BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 shows a diagram of distributed computing network connecting a server and clients.
FIG. 2 shows a more detailed diagram of a computer system which may be a client or server.
FIG. 3 shows a system block diagram of a computer system.
FIG. 4 shows a block diagram of a policy server that centrally manages policies that are used by workstations and servers according to a specific implementation of the invention.
FIG. 5 shows a block diagram of a number of workstations and document servers with policy enforcers installed and coexist within a system according to a specific implementation of the invention.
FIG. 6 shows a block diagram of minimal embodiments that utilize a number of workstations each with policy enforcers installed or a number of document servers each with policy enforcers installed according to a specific implementation of the invention.
FIG. 7 shows a block diagram of internal components of a policy server according to a specific implementation of the invention.
FIG. 8 shows a block diagram of the internal components of an intelligence server according to a specific implementation of the invention.
FIG. 9 shows a block diagram of an interceptor and a consequence applicator in a policy enforcement point (PEP) module according to a specific implementation of the invention.
FIG. 10 shows a block diagram of a policy enforcer that implements interception and enforcement functions using a PEP plug-in architecture according to a specific implementation of the invention.
FIG. 11 shows a block diagram of a policy enforcer installed on a workstation that controls access to files on the workstation according to the invention.
FIG. 12 shows a block diagram of a policy enforcer on a workstation enforcing access control to a nonfile system object according to the invention.
FIG. 13 shows a layer description of an implementation of a policy language system of the invention.
FIG. 14 shows the functional modes of an information system of the invention.
FIG. 15 shows an example of interactions between multiple policies and multiples policy abstractions and their interaction.
FIG. 16 shows an example of one policy and multiple policy abstractions, where one policy abstractions references other policy abstractions.
FIG. 17 shows accessing confidential document, seeking approval, with centralized decision.
FIG. 18 shows accessing confidential document, seeking approval, with distributed decision.
FIG. 19 shows blocking sending of a confidential document outside the company.
FIG. 20 shows encrypting a confidential document when copying to a removable device.
FIG. 21 shows sending of a confidential document between users who should observe separation of duties.
FIG. 22 shows an example of a deployment operation to a workstation of an information management system.
FIG. 23 shows an example of a deployment operation of rules associated with a user.
FIG. 24 shows an example of a push operation, pushing one set of rules to a workstation and another set of rules to a server.
FIGS. 25-50 show syntax diagrams for a specific implementation of a policy language, the Compliant Enterprise Active Control Policy Language (ACPL).
FIG. 51 provides a legend explaining the nodes used in FIGS. 25-50.
Patent Application
20070156659
