target.

2. The method of claim 1 wherein the corresponding definition statement is stored separately from the policy.

3. The method of claim 1 wherein when the first policy is determined not to be relevant to the first specific target profile, not inspecting the first code component of the first policy.

4. The method of claim 1 wherein the modified first code component that is transferred to the first specific target provides a rule input for a first program executing at the first specific target, and the first program determines whether a second program, executing at the first specific target, can access a file on a document server.

5. The method of claim 4 wherein the rule for the first program disallows access if the user has successfully accessed the file more than N times during a Y time period.

6. The method of claim 1 wherein when executed at the first specific target, the modified first code component is logically equivalent to the first code component.

7. The method of claim 1 wherein the modified first code component will be executed at the first specific target using less execution time than the corresponding first code component.

8. The method of claim 1 wherein the transferring the modified first code component to the first specific target comprises transferring less data than would transferring the first code component to the first specific target.

9. The method of claim 1 wherein the modified first code component uses less memory than the first code component.

10. The method of claim 1 wherein the modified first code component uses less storage space than the first code component.

11. The method of claim 1 wherein the analyzing a first policy of the plurality of policies to determine whether the first policy is relevant comprises:

extracting a first conditional expression of the first policy;

determining whether the first conditional statement can be satisfied based on the first set of specific target attributes;

if the first conditional statement can be satisfied, determining the first policy is relevant; and

if the first conditional statement cannot be satisfied, determining the first policy is not relevant.

12. The method of claim 1 comprising:

when a first user logs onto the first device, transferring a second policy corresponding to the first user, wherein the first and second policies comprise at least one different conditional expression; and

when a first document is accessed, reconciling results from the first and second policies.

13. The method of claim 1 wherein a first abstraction of the first policy references a Lightweight Directory Access Protocol (LDAP) module.

14. The method of claim 1 wherein a first abstraction of the first policy includes a first plurality of users.

15. The method of claim 1 wherein a first abstraction of the first policy includes a resource location.

16. The method of claim 15 wherein the resource location includes at least one wildcard operator and the at least one wildcard operator corresponds to a location in a file structure of a second device.

17. The method of claim 1 wherein the first policy exists at a first layer and a first abstraction included in the first policy exists at a second layer, wherein the first layer references abstractions of the second layer.

18. The method of claim 17 wherein the second layer references a third layer and the third layer comprises a plurality of entity objects.

19. The method of claim 18 wherein the plurality of entity objects corresponds to a plurality of physical resources.

20. The method of claim 1 wherein the altering the first code component does not include altering the first policy abstraction.

21. The method of claim 1 wherein a definition statement of a first abstraction referenced by the first code component is stored at a server and the modified first code component is stored at the first device.

22. The method of claim 21 wherein the first abstraction is retrieved when the modified first code component is evaluated.