Distributed policy distribution for compliance functionality

Patent metadata

Field	Value
Publication number	US-10169723-B2
Application number	US-61633009-A
Country	US
Kind code	B2
Filing date	Nov 11, 2009
Priority date	Nov 11, 2009
Publication date	Jan 1, 2019
Grant date	Jan 1, 2019

Abstract

A multi-component auditing environment uses a set of log-enabled components that are capable of being triggered during an information flow in a data processing system. A “master” compliance component receives data from each log-enabled component in the set of log-enabled components, the data indicating a set of logging properties that are associated with or provided by that log-enabled component. The master compliance component determines, for a given compliance policy, which of a set of one or more events are required from one or more of the individual log-enabled components in the set of log-enabled components. As a result of the determining step, the master compliance component then configures one of more of the individual log-enabled components, e.g. by generating one or more configuration events that are then sent to the one or more individual components. This configuration may take place remotely, i.e., over a network connection. As a result of the information flow, audit or other logs are then collected from the log-enabled components. The master compliance component evaluates the collected logs to determine compliance with the compliance policy. As necessary, the master compliance component re-configures one or more log-enabled components in the set of log-enabled components to address any compliance issues arising from the evaluation. Thus, once a given compliance policy is specified, typically the individual log-enabled components in the multiple-component environment are not responsible for their own configuration, as that task is undertaken by the master compliance component.

First claim

Having described our invention, what we now claim is as follows:

1. A method for automated policy compliance in a data processing system comprising:
configuring a set of log-enabled components in an audit environment that includes multiple diverse physical devices, at least one log-enabled component being of a first type and supported on a first of the multiple diverse physical devices, and at least one log-enabled component being of a second type distinct from the first type and supported on a second of the multiple diverse physical devices, wherein a log-enabled component is a software agent that captures log event data;
during an information flow, capturing, by each of the set of log-enabled components, log event data;
receiving, at a compliance server executing in hardware, logging property data from each log-enabled component in the set of log-enabled components, the logging property data distinct from the log event data captured by the log-enabled component during the information flow and indicating a set of one or more logging properties associated with the log-enabled component;
determining, at the compliance server, based at least in part on the logging property data received, which of a set of one or more log events are required from individual log-enabled components in the set of log-enabled components to support a compliance policy being managed by the compliance server;
configuring, by the compliance server, each log-enabled component in the set of log-enabled components to capture the one or more log events so determined for that individual log-enabled component, wherein configuring at least one log-enabled component in the set of log-enabled components includes restarting the log-enabled component and providing a directive to update a logging property otherwise set at that log-enabled component; and
evaluating logs collected from the set of log-enabled components to determine compliance with the compliance policy.

2. The method as described in claim 1 wherein the logs are evaluated by the compliance server.

3. The method as described in claim 1 wherein the set of logging properties for the log-enabled component identifies a set of log events that the log-enabled component is capable of logging.

4. The method as described in claim 1 wherein the set of logging properties for the log-enabled component identifies a configuration or a characteristic of a log file generated by the log-enabled component.

5. The method as described in claim 1 wherein the log-enabled component is one of: an audit log component, an error log component, a trace log component, and a combination of one or more such components.

6. The method as described in claim 1 wherein the configuring step is performed remotely as a web service.

7. The method as described in claim 1 further including tagging at least one log to identify that the at least one log-enabled component has been configured.

8. The method as described in claim 1 wherein the compliance policy is predefined.

9. The method as described in claim 1 wherein the compliance policy is a custom policy.

10. The method as described in claim 1 wherein the compliance policy is an enterprise compliance policy.

11. An apparatus for automated compliance processing comprising:
a set of log-enabled components positioned in an audit environment that includes multiple diverse physical devices, at least one log-enabled component being of a first type and supported on a first of the multiple diverse physical devices, and at least one log-enabled component being of a second type distinct from the first type and supported on a second of the multiple diverse physical devices, wherein a log-enabled component is a software agent that captures log event data during an information flow across the multiple diverse devices;
a processor;
a computer memory holding computer program instructions executed by the processor, the computer program instructions comprising:
program code to receive logging property data from each log-enabled component in a set of log-enabled components that are triggered during an information flow, wherein the information flow occurs in an audit environment that includes multiple diverse physical devices, at least one log-enabled component being of a first type and supported on a first of the multiple diverse physical devices, and at least one log-enabled component being of a second type distinct from the first type and supported on a second of the multiple diverse physical devices, wherein a log-enabled component is a software agent that captures log event data, the logging property data distinct from log event data captured by the log-enabled component during the information flow and indicating a set of one or more logging properties associated with the log-enabled component;
program code to determine, based at least in part on the logging property data received, which of a set of one or more log events are required from individual log-enabled components in the set of log-enabled components to support a compliance policy being managed by the apparatus, wherein the individual log-enabled components are not responsible for their own configuration and management;
program code to configure each log-enabled component in the set of log-enabled components to capture the one or more log events so determined for that individual log-enabled component, wherein the program code to configure restarts the log-enabled component and provides a directive to update a logging property otherwise set at one of the log-enabled components; and
program code to evaluate logs collected from the set of log-enabled components to determine compliance with the compliance policy.

12. The apparatus as described in claim 11 wherein the log-enabled components are one of: an audit log component, an error log component, a trace log component, and a combination of one or more such components.

13. The apparatus as described in claim 11 wherein the log-enabled component is configured remotely via a web service.

14. The apparatus as described in claim 11 wherein the compliance policy is predefined.

15. The apparatus as described in claim 11 wherein the compliance policy is a custom policy.

16. The apparatus as described in claim 11 wherein the compliance policy is an enterprise compliance policy.

17. The apparatus as described in claim 11 wherein the set of logging properties for the log-enabled components is one of: a set of log events that the log-enabled component is capable of logging, and a configuration or a characteristic of a log file generated by the log-enabled component.

18. A computer program product in a non-transitory computer readable medium for use in a data processing system for automated compliance processing, the computer program product holding computer program instructions which when executed by the data processing system perform operations comprising:
receiving logging property data from each log-enabled component in a set of log-enabled components that are triggered during an information flow, wherein the information flow occurs in an audit environment that includes multiple diverse physical devices, at least one log-enabled component being of a first type and supported on a first of the multiple diverse physical devices, and at least one log-enabled component being of a second type distinct from the first type and supported on a second of the multiple diverse physical devices, wherein a log-enabled component is a software agent that captures log event data, the logging property data distinct from log event data captured

Assignees

• Hinton Heather Maria
• Milman Ivan Matthew
• IBM

Inventors

• Hinton Heather Maria
• Milman Ivan Matthew

Classifications

• G06Q30/018

  Certifying business or products · CPC title

• G06Q10/06 Primary

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• G06Q10/06393

  Score-carding, benchmarking or key performance indicator [KPI] analysis · CPC title