# US 8,544,058 B2 · Techniques of transforming policies to enforce control in an information management system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,058 B2
- Document ID: US8544058B2
- Status: Granted
- Kind: B2
- Application number: 11/929,167
- Filed: 2007-10-30
- Published: 2008-03-13
- Granted: 2013-09-24
- Earliest claimed: 2005-12-29
- Assignees: NextLabs, Inc.
- Applicants: Keng Lim
- Inventors: Keng Lim
- Web page: https://patentgrep.com/patent/US8544058B2

## CPC

- G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06F 3/0601: {Interfaces specially adapted for storage systems}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/176: Support for shared access to files; File sharing support
- G06F 16/93: Document management systems
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F 21/125: {by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code}
- G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06Q 10/10: Office automation; Time management
- H04L 51/234: for tracking messages
- H04L 63/0263: {Rule management}
- H04L 63/0272: {Virtual private networks}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/102: {Entity profiles}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/303: Terminal profiles
- H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)}
- H04L 67/60: Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70)
- G06F 2216/03: Data mining
- G06F 2221/032: Protect output to user by software means
- Y10S 707/922: Communications
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- Y10S: TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS

## Abstract

In an information management system, policies are deployed to targets and targets can evaluate the policies whether they are connected or disconnected to the system. The policies may be transferred to the target, which may be a device or user. Relevant policies may be transferred while not relevant policies are not. The policies may have policy abstractions.

## Claims

### Claim 1

A method comprising:
providing a plurality of policies stored at a server handling a first policy language having access to a policy database, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes;
providing a first device with a first target profile comprising a first decision engine to manage information accessible via the device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language;
providing a second device with a second target profile that handles second and third policy languages;
receiving at the server that the second device handles second and third policy languages;
after the receiving at the server, translating a first policy of the policy database further comprising:
determining the second device is executing a first application program corresponding to a second decision engine handling the second policy language;
determining the second device is executing a second application program corresponding to a third decision engine handling the third policy language;
translating the first policy into the second policy language to manage information accessible by the first application program; and
translating the first policy into the third policy language to manage information accessible by the second application program;
transferring the first policy in the second policy language to the second device, wherein the second device contains a plurality of policies and the plurality of policies manage information accessible at the second device;
determining using the second decision engine whether to grant access to a first piece of information by the first application program stored at the second device by evaluating a first conditional statement of the first policy in the second policy language;
when at a first time the first conditional statement of the first policy evaluates to Boolean true, allowing the second device access to the first piece of information; and
when at a second time the first conditional statement of the first policy evaluates to Boolean false, denying the second device access to the first piece of information.

### Claim 2 (depends on 1)

The method of claim 1 further comprising:
transferring the first policy in the first policy language to the first device.

### Claim 3 (depends on 1)

The method of claim 1 wherein the second device is a firewall of the network and the method further comprises:
altering operation of the firewall based on the first policy in the second policy language.

### Claim 4 (depends on 1)

The method of claim 1 wherein the first policy language comprises policy abstractions, and the second policy language does not comprise policy abstractions.

### Claim 5 (depends on 1)

The method of claim 1 wherein the translating the first policy of the policy database into the second policy language comprises translating the policy abstractions of the first policy language to the second policy language.

### Claim 6 (depends on 1)

The method of claim 1 further comprising:
determining whether to grant access to a second piece of information stored at the second device by evaluating the first conditional statement of the first policy in the second policy language;
when at a third time the first conditional statement of the first policy evaluates to Boolean true, allowing the second device access to the second piece of information; and
when at a fourth time the first conditional statement of the first policy evaluates to Boolean false, denying the second device access to the second piece of information.

### Claim 7 (depends on 6)

The method of claim 6 wherein the first piece of information and the second piece of information are different.

### Claim 8 (depends on 1)

The method of claim 1 wherein the first device and the second device are different.

### Claim 9 (depends on 1)

The method of claim 1 wherein the second time is after the first time.

### Claim 10 (depends on 1)

The method of claim 1 comprising:
not transferring the first policy in the first policy language to the second device.

### Claim 11 (depends on 1)

The method of claim 1 wherein the translating a first policy of the policy database into the second policy language is performed at the server before the transferring the first policy in the second policy language to the second device.

### Claim 12 (depends on 1)

The method of claim 1 wherein the second device cannot handle evaluating a policy in the first policy language.

### Claim 13 (depends on 1)

The method of claim 1 comprising:
after transferring the first policy in the second policy language to the second device, storing the first policy of the second policy language in a nonvolatile memory at the second device;
receiving a request by a user at the second device executing an application program to open a second piece of information stored at the first device; and
determining whether to grant access to the user for the second piece of information stored at the first device by evaluating a second conditional statement of the first policy in the second policy language.

### Claim 14 (depends on 1)

The method of claim 1 comprising:
receiving a request by a user at the first device executing an application program to open a second piece of information stored at the second device; and
determining whether to grant access to the user for the second piece of information stored at the second device by evaluating a second conditional statement of the first policy in the second policy language.

### Claim 15 (depends on 1)

The method of claim 1 comprising:
at the second device, receiving a request to access a second piece of information stored at the server;
determining that a third policy associated with the determining access to the second piece of information is not stored at the second device;
from the second device, sending a request to the server for the second piece of information;
at the server, evaluating the third policy associated with the determining access to the second piece of information; and
when the third policy at the server evaluates to permit access, allowing the second device to access the second piece of information.

### Claim 16 (depends on 1)

The method of claim 1 wherein the determining whether to grant access to a first piece of information prevents a first access and a second access to the first piece of information using the first policy, wherein the first access and the second access are equivalent functions.

### Claim 17 (depends on 16)

The method of claim 16 wherein the first access is executed using a context-menu item and the second access is executed using a button item.

### Claim 18 (depends on 17)

The method of claim 17 wherein the second target profile for the second device is based on a user identity of a user of the second device.

### Claim 19 (depends on 16)

The method of claim 16 wherein the first access is a save operation and the second access is a save as operation.

### Claim 20 (depends on 16)

The method of claim 16 wherein the first access is a save operation and the second access is a copy operation.

### Claim 21 (depends on 16)

The method of claim 16 wherein the first access is a save operation and the second access is a drag-and-drop operation.

### Claim 22 (depends on 1)

The method of claim 1 wherein the second target profile for the second device is based on a machine type of the second device.

### Claim 23 (depends on 1)

The method of claim 1 further comprising:
transferring the first policy in the third policy language to the second device; and
determining using the third decision engine whether to grant access to a second piece of information by the second application program accessible to the second device by evaluating a first conditional statement of the first policy in the third policy language.

### Claim 24 (depends on 23)

The method of claim 23 wherein second and third decision engines are same.

### Claim 25 (depends on 23)

The method of claim 23 wherein second and third decision engines are different.

### Claim 26 (depends on 1)

The method of claim 1 further comprising preventing transmission of the first policy in the first policy language to the second device.

### Claim 27 (depends on 1)

The method of claim 1 wherein the first application program executing on the second device is a file explorer application.

### Claim 28 (depends on 27)

The method of claim 27 wherein the second application program executing on the second device comprises an e-mail application.

### Claim 29 (depends on 27)

The method of claim 27 wherein the second application program executing on the second device comprises a web browser application.

### Claim 30 (depends on 1)

The method of claim 1 wherein the translating a first policy of the policy database executes at a logon of a user onto the first device.

### Claim 31 (depends on 1)

The method of claim 1 wherein the second target profile includes at least one of the host name of the second device or the internet protocol address of the second device.

### Claim 32

A method comprising:
providing a plurality of policies stored at a server handling a first policy language having access to a policy database, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes, wherein each policy comprises a conditional statement having a policy abstraction and allowing execution of an application operation when the conditional statement is satisfied, and each policy abstraction has a corresponding definition statement stored separately from the policy;
providing a first device with a first target profile comprising a decision engine to control application operation on the device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language;
providing a second device with a second target profile;
at the server, analyzing a first policy of the plurality of policies to determine whether the first policy is relevant or irrelevant to the second target profile with a second set of target attributes further comprising:
determining the second device is executing a first application program corresponding to a second policy language;
determining the second device is executing a second application program corresponding to a third policy language;
translating the first policy into the second policy language to manage information accessible by the first application program; and
translating the first policy into the third policy language to manage information accessible by the second application program;
transferring the first policy in the second policy language to the second device;
determining whether to allow execution of an application operation at the second device, by evaluating a first conditional statement of the first policy in the second policy language;
when at a first time the first conditional statement of the first policy evaluates to Boolean true, allowing the application operation; and
when at a second time the first conditional statement of the first policy evaluates to Boolean false, denying the application operation.

### Claim 33 (depends on 32)

The method of claim 32 further comprising:
transferring the first policy in the first policy language to the first device.

### Claim 34 (depends on 32)

The method of claim 32 wherein the second device is a firewall of the network and the method further comprises:
altering operation of the firewall based on the first policy in the second policy language.

### Claim 35 (depends on 32)

The method of claim 32 wherein the translating the first policy of the policy database into the second policy language comprises translating the policy abstractions of the first policy language to the second policy language.

### Claim 36 (depends on 32)

The method of claim 32 wherein the first policy in the second policy language requires fewer processing cycles when evaluated at the second device than the first policy in the first policy language.

### Claim 37 (depends on 32)

The method of claim 32 wherein the second target profile indicates the second device can handle e-mail messages and calendar functions.

### Claim 38 (depends on 37)

The method of claim 37 wherein the second target profile further indicates the second device is denied file access.

### Claim 39 (depends on 32)

The method of claim 32 further comprising:
detecting an updated second target profile for the second device; and
selecting a second policy from the plurality of policies stored at the server based on the updated second target profile.

### Claim 40 (depends on 32)

The method of claim 32 further comprising:
identifying a first portion of the first policy as irrelevant based on the first target profile;
identifying the first portion of the first policy as relevant based on the second target profile; and
transferring the first policy in the first policy language, wherein the first policy in the first policy language does not include the first portion.

### Claim 41 (depends on 40)

The method of claim 40 wherein the first portion evaluates to a Boolean true at the first device.

### Claim 42

A method comprising:
providing a plurality of policies stored at a server handling a first policy language having access to a policy database, wherein the policies are applicable to a plurality of target profiles, each target profile having a set of target attributes;
providing a first device with a first target profile comprising a decision engine to manage information accessible via the device according to a first set of policies stored on the device, wherein the first set of policies is associated with the first policy language;
providing a second device with a second target profile that handles second and third policy languages;
translating a first policy of the policy database further comprising:
determining the second device is executing a first application program corresponding to a second decision engine handling the second policy language;
determining the second device is executing a second application program corresponding to a third decision engine handling the third policy language;
translating the first policy into the second policy language to manage information accessible by the first application program; and
translating the first policy into the third policy language to manage information accessible by the second application program;
transferring the first policy in the second policy language to the second device; and
determining whether to grant access to a first piece of information stored at the second device by evaluating the first policy in the second policy language comprising:
for the first application program at the second device, denying a first operation; and
for the second application program at the second device, denying a second operation, wherein the first operation and the second operation are equivalent.

### Claim 43 (depends on 42)

The method of claim 42 wherein the first application program and the second application program are different.

### Claim 44 (depends on 42)

The method of claim 42 wherein the first application is an e-mail application and the second application is a file access command of a operating system of the second device.

### Claim 45 (depends on 42)

The method of claim 42 wherein the first application is a web browser and the second application is a file server.