Techniques of transforming policies to enforce control in an information management system

• US 8,990,886 B2
• Filed: 09/24/2013
• Issued: 03/24/2015
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Nextlabs
• Inventors: Lim, Keng
• Primary Examiner(s): BAYOU, YONAS A
• Application Number:
  US14/035,595
• Publication Number:
  US 20140020054A1
• Time in Patent Office: 546 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2216/03 Data mining
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/60 : Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: Y10S 707/922 : Communications

Abstract

In an information management system, policies are deployed to targets and targets can evaluate the policies whether they are connected or disconnected to the system. The policies may be transferred to the target, which may be a device or user. Relevant policies may be transferred while not relevant policies are not. The policies may have policy abstractions.

Claims

1. A method of managing information of a network comprising:

providing a server handling a first policy language having access to a policy database;

providing a first device comprising a first decision engine to manage information accessible via the first device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language;

providing a second device comprising;

a first application program installed on the second device and managed by a second decision engine, wherein the second decision engine comprises a second policy language; and

a second application program installed on the second device and managed by a third decision engine, wherein the third decision engine comprises a third policy language;

translating a first policy of the policy database into the second policy language;

translating the first policy of the policy database into the third policy language; and

transferring the first policy in the second and third policy languages to the second device.

2. The method of claim 1 wherein the second and third policy languages are different policy languages.

3. The method of claim 1 wherein the first device comprises a first target profile and the second device comprises a second target profile, different than the first target profile.

4. The method of claim 3 wherein the second target profile comprises a first identifier corresponding to the first application program and a second identifier corresponding to the second application program.

5. The method of claim 1 wherein the translating a first policy of the policy database into the second policy language comprises modifying a first conditional statement of the first policy.

6. The method of claim 5 wherein the translating the first policy of the policy database into the third policy language comprises modifying the first conditional statement of the first policy.

7. The method of claim 1 wherein the policy database comprises a plurality of policies wherein each policy comprises a conditional statement having a policy abstraction and allowing execution of an application operation when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored separately from the policy.

8. The method of claim 1 wherein the second device comprises a firewall.

9. The method of claim 8 wherein operation of the firewall is altered by the first policy.

10. The method of claim 1 wherein the first and second devices are separate devices.

11. The method of claim 1 further comprising:

when at a first time the first policy evaluates to Boolean true, allowing the second device access to a first piece of information; and

when at a second time the first policy evaluates to Boolean false, denying the second device access to the first piece of information.

12. The method of claim 1 wherein the translating a first policy of the policy database into the second policy language comprises modifying a first policy abstraction of the first policy.

13. The method of claim 12 wherein the translating the first policy of the policy database into the third policy language comprises modifying the first policy abstraction of the first policy.

14. A method of managing information of a network comprising:

providing a server handling a first policy language having access to a policy database;

providing a first device with a first target profile comprising;

a first application program installed on the first device and managed by a first decision engine, wherein the first decision engine comprises a second policy language; and

a second application program installed on the first device and managed by a second decision engine, wherein the second decision engine comprises a third policy language;

translating a first policy of the policy database into the second policy language;

translating the first policy of the policy database into the third policy language;

transferring the first policy in the second and third policy languages to the first device;

receiving an updated first target profile for the first device;

selecting a second policy from the policy database based on the updated first target profile; and

transferring the second policy to the first device.

15. The method of claim 14 further comprising:

providing a second device comprising a second decision engine to manage information accessible via the second device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language.

16. The method of claim 14 wherein the transferring the second policy replaces the first policy at the first device.

17. The method of claim 14 wherein the first target profile for the first device comprises a user identity of a user of the first device.

18. The method of claim 17 wherein the updated first target profile comprises a first user, different than a second user of the first target profile.

19. The method of claim 14 wherein the first target profile for the first device comprises a machine type of the first device.

20. The method of claim 14 wherein the first decision engine executes on a second device.