Techniques and System to Deploy Policies Intelligently

• US 20070156659A1
• Filed: 12/22/2006
• Published: 07/05/2007
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Blue Jungle
• Inventors: Lim, Keng
• Granted Patent: US 7,716,240 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64

Abstract

In an information management system, relevant policies are deployed to targets while policies which are not relevant are not. By deploying relevant policies, this reduces the amount of space requirements at the target to store the policies and the amount of data that needs to be sent to the target. Also, execution speed at the target may increase since the target does not need to evaluate policies that are not relevant.

Claims

1. A method comprising:

providing a plurality of policies, wherein the policies are applicable to a plurality of target profiles, each having a set of target attributes;

analyzing a policy to determine whether that policy is relevant to a specific target profile with a set of specific target attributes; and

determining a policy is relevant when a value of at least one of the specific target attributes is used during an evaluation of the policy.

2. The method of claim 1 wherein the at least one of the specific target attributes specifies a capability of a target having the specific target profile.

3. The method of claim 1 wherein the at least one of the specific target attributes specifies the device type of a target having the specific target profile.

4. The method of claim 1 wherein the at least one of the specific target attributes specifies the location of a target having the specific target profile.

5. The method of claim 1 wherein the at least one of the specific target attributes specifies at least one user at a target having the specific target profile.

6. The method of claim 1 wherein the at least one of the specific target attributes specifies at least one application program running at a target having the specific target profile.

7. The method of claim 1 wherein the target attributes specify at least one of capability, device type or location, or user or application.

8. The method of claim 1 wherein the plurality of policies comprises policy abstractions.

9. A method comprising:

providing a plurality of policies, wherein the policies are applicable to a plurality of target profiles, each having a set of target attributes;

analyzing a policy to determine whether that policy is relevant or irrelevant to a specific target profile with a set of specific target attributes; and

transferring relevant policies to a specific target with the specific target profile and not transferring irrelevant policies to the specific target.

10. The method of claim 9 further comprising:

determining a policy is relevant when a value of at least one of the specific target attributes is used during an evaluation of the policy.

11. The method of claim 9 further comprising:

determining a policy is irrelevant when the policy has no event that can occur at the specific target.

12. The method of claim 11 wherein the event is a send operation.

13. The method of claim 11 wherein the event is an order submission operation.

14. The method of claim 11 wherein the event is a print operation.

15. The method of claim 11 where in the event is an HTTP request operation.

16. The method of claim 9 further comprising:

providing a specific policy that controls access to information at a specific target;

determining the specific policy is irrelevant to the specific target because access to the information cannot occur at the specific target.

17. The method of claim 16 wherein the information comprises files on a file server, and the specific target comprises a device without capability to access a file server.

18. The method of claim 16 wherein the information comprises a spreadsheet file, and the specific target comprises a smart phone without a software program capable of displaying the spreadsheet file.

19. The method of claim 9 further comprising:

providing a specific policy that allows a specific action at a specific target;

determining the specific policy is irrelevant to the specific target because the specific action cannot occur at the specific target.

20. The method of claim 19 wherein the specific action is sending an e-mail.

21. The method of claim 19 wherein the specific action is opening a document.

22. The method of claim 19 wherein the specific action is a cut and paste.

23. The method of claim 9 further comprising:

providing a specific policy that denies access to information when a condition is met;

determining the specific policy is irrelevant to the specific target because the condition cannot be met at the specific target.

24. The method of claim 23 wherein the condition comprises forwarding an e-mail message, and the specific target comprises a file server without a capability to process e-mail messages.

25. The method of claim 9 further comprising:

when at least one of the specific target attributes of the specific target profile changes, reanalyzing the policy to determine whether that policy is relevant or irrelevant; and

retransferring relevant policies to the specific target with the specific target profile with the changed specific target attributes.

26. The method of claim 9 further comprising:

when at least one of the specific target attributes of the specific target profile changes, reanalyzing the policy to determine whether that policy is relevant or irrelevant; and

retransferring relevant policies changes to the specific target with the specific target profile with the changed specific target attributes.

27. The method of claim 25 wherein a specific target attribute of the specific target profile that changes is related to a location change of the specific target.

28. The method of claim 25 wherein a specific target attribute of the specific target profile that changes is related to a change in a user who is logged into the specific target.

29. The method of claim 25 wherein a specific target attribute of the specific target profile that changes is related to a network address change of the specific target.

30. The method of claim 9 further comprising:

disconnecting the specific target from a system and then subsequently reconnecting the specific target to the system;

after reconnecting the specific target to the system, reanalyzing the policy to determine whether the policy is relevant or irrelevant to the specific target; and

after reanalyzing the policy, retransferring relevant policies to the specific target with the specific target profile.

31. The method of claim 9 wherein the plurality of policies comprises policy abstractions.

32. A method comprising:

providing a plurality of policies applicable to a plurality of targets, each target having a set of capabilities, wherein a policy comprises an expression and an event;

determining whether a policy is relevant or irrelevant to a specific target; and

transferring relevant policies to the specific target and not transferring irrelevant policies to the specific target.

33. The method of claim 32 wherein the expression comprises a variable defined in a policy abstraction.

34. The method of claim 32 wherein the number of relevant policies is less than a total number of the plurality of policies applicable to a plurality of targets.

35. The method of claim 32 wherein the relevant policies are stored at the target.

36. The method of claim 32 wherein the irrelevant policies are not stored at the target.

37. The method of claim 32 further comprising:

evaluating the relevant polices at the target.

38. The method of claim 32 further comprising:

determining a policy is irrelevant to a specific target when the policy specifies an event requiring a capability not within the set of capabilities of the target.

39. The method of claim 32 wherein the plurality of policies comprises policy abstractions.