AUTOMATED COMPLIANCE POLICY ENFORCEMENT IN SOFTWARE SYSTEMS

• US 20090205012A1
• Filed: 02/11/2008
• Published: 08/13/2009
• Est. Priority Date: 02/11/2008
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Bhalla, Amit, Jain, Nitin, Mukherjee, Sourav, Singh, Anurag, Logandan, Aawardhan
• Granted Patent: US 8,707,385 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Some embodiments of the present invention provide a system that maintains a software system. During operation, the system obtains a compliance policy for the software system and monitors the software system for a violation of the compliance policy. If such a violation is detected, the system retrieves a change package associated with the violation based on the compliance policy and automatically deploys the change package to the software system to resolve the violation.

Claims

1. A method for maintaining a software system, comprising:

obtaining a compliance policy for the software system;

monitoring the software system for a violation of the compliance policy;

if a violation is detected;

retrieving a change package associated with the violation based on the compliance policy; and

automatically deploying the change package to the software system to resolve the violation.

2. The method of claim 1, further comprising:

reevaluating the software system using the compliance policy; and

if the software system conforms to the compliance policy;

clearing the violation.

3. The method of claim 1, wherein the software system is monitored by:

translating the compliance policy into a set of checks; and

running the checks on the software system.

4. The method of claim 1, wherein the compliance policy is user-authored.

5. The method of claim 1, wherein the violation is associated with at least one of a password reset, a security attack, a port, a configuration file, a software patch, an application type, an application version, and a standard.

6. The method of claim 1, wherein the software system comprises an enterprise solution.

7. The method of claim 1, wherein the change package is user-specified.

8. The method of claim 1, wherein the compliance policy comprises an Extensible Markup Language (XML) document.

9. A system for maintaining a software system, comprising:

a change package repository comprising a set of change packages for the software system; and

a configuration framework configured to obtain a compliance policy, comprising;

a configuration engine configured to monitor the software system for a violation of the compliance policy; and

an enforcement engine configured to;

retrieve a change package associated with the violation from the set of change packages using the compliance policy; and

automatically deploy the change package to the software system to resolve the violation.

10. The system of claim 9, further comprising:

an agent process configured to;

obtain target information from the software system; and

store the target information in a repository,

wherein the target information is used by the configuration framework to monitor the software system.

11. The system of claim 9, wherein the configuration framework is further configured to:

reevaluate the software system using the compliance policy; and

clear the violation.

12. The system of claim 9, wherein the software system is monitored by:

translating the compliance policy into a set of checks; and

running the checks on the software system.

13. The system of claim 9, wherein the compliance policy is user-authored, and wherein the change package is user-provided.

14. The system of claim 9, wherein the violation is associated with at least one of a password reset, a security attack, a port, a configuration file, a software patch, an application type, an application version, and a standard.

15. The system of claim 9, wherein the software system comprises an enterprise solution.

16. The system of claim 9, wherein the compliance policy comprises an Extensible Markup Language (XML) document.

17. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for maintaining a software system, the method comprising:

obtaining a compliance policy for the software system;

monitoring the software system for a violation of the compliance policy;

if a violation is detected;

retrieving a change package associated with the violation using the compliance policy; and

automatically deploying the change package to the software system to resolve the violation.

18. The computer-readable storage medium of claim 17, the method further comprising:

reevaluating the software system using the compliance policy; and

if the software system conforms to the compliance policy;

clearing the violation.

19. The computer-readable storage medium of claim 17, wherein the software system is monitored by:

translating the compliance policy into a set of checks; and

running the checks on the software system.

20. The computer-readable storage medium of claim 17, wherein the compliance policy is user-authored.

21. The computer-readable storage medium of claim 17, wherein the violation is associated with at least one of a password reset, a security attack, a port, a configuration file, a software patch, an application type, an application version, and a standard.

22. The computer-readable storage medium of claim 17, wherein the software system comprises an enterprise solution.

23. The computer-readable storage medium of claim 17, wherein the change package is user-provided.

24. The computer-readable storage medium of claim 17, wherein the compliance policy comprises an Extensible Markup Language (XML) document.