Back to results
US 8,544,058 B2Granted
Techniques of transforming policies to enforce control in an information management system
AssigneeNextLabs, Inc.
InventorKeng Lim
Life of this patent
Estimating the term…
Abstract
In an information management system, policies are deployed to targets and targets can evaluate the policies whether they are connected or disconnected to the system. The policies may be transferred to the target, which may be a device or user. Relevant policies may be transferred while not relevant policies are not. The policies may have policy abstractions.
Claims45
A method comprising:
- providing a plurality of policies stored at a server handling a first policy language having access to a policy database, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes;
- providing a first device with a first target profile comprising a first decision engine to manage information accessible via the device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language;
- providing a second device with a second target profile that handles second and third policy languages;
- receiving at the server that the second device handles second and third policy languages;
- after the receiving at the server, translating a first policy of the policy database further comprising:
- determining the second device is executing a first application program corresponding to a second decision engine handling the second policy language;
- determining the second device is executing a second application program corresponding to a third decision engine handling the third policy language;
- translating the first policy into the second policy language to manage information accessible by the first application program;
- and
- translating the first policy into the third policy language to manage information accessible by the second application program;
- transferring the first policy in the second policy language to the second device, wherein the second device contains a plurality of policies and the plurality of policies manage information accessible at the second device;
- determining using the second decision engine whether to grant access to a first piece of information by the first application program stored at the second device by evaluating a first conditional statement of the first policy in the second policy language;
- when at a first time the first conditional statement of the first policy evaluates to Boolean true, allowing the second device access to the first piece of information;
- and
- when at a second time the first conditional statement of the first policy evaluates to Boolean false, denying the second device access to the first piece of information.
12 more elements
A method comprising:
- providing a plurality of policies stored at a server handling a first policy language having access to a policy database, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, wherein each policy comprises a conditional statement having a policy abstraction and allowing execution of an application operation when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored separately from the policy;
- providing a first device with a first target profile comprising a decision engine to control application operation on the device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language;
- providing a second device with a second target profile;
- at the server, analyzing a first policy of the plurality of policies to determine whether the first policy is relevant or irrelevant to the second target profile with a second set of target attributes further comprising:
- determining the second device is executing a first application program corresponding to a second policy language;
- determining the second device is executing a second application program corresponding to a third policy language;
- translating the first policy into the second policy language to manage information accessible by the first application program;
- and
- translating the first policy into the third policy language to manage information accessible by the second application program;
- transferring the first policy in the second policy language to the second device;
- determining whether to allow execution of an application operation at the second device, by evaluating a first conditional statement of the first policy in the second policy language;
- when at a first time the first conditional statement of the first policy evaluates to Boolean true, allowing the application operation;
- and
- when at a second time the first conditional statement of the first policy evaluates to Boolean false, denying the application operation.
11 more elements
A method comprising:
- providing a plurality of policies stored at a server handling a first policy language having access to a policy database, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes;
- providing a first device with a first target profile comprising a decision engine to manage information accessible via the device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language;
- providing a second device with a second target profile that handles second and third policy languages;
- translating a first policy of the policy database further comprising:
- determining the second device is executing a first application program corresponding to a second decision engine handling the second policy language;
- determining the second device is executing a second application program corresponding to a third decision engine handling the third policy language;
- translating the first policy into the second policy language to manage information accessible by the first application program;
- and
- translating the first policy into the third policy language to manage information accessible by the second application program;
- transferring the first policy in the second policy language to the second device;
- and
- determining whether to grant access to a first piece of information stored at the second device by evaluating the first policy in the second policy language comprising:
- for the first application program at the second device, denying a first operation;
- and
- for the second application program at the second device, denying a second operation, wherein the first operation and the second operation are equivalent.
12 more elements
Dependencies are inferred from the claim text.