Policy Rule Evaluation via Common Subexpression Pre-computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large computer systems face resource-intensive challenges in enforcing policies due to numerous active policies, complex rule evaluations, and distributed enforcement points, leading to increased time and resource consumption, especially when access to information assets is requested by users.
Innovation Solution
A method that identifies common subexpressions between rules in policies, applies metadata to form partially evaluated rules, and stores these rules in association with information assets, reducing the computational resources needed for policy enforcement by compressing the rules into a more efficient form.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all rules in policies are fully evaluated at enforcement time, then policy enforcement accuracy is maintained, but system performance and availability deteriorate due to resource-intensive processing
Solution Approach 1:
The patent applies preliminary action by pre-evaluating common subexpressions in policy rules before enforcement time. The system identifies and evaluates shared subexpressions across multiple rules in advance, storing the results for reuse during actual policy enforcement. This eliminates redundant evaluation work while maintaining accurate policy decision-making, directly resolving the contradiction between enforcement accuracy and system performance.
Solution Approach 2:
The patent merges identical or similar subexpressions that appear across multiple policy rules into a single evaluated unit. By combining common evaluation logic into shared components, the system evaluates each unique subexpression only once and reuses the result across all rules that contain it. This merging approach maintains complete policy evaluation accuracy while dramatically reducing the total computational workload and improving system performance.
2Reliability
If policy rules are evaluated in real-time without optimization, then complete policy compliance is ensured, but resource consumption increases significantly
Solution Approach 1:
The system performs preliminary evaluation of common subexpressions before policy enforcement, storing the evaluation results for later reuse. This advance preparation ensures that when policies are enforced in real-time, the system can maintain complete compliance accuracy while consuming significantly fewer computational resources, as the expensive evaluation work has already been completed.
Solution Approach 2:
The patent creates and stores copies of evaluated subexpression results that can be reused across multiple rule evaluations. Instead of re-evaluating identical subexpressions repeatedly, the system copies the evaluation results and references them during policy enforcement. This copying mechanism guarantees policy compliance is maintained while dramatically reducing the computational energy required for each policy check.
3Measurement precision
If complex rule evaluations are performed for each policy, then accurate enforcement decisions are made, but evaluation time increases
Solution Approach 1:
The system applies preliminary action by evaluating common subexpressions in advance and caching the results. During actual policy enforcement, the system retrieves these pre-computed results instead of performing complex evaluations again. This approach maintains accurate enforcement decisions by ensuring all necessary evaluations are performed, while significantly reducing the time required for each policy check by eliminating redundant computation.
Solution Approach 2:
The patent segments policy rules into distinct subexpressions, identifying which portions are common across multiple rules and which are unique. By segmenting the evaluation process this way, the system can evaluate common subexpressions once and reuse them across multiple rules, while still performing the necessary unique evaluations. This segmentation strategy maintains complete evaluation accuracy while reducing total evaluation time through intelligent reuse of intermediate results.
Data Source
AI summary
A method, apparatus, system, and computer program product evaluate an information asset with a corpus of policies in conjunction with the context of access including a specific user. A large corresponding set of rules in the policy corpus are identified by computer system. A continuous process of rule evaluation occurs against information asset metadata wherein a series of processing including set of common subexpressions between the predicates of all active rules, pre-evaluation, compaction and storage are identified by the computer system in the policy and rule corpus. Metadata for the information asset is applied by the computer system to the set of common subexpressions to form partially evaluated rules for the policy. The partially evaluated rules henceforth compacted are stored by the computer system in association with the information asset. Subsequently the partially evaluated rules are a compressed form of the rule corpus for the policies in the system and hence reduce computer resources and significantly improve the response tome used to evaluate the enforcement decision for the said information asset with the policy in conjunction with the context of access. The process can be repeated each time at least one of the metadata or the policy changes to provide continuous processing of rules to maintain compacted up-to-date partially evaluated rules to enforce the policy.