Intelligent policy deployment

• US 9,531,595 B2
• Filed: 05/22/2012
• Issued: 12/27/2016
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Nextlabs
• Inventors: Lim, Keng
• Primary Examiner(s): Wu, Yicun
• Application Number:
  US13/477,958
• Publication Number:
  US 20120233216A1
• Time in Patent Office: 1,680 Days
• Field of Search: 707/781, 709/200, 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64

Abstract

In an information management system, relevant policies are deployed to targets while policies which are not relevant are not. By deploying relevant policies, this reduces the amount of space requirements at the target to store the policies and the amount of data that needs to be sent to the target. Also, execution speed at the target may increase since the target does not need to evaluate policies that are not relevant.

Claims

1. A method comprising:

providing a plurality of policies, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, and each policy comprises a conditional statement having a policy abstraction and a corresponding action that will be performed when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored separately from the policy;

using at least one processor implemented in hardware, analyzing a first policy to determine whether that policy is relevant to a first specific target device with a set of specific target attributes;

determining the first policy comprising a corresponding first conditional statement having a corresponding first definition statement and a first action is relevant when a value of at least one of the specific target attributes is used during an evaluation of the first policy and allowing the first action to be performed at the first specific target device, wherein the first policy and the first conditional statement are stored at the first specific target device and the first definition statement corresponding to the first conditional statement is stored separately from the first specific target device;

allowing the first action to proceed if the first conditional statement evaluates to a Boolean true based on a first specific target attribute of the at least one of the specific target attributes of the first specific target device; and

preventing the first action from proceeding if the first conditional statement evaluates to a Boolean false based on the first specific target attribute of the at least one of the specific target attributes of the first specific target device.

2. The method of claim 1 comprising:

after the first action is allowed to be performed at the first specific target device, altering the first conditional statement and without transferring the first policy to the first specific target device.

3. The method of claim 2 comprising:

after altering the first conditional statement at a server and without transferring the first policy to the first specific target device, evaluating the first conditional statement which results in allowing performing of the first action at the first specific target device.

4. The method of claim 1 comprising:

when the policy is determined to be relevant, transferring the policy to a specific target having the specific target profile; and

when the policy is determined to not be relevant, not transferring the policy to the specific target having the specific target profile.

5. The method of claim 1 wherein the altering the first conditional statement and without transferring the first policy to the first specific target device comprises adding an event to the first policy that will trigger an evaluation of the first conditional statement, wherein the event cannot occur at the first specific target device.

6. The method of claim 5 further comprising after the adding an event to the first policy, transferring the first policy to the second specific target, wherein the event can occur at a second specific target.

7. The method of claim 1 further comprising:

determining the first policy is not relevant to a second specific target profile and not transferring the first policy to a second specific target with the second specific target profile.

8. The method of claim 7 further comprising:

at the first specific target device, evaluating the first conditional statement which results in allowing performing of the first action at the first specific target device.

9. The method of claim 1 wherein the each policy abstraction has a corresponding definition statement stored separately from the policy comprises the policy abstraction stored at a first computer and the corresponding definition statement stored at a second computer.

10. The method of claim 9 wherein the first computer comprises the first specific target device.

11. The method of claim 1 wherein the first specific target profile includes a group of users that access the first specific target device.

12. The method of claim 1 wherein the first policy is relevant when it specifies access control to documents accessed at the first specific target device.

13. The method of claim 12 wherein the first policy is relevant when it specifies access control to documents accessed at the first specific target device further comprises access control based on an application program at the first specific target device.

14. A method comprising:

providing a plurality of policies stored at a server, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, wherein each policy comprises a conditional statement having a policy abstraction and a corresponding action that will be performed when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored separately from the policy;

analyzing a first policy of the plurality of policies to determine whether the first policy is relevant or irrelevant to a first specific target profile with a first set of specific target attributes;

determining the first policy is relevant to the first specific target profile and transferring the first policy to a first specific target with the first specific target profile and causing storing in a memory of the first specific target a first conditional statement having a first abstraction and a first action of the first policy, wherein a first definition statement corresponding to the first conditional statement is stored separately from the first specific target;

at the first specific target, evaluating the first conditional statement which results in allowing performing of the first action at the first specific target, wherein the first conditional statement references the first policy abstraction;

allowing the first action to proceed if the first conditional statement of the first policy evaluates to a Boolean true; and

preventing the first action from proceeding if the first conditional statement of the first policy evaluates to a Boolean false.

15. The method of claim 14 comprising:

after the first action is allowed to be performed at the first specific target by the stored first policy, altering the first policy abstraction at a first location, separate from the first specific target without retransferring the first policy to the first specific target.

16. The method of claim 15 comprising:

after altering the first policy abstraction at a first location, separate from the first specific target, and without retransferring the first policy to the first specific target, evaluating the first conditional statement which results in not allowing performing of the first action at the first specific target.

17. A system comprising:

a policy server storing a plurality of policies, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, and each policy comprises a conditional statement having a policy abstraction and a corresponding action that will be performed when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored separately from the policy;

a rule evaluation module at a client computer which analyzes a first policy of the plurality of policies to determine whether that policy is relevant to a first specific target profile with a set of specific target attributes; and

a policy enforcement module at the client computer which determines based on the first policy and a first action whether to allow the first action to be performed at the first specific target, wherein the first policy comprises a first conditional statement, the first conditional statement having a first definition statement stored at a location separate from the client computer.

18. The system of claim 17 wherein the first definition statement is retrieved by the client computer after the first action.

19. The system of claim 18 wherein the first specific target profile corresponds to the client computer.

20. The system of claim 17 wherein the server and client computer are different computers connected by a network connection.