Method of customizing a standardized it policy

• US 20070204324A1
• Filed: 02/27/2006
• Published: 08/30/2007
• Est. Priority Date: 02/27/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Rawlins, Rudy, Roberts, Phillip, Hanson, Ron
• Granted Patent: US 8,332,906 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A system and method are described herein for standardizing an IT policy that is used to configure devices operating on a network. An IT policy can be generated that applies to a group of users or to one or more special users without having to define and store a new IT policy for each special user. This can be achieved by specifying global and per-user IT policy rules and merging these rules as needed to produce IT policy data.

Claims

1. A method of providing IT policy data to configure devices associated with a group of users, wherein the IT policy data is customizable on a per-user basis and the method comprises:

defining global IT policy rules with associated settings that are applicable to all users within the group of users;

defining user IT policy rules with associated settings that are applicable to a special user within the group of users;

generating IT policy data based on IT policy rules applicable to users within the group; and

sending appropriate IT policy data to the corresponding users within the group.

2. The method of claim 1, wherein the generating step comprises:

generating global IT policy data based on settings for the global IT policy rules;

generating per-user IT policy data based on settings for the per-user IT policy rules; and

merging the global IT policy data and the per-user IT policy data to produce merged IT policy data.

3. The method of claim 2, wherein the merging step comprises overriding settings in the global IT policy data with settings in the per-user IT policy data for conflicting IT policy rules in the global and per-user IT policy data.

4. The method of claim 2, wherein both the global and per-user IT policy rules comprise grouped IT policy rules with associated sub-IT policy rules, and during the merging step, the global and per-user IT policy data corresponding to sub-IT policy rules associated with one of the grouped IT policy rules are grouped together.

5. The method of claim 1, wherein the method comprises storing IT policy rules in an IT policy table, the IT policy rules comprising the global IT policy rules and the per-user IT policy rules, and the method further comprises using a field in the IT policy table to indicate whether a given IT policy rule is settable on a per-user basis.

6. The method of claim 1, wherein the method further comprises storing global IT policy data for a global IT policy, and storing per-user IT policy data for a per-user IT policy.

7. The method of claim 2, wherein the sending step comprises sending the global IT policy data to all of the users in the group that do not have any applicable per-user IT policy data.

8. The method of claim 2, wherein the sending step comprises sending the merged global IT policy data to the special user within the group.

9. The method of claim 2, wherein if at least one of the global IT policy data and the per-user IT policy data is updated, the method further comprises sending the appropriate IT policy data to the corresponding users within the group.

10. The method of claim 1, wherein the generating step comprises using tag-length-value encoding for generating IT policy data based on IT policy rules.

11. The method of claim 1, wherein the sending step comprises adding a header to the appropriate IT policy data to add security data, and to format the appropriate IT policy data for transmission to the devices.

12. The method of claim 1, wherein the sending step comprises sending the appropriate IT policy data to the devices via one of a wireless connection for a wireless network, and a wired connection for a wired network.

13. A computer program product comprising a computer readable medium embodying program code means executable by a processor for performing a method for providing IT policy data to configure devices associated with a group of users on a network, wherein the IT policy data is customizable on a per-user basis and the method comprises:

defining global IT policy rules with associated settings that are applicable to all users within the group of users;

defining user IT policy rules with associated settings that are applicable to a special user within the group of users;

generating IT policy data based on IT policy rules applicable to users within the group; and

sending appropriate IT policy data to the corresponding users within the group.

14. The computer program product of claim 13, wherein the method further comprises:

generating global IT policy data based on settings for the global IT policy rules;

generating per-user IT policy data based on settings for the per-user IT policy rules; and

merging the global IT policy data and the per-user IT policy data to produce merged IT policy data.

15. An IT policy server for providing IT policy data to configure devices associated with a group of users on a network, wherein the IT policy data is customizable on a per-user basis and the IT policy server comprises:

a) a processor adapted to generate the IT policy data;

b) a network interface connected to the processor, the network interface being adapted to allow the IT policy server to communicate with the network; and

c) a memory unit connected to the processor, the memory unit being adapted to store applications and data related to the IT policy, wherein, the processor stores global IT policy rules with associated settings that are applicable to all users within the group of users;

stores user IT policy rules with associated settings that are applicable to a special user within the group of users, generates the IT policy data based on IT policy rules applicable to users within the group, and sends appropriate IT policy data to the corresponding users within the group.

16. The IT policy server of claim 15, wherein the processor generates the IT policy data by generating global IT policy data based on settings for the global IT policy rules, generating per-user IT policy data based on settings for the per-user IT policy rules, and merging the global IT policy data and the per-user IT policy data to produce merged IT policy data.

17. The IT policy server of claim 16, wherein during merging, the IT policy server overrides settings in the global IT policy data with settings in the per-user IT policy data for conflicting IT policy rules in the global and per-user IT policy data.

18. The IT policy server of claim 16, wherein both the global and per-user IT policy rules comprise grouped IT policy rules with associated sub-IT policy rules, and during merging, the IT policy server groups together global and per-user IT policy data corresponding to sub-IT policy rules associated with one of the grouped IT policy rules.

19. The IT policy server of claim 15, wherein the IT policy server stores IT policy rules in an IT policy table, the IT policy rules comprise the global IT policy rules and the per-user IT policy rules, and the IT policy table comprise a field to indicate whether a given IT policy rule is settable on a per-user basis.

20. The IT policy server of claim 15, wherein the IT policy server stores global IT policy data for a global IT policy, and per-user IT policy data for a per-user IT policy.

21. The IT policy server of claim 16, wherein the IT policy server sends the global IT policy data to all of the users in the group that do not have any applicable per-user IT policy data.

22. The IT policy server of claim 16, wherein the IT policy server sends the merged global IT policy data to the special user within the group.

23. The IT policy server of claim 15, wherein the IT policy server uses tag-length-value encoding for generating IT policy data based on IT policy rules.

24. The IT policy server of claim 15, wherein the IT policy server adds a header to the appropriate IT policy data to add security data, and to format the appropriate IT policy data for transmission to the devices.