COMPLIANCE CONTROL SYSTEM

• US 20080148346A1
• Filed: 09/14/2007
• Published: 06/19/2008
• Est. Priority Date: 12/15/2006
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.), SAP AG (SAP SE)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Young, Paul, Srivastava, Pankaj, Aoun, Boulos, Cooper, Lee, Gill, Ravinder
• Application Number:
  US11/855,914
• Publication Number:
  US 20080148346A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method comprises automatically obtaining network data, and automatically processing the network data to detect violation of a compliance control policy of an entity.

Claims

1. A method comprising:

automatically obtaining network data; and

automatically processing the network data to detect a violation of a compliance control policy of an entity.

2. The method of claim 1, including automatically obtaining application data, and automatically processing the application data in conjunction with the network data to detect the violation of the compliance control policy of the entity.

3. The method of claim 1, wherein the compliance control policy is at least one of a company policy, a government regulation, a law, a professional rule, an accounting rule, a statement of good business practices, a condition imposed by a contract, or a corporate article.

4. The method of claim 1, wherein the obtaining of the network data includes monitoring network traffic data, and wherein the processing of the network data includes processing the network traffic data to detect a data privacy violation.

5. The method of claim 1, wherein the obtaining of network data includes monitoring network events to obtain network event data, and wherein the processing of the network data includes processing the network event data.

6. The method of claim 1, wherein the obtaining of the network data includes obtaining network security data, and wherein the processing of the network data includes processing the network security data to detect a network security violation.

7. The method of claim 1, wherein the obtaining of the network data includes obtaining service level agreement (SLA) compliance data, and wherein the processing of the network data includes processing the SLA compliance data to detect an SLA violation.

8. The method of claim 1, including:

defining the compliance control policy at a compliance control system;

storing the compliance control policy within a policy repository;

communicating the compliance control policy from the compliance control system to a network service application, the network service application to utilize the compliance control policy in the obtaining of the network data;

automatically translating the compliance control policy into at least one network control policy; and

installing the at least one network policy at the network service application.

9. The method of claim 8, wherein the network service application is to

obtain the network data from a plurality of network entities, and is to aggregate to the network data;

and

filter the network data obtained from the plurality of network entities,

and wherein the plurality of network entities include at least one of network devices, network applications, or network Web services.

10. The method of claim 1, including performing process control responsive to the detection of the violation of the compliance control policy of the entity, the performance of the process control including preventing occurrence of an event and performing a remedial action to remedy the violation of the compliance control policy.

11. The method of claim 1, including performing access control responsive to the detection of the violation of the compliance control policy of the entity, and wherein the performance of the access control includes restricting access to at least one of a network-layer process and an application-layer process.

12. The method of claim 1, including performing a notification action responsive to the detection of violation of the compliance control policy of the entity.

13. A system comprising:

a network system to automatically obtain network data; and

a compliance control system to process the network data to detect a violation of a compliance control policy of an entity.

14. The system of claim 13, wherein the compliance control system is to obtain application data, and is automatically to process the application data in conjunction with the network data to detect the violation of the compliance control policy of the entity.

15. The system of claim 13, wherein the compliance control policy is at least one of a company policy, a government regulation, a law, a professional rule, an accounting rule, a statement of good business practices, a condition imposed by a contract, or a corporate article.

16. The system of claim 13, wherein:

the network system is to monitor network traffic data, and wherein the compliance control system is to process the network traffic data to detect a data privacy violation;

the network system is to monitor network events to obtain network event data, and wherein the compliance control system is to process the network event data;

the network system is to obtain network security data, and wherein the compliance control system is to process the network security data to detect a network security violation;

or

the network system is to obtain service level agreement (SLA) compliance data, and wherein the compliance control system is to process the SLA compliance data to detect an SLA violation.

17. The system of claim 13, wherein:

the compliance control system is to receive a definition of the compliance control policy at a policy definition component, and is to store the compliance control policy within a policy repository at an application level;

the compliance control system is to communicate the compliance control policy from the compliance control system to the network system, the network system being to utilize the compliance control policy in the obtaining of the network data;

the network system is to translate the compliance control policy into at least one network control policy, and is further to propagate the at least one network policy to at least one network service application;

the at least one network service application is to obtain the network data from a plurality of network entities, and is to aggregate to the network data; and

the at least one network service application is to filter the network data obtained from the plurality of network entities, the plurality network entities including at least one of a group consisting of network devices, network applications, and network Web services.

18. The system of claim 13, wherein the compliance control system is to perform process control responsive to the detection of violation of the compliance control policy of the entity, the process control including at least one of preventing prevent occurrence of an event or performing a remedial action to remedy the violation of the compliance control policy.

19. A system comprising:

first means for obtaining network data; and

second means for processing the network data to detect violation of a compliance control policy of an entity.

20. The system of claim 19, wherein the second means is for obtaining the application data, and is for processing the application data in conjunction with the network data to detect violation of the compliance control policy of the entity.

21. The system of claim 19, wherein the second means is for:

receiving a definition of the compliance control policy at a policy definition component, and is for storing the compliance control policy within a policy repository;

performing process control responsive to the detection of the violation of the compliance; and

performing access control responsive to the detection of the violation of the compliance control policy of the entity.

22. The system of claim 19, wherein at least one of the first means and the second means is to perform a notification action responsive to the detection of violation of the compliance control policy of the entity.

23. A machine-readable medium embodying instructions that, when executed by a machine, cause the machine to:

automatically obtain network data; and

automatically process the network data to detect violation of a compliance control policy of an entity.

24. The machine-readable medium of claim 23, wherein the instructions cause the machine to automatically obtain application data, and automatically to process the application data in conjunction with the network data to detect violation of the compliance control policy of the entity.