Systems and methods for dynamically configuring computing system group assignments based on detected events

Patent metadata

Field	Value
Publication number	US-9565059-B1
Application number	US-201414448770-A
Country	US
Kind code	B1
Filing date	Jul 31, 2014
Priority date	Jul 31, 2014
Publication date	Feb 7, 2017
Grant date	Feb 7, 2017

Abstract

A computer-implemented method for configuring computing systems may include (1) detecting an event associated with a client device that potentially impacts a group to which the client device is assigned and, in response to detecting the event, (2) discovering at least one attribute of the client device that has the potential to impact the client device's group assignment, (3) identifying at least one rule that defines conditions for assigning client devices to groups, (4) determining, by applying the rule to the discovered attribute of the client device, that the client device's group assignment should be modified, and (5) modifying, in response to determining that the client device's group assignment should be modified, the client device's group assignment based on the discovered attribute of the client device. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for dynamically configuring computing system group assignments based on detected events, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
detecting an event associated with a client device that potentially impacts a group to which the client device is assigned;
in response to detecting the event:
discovering at least one attribute of the client device that potentially impacts the client device's group assignment;
identifying at least one rule that defines conditions for assigning client devices to groups by formulating a dynamic rule that associates at least one condition associated with the client device with an alternate group;
determining, by applying the rule to the discovered attribute of the client device, that the client device's group assignment should be modified to that of the alternate group; and
in response to determining that the client device's group assignment should be modified, modifying the client device's group assignment based on the discovered attribute of the client device.

2. The computer-implemented method of claim 1 , wherein identifying the rule that defines conditions for assigning client devices to groups comprises:
identifying a plurality of rules that define conditions for assigning the client device to a plurality of groups;
determining that the client device satisfies conditions of a plurality of groups, resulting in a conflict;
resolving the conflict between the conflicting groups; and
in response to resolving the conflict between the conflicting groups, modifying the client device's group assignment.

3. The computer-implemented method of claim 2 , wherein resolving the conflict between the conflicting groups comprises at least one of:
determining that one group of the conflicting groups is a superset of all other groups of the conflicting groups; and
determining that one group of the conflicting groups is a proper subset of all other groups of the conflicting groups.

4. The computer-implemented method of claim 2 , wherein resolving the conflict between the conflicting groups comprises:
selecting a rule from the rules assigning devices to conflicting groups to modify the client device's group assignment; and
notifying an administrator to formulate a new rule that resolves the conflict between the conflicting groups.

5. The computer-implemented method of claim 1 :
further comprising identifying a configuration setting of the attribute that improves utility of the client device; and
wherein the rule that defines conditions for assigning client devices to groups initiates application of the configuration setting to the attribute of the client device.

6. The computer-implemented method of claim 5 , further comprising, in response to determining that the client device's group assignment should be modified, applying the configuration setting to the attribute of the client device.

7. The computer-implemented method of claim 1 , wherein the attribute comprises at least one of:
a data loss prevention policy;
a directory services setting;
a software application configuration setting;
a network setting;
a device resource setting;
an operating system configuration setting; and
a device security setting.

8. The computer-implemented method of claim 1 , wherein the event associated with the client device comprises at least one of:
a login event;
a device security threat event;
a directory services change event;
a software application change event;
a network connection event;
a device change event; and
an operating system configuration event.

9. The computer-implemented method of claim 1 , wherein discovering the attribute of the client device comprises discovering at least one attribute of a user of the client device.

10. The computer-implemented method of claim 1 , wherein identifying the rule that defines conditions for assigning client devices to groups comprises:
obtaining, using information that identifies the discovered attribute of the client device, the rule by querying a database that associates conditions for assigning client devices to groups with rules for assigning client devices to groups.

11. The computer-implemented method of claim 1 , wherein the condition for assigning client devices to groups comprises a logical combination of attributes of client devices.

12. A system for dynamically configuring computing system group assignments based on detected events, the system comprising:
an event module, stored in memory, that detects an event associated with a client device that potentially impacts a group to which the client device is assigned;
a client analysis module, stored in memory, that, in response to detecting the event, discovers at least one attribute of the client device that potentially impacts the client device's group assignment;
a rule analysis module, stored in memory, that identifies at least one rule that defines conditions for assigning client devices to groups by formulating a dynamic rule that associates at least one condition associated with the client device with an alternate group;
an assignment module, stored in memory, that:
determines, by applying the rule to the discovered attribute of the client device, that the client device's group assignment should be modified to that of the alternate group;
in response to determining that the client device's group assignment should be modified, modifies the client device's group assignment based on the discovered attribute of the client device; and
at least one physical processor configured to execute the event module, the client analysis module, the rule analysis module, and the assignment module.

13. The system of claim 12 , wherein the rule analysis module identifies the rule that defines conditions for assigning client devices to groups by:
identifying a plurality of rules that define conditions for assigning the client device to a plurality of groups;
determining that the client device satisfies conditions of a plurality of groups, resulting in a conflict;
resolving the conflict between the conflicting groups; and
in response to resolving the conflict between the conflicting groups, modifying the client device's group assignment.

14. The system of claim 13 , wherein the rule analysis module resolves the conflict between the conflicting groups by at least one of:
determining that one group of the conflicting groups is a superset of all other groups of the conflicting groups; and
determining that one group of the conflicting groups is a proper subset of all other groups of the conflicting groups.

15. The system of claim 13 , wherein the rule analysis module resolves the conflict between the conflicting groups by:
selecting a rule from the rules assigning devices to conflicting groups to modify the client device's group assignment; and
notifying an administrator to formulate a new rule that resolves the conflict between the conflicting groups.

16. The system of claim 12 , wherein:
the client analysis module identifies a configuration setting of the attribute that improves utility of the client device; and
the rule that defines conditions for assigning client devices to groups initiates application of the configuration setting to the attribute of the client device.

17. The system of claim 16 , further comprising a client configuration module, stored in memory, that in response to determining that the client device's group assignment should be modified, applies the config

Assignees

• Symantec Corp

Inventors

• Manmohan Sarin Sumit
• Torney Milind
• Kessler Dirk
• Espinoza Mario

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L41/0813 Primary

  characterised by the conditions triggering a change of settings · CPC title