Supplying regulatory compliance evidence for a service provider environment

Patent metadata

Field	Value
Publication number	US-9967285-B1
Application number	US-201514864777-A
Country	US
Kind code	B1
Filing date	Sep 24, 2015
Priority date	Sep 24, 2015
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

Technology is described for supplying regulatory compliance evidence for a virtual computing service provider. A request is received for providing regulatory compliance evidence for a service provided by a virtual computing service provider. A statistical analysis of subject matter relating to the request using machine learning is provided. The subject matter associated with the request is categorized. The categorized subject matter is mapped to a control list, maintained for compliance regulations, that is mapped to the regulatory compliance evidence. A confidence level for the regulatory compliance evidence is developed according to historical data relating to previously provided regulatory compliance evidence. A response, having both the regulatory compliance evidence associated with the request and the regulatory confidence level, is provided with a set of digital signatures. An authenticated user feedback response is provided indicating an accuracy level that the response matches the request for developing the confidence level.

First claim

What is claimed is:

1. A method for supplying regulatory compliance evidence for a service provider environment, the method comprising:
receive a request for providing signed regulatory compliance evidence about a service provided by a service provider, using at least one hardware processor and a memory configured with executable instructions;
provide a statistical analysis of subject matter relating to the request using machine learning for interpreting the request, using the at least one hardware processor and the memory;
categorize the subject matter associated with the request according to the statistical analysis, using the at least one hardware processor and the memory;
map categorized subject matter associated with the request to a control list, maintained for compliance regulations, that is mapped to the signed regulatory compliance evidence for associating the regulatory compliance evidence with the request, using the at least one hardware processor and the memory;
develop a confidence level for the signed regulatory compliance evidence according to historical data relating to previously provided regulatory compliance evidence, wherein the confidence level indicates a statistical probability that the signed regulatory compliance evidence matches key words in the request, and a statistical regression model is used to create a machine learning model to establish the statistical probability by comparing currently mapped key words with previously mapped key words in previous requests, using the at least one hardware processor and the memory;
provide a response, having both the regulatory compliance evidence associated with the request and the confidence level, with a set of digital signatures provided by the service provider, using the at least one hardware processor and the memory; and
receive an authenticated user feedback response relating to the response indicating an accuracy level that the response matches the request, using the at least one hardware processor and the memory.

2. The method of claim 1 , further comprises executable instructions that authenticate the response by encrypting a portion of data associated with the response for providing the set of digital signatures, using the at least one processor and memory, wherein the set of digital signatures includes an aggregation of digital signatures relating to at least one of regulatory compliance evidence or the authenticated user feedback.

3. The method of claim 1 , further comprises executable instructions that:
provide the response with at least a summary of the regulatory compliance evidence, and
use the authenticated user feedback response for modifying the confidence level.

4. A computer-implemented method, the method comprising:
receive a request for providing regulatory compliance evidence, which is signed and maintained, for a virtual computing service provider, using at least one hardware processor and a memory configured with executable instructions;
identify key words associated with the request for the regulatory compliance evidence, using the at least one hardware processor and the memory;
categorize the key words associated with the request, using the least one hardware processor and the memory;
map categorized key words associated with the request to a control list, maintained for compliance regulations, that is mapped to the regulatory compliance evidence for associating the regulatory compliance evidence with the request, using the at least one hardware processor and the memory;
develop a confidence level for the regulatory compliance evidence that indicates a statistical probability that the regulatory compliance evidence matches the key words associated with the request, and a statistical regression model is used to create a machine learning model to establish the statistical probability by comparing currently mapped key words with previously mapped key words in previous requests, using the at least one hardware processor and the memory; and
provide a response with a summary of the regulatory compliance evidence and a set of digital signatures, using the at least one hardware processor and the memory.

5. The method of claim 4 , further comprising executable instructions that authenticate the response by encrypting a portion of data associated with the response to provide the digital signature, using the at least one processor and memory, wherein the set of digital signatures includes an aggregation of digital signatures relating to the regulatory compliance evidence.

6. The method of claim 4 , further comprising executable instructions that:
develop a confidence level for the regulatory compliance evidence according to historical data relating to previously provided regulatory compliance evidence.

7. The method of claim 6 , further comprising executable instructions that record the user feedback relating to the response.

8. The method of claim 7 , further comprising executable instructions that use a statistical regression model to assist in creating a machine learning model to developing the confidence level.

9. The method of claim 8 , further comprising executable instructions that use the compliance evidence to indicate whether the key words are accurately mapped to the control list.

10. The method of claim 9 , further comprising executable instructions that iteratively build a content lexicon based the key words mapped to the compliance evidence for increasing the confidence level.

11. The method of claim 8 , further comprising executable instructions that:
provide the response via an application programming interface (API); and
execute an authenticated continuous monitoring operation at a predefined rate or time period frequency to monitor and identify any changes during a cycle of requests and responses.

12. The method of claim 8 , further comprising executable instructions that display the response via a dashboard indicating at least one of compliance status, changes relating to the regulatory compliance evidence, and or history of the regulatory compliance evidence.

13. The method of claim 4 , further comprising executable instructions that provide the response with source documentation as the regulatory compliance evidence.

14. The method of claim 4 , further comprising executable instructions that analyze source documentation for determining the regulatory compliance evidence to provide in the response based on the mapping.

15. The method of claim 14 , wherein the source documentation includes at least one of change management records, document control records, service level agreement performance records, regulatory compliance service records, hardware records, compliance documentation relating to a service provided by the virtual computing service provider, or software records.

16. The method of claim 4 , further comprising executable instructions that provide a virtual computing service provider key for signing a digital signature to be included in the set of digital signatures.

17. A method for providing compliance evidence for a virtual computing service provider, the method comprising:
receive a request for providing regulatory compliance evidence, that is signed and maintained, for a virtual computing service provider, using at least one hardware processor and a memory configured with executable instructions;
categorize key words relating to subject matter of the request for interpreting the request, using the at least one hardware processor and the memory;
map categorized key words relating to subject matter of the request to source documentation for associa

Assignees

• Amazon Tech Inc

Inventors

• Rossman Hart Matthew
• Beegle Jessica Paige
• Whalley Christopher John
• Wilson Aaron John

Classifications

• G06F17/30914

  Physics · mapped topic

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F16/22

  Indexing; Data structures therefor; Storage structures · CPC title

• G06F16/84

  Mapping; Conversion · CPC title