Policy enforcement as a service for third party platforms

Patent metadata

Field	Value
Publication number	US-10680958-B2
Application number	US-201815885594-A
Country	US
Kind code	B2
Filing date	Jan 31, 2018
Priority date	Jan 31, 2018
Publication date	Jun 9, 2020
Grant date	Jun 9, 2020

Abstract

Systems, methods, and computer-readable media for providing a Policy Enforcement as a Service (PEaaS) are described. The PEaaS may allow customer service providers to define policies for usage restrictions to be implemented across their distributed systems/platforms. The policy enforcement mechanisms of the PEaaS may prevent users from overloading the systems/platforms of the customer service providers. Other embodiments may be described and/or claimed.

First claim

The invention claimed is:

1. One or more non-transitory computer-readable media (NTCRM) comprising instructions for providing a Policy Enforcement as a Service web service (PEaaS-WS), wherein execution of the instructions by one or more processors of a computing system is operable to cause the computing system to:
obtain one or more policies from individual third party platforms (TPPs) of the plurality of TPPs, respectively, each policy of the one or more policies corresponds with a service provided by respective TPPs of the plurality of TPPs, and each policy defines a threshold number of infractions to occur over a defined period of time for issuing a suspension for a corresponding service;
generate or update, in response to receipt of each user request to access a service provided by a TPP of a plurality of TPPs, usage metrics of a user system that sent each user request;
store the usage metrics in a database, the usage metrics being based on interactions between the user system and the TPP;
generate, based on each received user request to access the service, alert attribute value pairs (AVPs), each alert AVP comprising: a value to indicate a client identifier (client_id) of a user or the user system that sent a user request, and an attribute to indicate a policy identifier (policy_id), the policy_id to indicate a policy defined by the TPP for the service provided by the TPP;
store each alert AVP in a message queue;
determine, in response to obtaining a dequeued alert, whether an infraction has occurred based on the usage metrics, the infraction being a violation of the policy indicated by the policy_id of the dequeued alert that is committed by a user indicated by the client_id of the dequeued alert during an evaluation period defined by the policy indicated by the policy_id of the dequeued alert;
determine whether the user should be suspended from using the service based on a number of infractions committed by the user during a defined time period; and
transmit, in response to a request for suspended users, an indication of the suspended user.

2. The one or more NTCRM of claim 1 , wherein the threshold number of infractions corresponds to a number of user requests that an individual user is permitted to send to a respective TPP.

3. The one or more NTCRM of claim 2 , wherein the threshold number of infractions corresponds to a number of user requests including a query or an address to access a resource associated with a corresponding service.

4. The one or more NTCRM of claim 2 , wherein each policy is to specify a plurality of suspension levels, each suspension level of the plurality of suspension levels being associated with an amount of time that a user is to be suspended from using a corresponding service, and execution of the instructions is operable to cause the computing system to:
determine a suspension level for each user that is determined to have committed an infraction during the evaluation period.

5. The one or more NTCRM of claim 1 , wherein execution of the instructions is operable to cause the computing system to:
dequeue each queued alert according to an evaluation frequency defined by the policy, and the evaluation frequency corresponds to the evaluation period.

6. The one or more NTCRM of claim 1 , wherein the database to store the usage metrics is a time series database, the message queue is a Kafka queue, and the policy is to be stored in an object-relational database, and the usage metrics include one or more of an amount of user requests sent by the user system, a payload size of each user request, a query size of each user request, a query type of each user request, resources or database objects included in each user request, an input/output operation of each user request, or computing resources needed to process each user request.

7. The one or more NTCRM of claim 6 , wherein execution of the instructions is operable to cause the computing system to:
generate an infraction record for each determined infraction; and
store each infraction record in the object-relational database.

8. The one or more NTCRM of claim 7 , wherein the indication is to indicate a plurality of users that are determined to be suspended during a time interval.

9. The one or more NTCRM of claim 5 , wherein execution of the instructions is operable to cause the computing system to:
receive a plurality of user requests from a plurality of user systems via a PEaaS interface embedded in a platform of respective TPPs of the plurality of TPPs.

10. A computing system, comprising:
processor circuitry communicatively coupled with a memory circuitry, wherein the processor circuitry is configurable to:
collect and store one or more sets of policy parameter values from one or more third party platforms (TPPs), respectively, wherein each set of policy parameter values corresponds to a service provided by a TPP to the one or more of TPPs, and each set of policy parameter values defines a threshold for issuing a user suspension for the service provided by the TPPs,
collect and store one or more usage metric sets provided by the one or more TPPs, respectively, based on receipt of user requests to access services provided by respective TPPs of the one or more TPPs, wherein each usage metric set includes one or more usage metrics for one or more users, respectively, the usage metrics being based on interactions between the one or more users and the respective TPPs,
generate alert attribute value pairs (AVPs) based on each received user request to access the service, each alert AVP including a value to indicate a client identifier (client_id) of a user or user system that sent a user request to access an individual service provided by an individual TPP, and an attribute to indicate a policy identifier (policy_id), the policy_id to indicate a set of policy parameter values defined by the individual TPP to correspond to the individual service,
store each alert AVP in a message queue,
compare, in response to obtaining a dequeued alert, each of the usage metrics to a corresponding one of the sets of policy parameter values to identify users that have committed one or more infractions for one of the one or more services,
determine whether the identified users should be suspended from using the service based on a number of infractions committed by the user during an evaluation period of each alert AVP, and
generate, in response to identification of ones of the identified users that have committed the number of infractions of the threshold, suspension values
or corresponding ones of the identified users; and
communication circuitry communicatively coupled with the processor circuitry, the communication circuitry is configurable to transmit the suspension values to corresponding ones of the TPPs, the suspension values usable by the corresponding ones of the TPPs to determine whether to deny requests from the ones of the identified users for respective services.

11. The computing system of claim 10 , wherein the processor circuitry is configurable to:
control storage of the one or more usage metric sets in a first database; and
control storage of the one or more sets of policy parameter values in a second database.

12. The computing system of claim 11 , wherein the processor circuitry is configurable to:
generate alerts for each of the collected one or more usage metric sets, the alerts comprising a key value pair comprising an identifier of a set of the one or more sets of policy parameter values as a key of the key value pair and an identifier of a user of the one or more users as a value of the key value pair; and
control storage of the alerts in a message queue.

Assignees

• Salesforce Com Inc

Inventors

• Guan Colbert
• Bhatt Jigna
• Valine Thomas Nicholas
• Zhang Ruofan
• Tulava Sampath

Classifications

• H04L49/90

  Buffering arrangements · CPC title

• H04L43/0882

  Utilisation of link capacity · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L41/0681

  Configuration of triggering conditions · CPC title

• H04L67/16

  Electricity · mapped topic