Data consistency of policy enforcement for distributed applications

Patent metadata

Field	Value
Publication number	US-10560349-B2
Application number	US-201815885650-A
Country	US
Kind code	B2
Filing date	Jan 31, 2018
Priority date	Jan 31, 2018
Publication date	Feb 11, 2020
Grant date	Feb 11, 2020

Abstract

Systems, methods, and computer-readable media for providing a Policy Enforcement as a Service (PEaaS) are described. A processor may, in response to identification of a suspension of user(s) for one of one or more services, generate a suspension value indicative of the suspension and transmit the suspension value to a corresponding one of third party platforms of the service(s), respectively. The suspension value usable by the corresponding third party platform to determine whether to deny request(s) from the user for the distributed service, or not. A service of the service(s) comprises a distributed service provided by a plurality of hosts. In response to the service corresponding to the suspension including the distributed service, the suspension value may be transmitted to the first host, and the suspension value may be propagated to the one or more second hosts, respectively. Other embodiments may be described and/or claimed.

First claim

The invention claimed is:

1. A computing system to provide a Policy Enforcement as a Service (PEaaS) to a third party platform (TPP), the TPP comprising a plurality of hosts providing a distributed service, the computing system, comprising:
a processing system; and
a memory device coupled to the processing system, the memory device and including instructions stored thereon, wherein execution of the instructions by the processing system is to cause the processing system to:
collect a set of policy parameter values from the TPP, the set of policy parameter values defining when a user is to be suspended from accessing the distributed service;
collect usage metrics from respective hosts of the plurality of hosts via respective interfaces between each host and the computing system, the usage metrics indicating usage of the distributed service by one or more users that interact with the respective hosts;
compare each of the usage metrics to the sets of policy parameter values; and
in response to identification of a suspension of one user of the one or more users that interacts with one host of the plurality of hosts based on the comparison,
generate a suspension value indicative of the suspension,
control transmission of the suspension value to the one host via an interface between the one host and the computing system, and
propagate the suspension value to each other host of the plurality of hosts via the respective interfaces, the suspension value usable by each host to determine whether to deny the one user access to the distributed service.

2. The computing system of claim 1 , wherein, to propagate the suspension value to each other host, execution of the instructions by the processing system is operable to perform operations including:
identify one or more synchronization requests from each other host, respectively; and
control transmission of one or more responses to the one or more synchronization requests, respectively, wherein each of the one or more responses includes the suspension value.

3. The computing system of claim 2 , wherein the sets of policy parameter values comprise one or more propagation interval values for the TPP, and wherein the one or more synchronization requests are based on a corresponding one of the one or more propagation interval values.

4. The computing system of claim 3 , wherein the corresponding one of the one or more propagation interval values is taken from a selection from the TPP.

5. The computing system of claim 3 , wherein the corresponding one of the one or more propagation interval values comprises a default propagation interval value.

6. The computing system of claim 2 , wherein the one or more synchronization requests are received at one or more times, respectively, based on a same synchronization interval.

7. The computing system of claim 1 , wherein transmission of the suspension value to the one host is to take place prior to propagation of the suspension value to the other hosts.

8. The computing system of claim 1 , wherein the set of policy parameter values defines a threshold number of user requests for issuing a user suspension for a suspension period, and execution of the instructions by the processing system is operable to perform operations including:
determine whether the threshold has been met for the one user during a predetermined amount of time;
increment an infraction count when the threshold is determined to be met for the one user during the predetermined amount of time; and
generate the suspension value to indicate the suspension period when the infraction count is equal to a predetermined value.

9. The computing system of claim 8 , wherein the threshold number of user requests is a first threshold number of user requests, the suspension period is a first suspension period, and the set of policy parameter values further defines a second threshold number of user requests for issuing a user suspension for a second suspension period that is a longer period of time than the first suspension period, and execution of the instructions by the processing system is operable to perform operations including:
determine whether the second threshold has been met for the one user during the predetermined amount of time or another predetermined amount of time when the infraction count for the one user is greater than a predetermined value;
increment another infraction count when the second threshold is determined to be met for the one user during the predetermined amount of time or the other predetermined amount of time; and
generate the suspension value to indicate the second suspension period when the other infraction count is equal to the predetermined value or another predetermined value.

10. A method for providing a Policy Enforcement as a Service (PEaaS) to a third party platform (TPP), the TPP comprising a plurality of hosts providing a distributed service, the method comprising:
collecting, by a computing system, one or more sets of policy parameter values from the TPP, wherein each set of policy parameter values defines a criteria for issuing a user suspension for accessing the distributed service;
collecting, by the computing system, one or more usage metrics for the distributed services from respective hosts of the plurality of hosts via respective interfaces between each host and the computing system, the one or more usage metrics indicating usage of the distributed service by one or more users that interact with the respective hosts;
comparing, by the computing system, the one or more usage metrics to a corresponding one of the sets of policy parameter values; and
in response to identifying a suspension of one user of the one or more users that interacts with one host of the plurality of hosts based on the comparison,
generating a suspension value indicating the suspension of the one user, the suspension value being usable by respective hosts to determine whether to grant or deny the one user access to the distributed service;
transmitting the suspension value to the one host via one of the respective interfaces that is between the one host and the computing system; and
propagating the suspension value to each of the other hosts via the respective interfaces.

11. The method of claim 10 , wherein propagating the suspension value to the one or more second hosts at the one or more second times, respectively, further includes:
identifying one or more synchronization requests from the respective hosts, respectively; and
transmitting one or more responses to the one or more synchronization requests, respectively, wherein each of the one or more responses includes the suspension value.

12. The method of claim 11 , wherein the one or more sets of policy parameter values comprise one or propagation interval values for the TPP, and wherein the one or more synchronization requests are based on a corresponding one of the one or more propagation interval values.

13. The method of claim 12 , wherein the corresponding one of the one or more propagation interval values is taken from a selection from a corresponding one of the plurality of hosts.

14. The method of claim 12 , wherein the corresponding one of the one or more propagation interval values comprises a default propagation interval value.

15. The method of claim 11 , wherein the one or more synchronization requests are received at one or more third times, respectively, based on a same synchronization interval.

16. The method of claim 10 , wherein the set of policy parameter values defines a threshold number of user requests for issuing a user suspension for a suspension

Assignees

• Salesforce Com Inc

Inventors

• Guan Colbert
• Bhatt Jigna
• Valine Thomas Nicholas
• Zhang Ruofan
• Tulava Sampath

Classifications

• H04L41/5003

  Managing SLA; Interaction between SLA and QoS · CPC title

• H04L43/10

  Active monitoring, e.g. heartbeat, ping or trace-route · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L43/16

  Threshold monitoring · CPC title