Inspecting code and reducing code size associated to a target

• US 8,904,478 B2
• Filed: 01/28/2014
• Issued: 12/02/2014
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Nextlabs
• Inventors: Lim, Keng
• Primary Examiner(s): Harriman, Dant Shaifer
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US14/166,604
• Publication Number:
  US 20140143830A1
• Time in Patent Office: 308 Days
• Field of Search: 726/1, 726/26, 713/153
• US Class Current: 726/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2216/03 Data mining
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/60 : Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: Y10S 707/922 : Communications

Abstract

Code is associated to a target based on an inspection of the code. A target may be a device or a user. A number of code components may be inspected at one time and then transferred or otherwise associated to a target based on the target'"'"'s profile. A code component may be a policy of an information management system.

Claims

1. A method comprising:

providing a plurality of code components, wherein each code component comprises a conditional expression having a policy abstraction and a corresponding action that will be performed when the conditional expression is satisfied;

providing a plurality of devices having device profiles;

inspecting contents of the plurality of code components;

based on a result of the inspection of the contents of the code components and the device profiles, determining which of the devices to associate a code component with;

using at least one processor, determining a first code component is relevant to a first device;

altering the first code component obtain a modified first code component; and

transferring the modified first code component, and not the first code component, to the first device, wherein the transferring the modified first code component to the first specific target comprises transferring less data than would transferring the first code component.

2. The method of claim 1 wherein each code component comprises a policy.

3. The method of claim 1 wherein each code component comprises a policy abstraction.

4. The method of claim 1 where a code component comprises at least one of a statement, a statement having at least one expression, a statement having at least one variable, a script, an uncompiled C language file, an uncompiled high-level programming language file, an ASCII file, an expression, an expression having at least one variable, a binary file, or an executable file.

5. The method of claim 1 wherein the first code component is provided in a first format and the method further comprises:

transforming the first code component into a second code component having a second format, different from the first format; and

transferring the second code component, and not the first code component, to a second device.

6. A method comprising:

providing a plurality of code components, wherein a code component comprises a conditional expression having a policy abstraction and a corresponding action that will be performed when the conditional expression is satisfied;

providing a plurality of devices having device profiles;

inspecting contents of the plurality of code components;

based on a result of the inspection of the contents of the code components and the device profiles, determining which of the devices to associate a code component with;

determining a first code component is relevant to a first device;

using at least one processor, altering the first code component obtain a modified first code component of a first policy; and

transferring the modified first code component, and not the first code component, to the first device, wherein the transferring the modified first code component to the first specific target comprises transferring less data than would transferring the first code component and the modified first code component includes a reference to a first policy abstraction whose definition statement is not transferred with the modified first code component.

7. The method of claim 6 wherein a first conditional expression comprises a first Boolean expression comprising at least a first Boolean function and at least a second Boolean function and the altering the first code component obtain a modified first code component of a first policy comprises removing at least the second Boolean function.

8. The method of claim 7 wherein transferring the modified first code component, and not the first code component, to the first device comprises transferring at least the first Boolean function and not the second Boolean function.

9. The method of claim 6 wherein the modified first code component that is transferred to the first specific target provides a rule input for a first program executing at the first specific target, and the first program determines whether a second program, executing at the first specific target, can access a file on a document server.

10. The method of claim 9 wherein the rule for the first program disallows access if the user has successfully accessed the file more than N times during a Y time period.

11. A method comprising:

providing a plurality of policies stored at a server, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, wherein each policy comprises a code component comprising a conditional expression having a policy abstraction and a corresponding action that will be performed when the conditional expression is satisfied, and each policy abstraction has a corresponding definition statement;

at the server, analyzing a first policy of the plurality of policies to determine whether the first policy is relevant to a first specific target profile with a first set of specific target attributes without inspecting a first code component of the first policy;

at the server, upon determining the first policy is relevant to the first specific target profile, inspecting the first code component of the first policy;

at the server, when the first policy is determined to be relevant to the first specific target profile, based upon the inspecting of the first code component of the first policy, altering the first code component of the first policy to obtain a modified first code component of the first policy;

when the first policy is determined to be relevant to the first specific target profile, transferring the first policy to a first specific target with the first specific target profile by transferring the modified first code component to the first specific target; and

when the first policy is determined not to be relevant to the first specific target profile, not transferring the first policy to the first specific target.

12. The method of claim 11 wherein the corresponding definition statement is stored separately from the policy.

13. The method of claim 11 wherein when the first policy is determined not to be relevant to the first specific target profile, not inspecting the first code component of the first policy.

14. The method of claim 11 wherein the modified first code component that is transferred to the first specific target provides a rule input for a first program executing at the first specific target, and the first program determines whether a second program, executing at the first specific target, can access a file on a document server.

15. The method of claim 14 wherein the rule for the first program disallows access if the user has successfully accessed the file more than N times during a Y time period.

16. The method of claim 11 wherein when executed at the first specific target, the modified first code component is logically equivalent to the first code component.

17. The method of claim 11 wherein the modified first code component will be executed at the first specific target using less execution time than the corresponding first code component.

18. The method of claim 11 wherein the transferring the modified first code component to the first specific target comprises transferring less data than would transferring the first code component to the first specific target.

19. The method of claim 11 wherein the modified first code component uses less memory than the first code component.