METHOD AND SYSTEM FOR PROVIDING SECURITY AWARE APPLICATIONS

• US 20150288708A1
• Filed: 04/07/2014
• Published: 10/08/2015
• Est. Priority Date: 04/07/2014
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Lietz, M. Shannon, Cabrera, Luis Felipe
• Granted Patent: US 9,276,945 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 47/803 Application aware
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Instructions for monitoring and detecting one or more trigger events in assets used to implement an application are generated. Instructions for implementing at least one responsive action associated with each of the one or more trigger events is generated. At least part of instructions for monitoring and detecting the one or more trigger events is provided to an asset used to implement the application. The at least part of the instructions for monitoring and detecting the one or more trigger events are used by the asset to detect a trigger event. The instructions for implementing the at least one responsive action associated with each of the one or more trigger events is then used to automatically implement the at least one responsive action associated with the detected trigger event.

Claims

1. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

defining one or more trigger events that when detected in an asset used to implement an application require at least one responsive action;

defining at least one responsive action to be associated with each of the one or more trigger events;

generating data representing instructions for monitoring and detecting the one or more trigger events in an asset used to implement the application;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing at least part of the data representing instructions for monitoring and detecting the one or more trigger events in an asset to at least one asset used to implement the application;

using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events in an asset to detect a trigger event involving the at least one asset; and

using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events to automatically implement the at least one responsive action associated with the detected trigger event.

2. The system for providing security aware applications of claim 1 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in a user ID associated with a user of the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

3. The system for providing security aware applications of claim 1 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

disabling one or more communications channels associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

4. The system for providing security aware applications of claim 1 wherein the at least one asset used to implement the application is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

5. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

6. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application.

7. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided to the application, and/or one or more assets used to implement the application, by the owner of the application.

8. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of a production environment in which the application is implemented.

9. The system for providing security aware applications of claim 1 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.

10. A system for providing security aware applications comprising:

an application;

a production environment for implementing the application;

one or more assets used to implement the application in the production environment;

data for monitoring and detecting one or more trigger events in one of more of the assets used to implement the application in the production environment;

data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events upon detection of the one or more trigger events in one of more of the assets used to implement the application in the production environment;

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

providing at least part of the data for monitoring and detecting the one or more trigger events to at least one asset used to implement the application in the production environment;

using the at least part of the data for monitoring and detecting the one or more trigger events to detect a trigger event involving the at least one asset; and

using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events to automatically implement the at least one responsive action associated with the detected trigger event.

11. The system for providing security aware applications of claim 10 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in a user ID associated with a user of the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

12. The system for providing security aware applications of claim 10 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

disabling one or more communications channels associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

13. The system for providing security aware applications of claim 10 wherein the at least one asset used to implement the application in the production environment is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

14. The system for providing security aware applications of claim 10 wherein the data for monitoring and detecting the one or more trigger events and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

15. The system for providing security aware applications of claim 10 wherein the data for monitoring and detecting the one or more trigger events and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate the at least one virtual asset used to implement the application in the production environment.

16. The system for providing security aware applications of claim 10 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by the owner of the application.

17. The system for providing security aware applications of claim 10 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of the production environment in which the application is implemented.

18. The system for providing security aware applications of claim 10 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.

19. A system for providing security aware applications comprising:

at least one processor; and

at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the one or more processors, perform a process for providing security aware applications, the process for providing security aware applications including;

defining one or more operational parameters associated with assets used to implement an application;

obtaining baseline values for the one or more operational parameters associated with assets used to implement the application;

defining a trigger deviation value for each of the one or more operational parameters associated with assets used to implement the application;

defining one or more trigger events that when detected in an asset used to implement the application require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters associated with assets used to implement the application;

defining at least one responsive action to be associated with each of the one or more trigger events;

generating data representing instructions for monitoring and detecting the one or more trigger events in assets used to implement the application;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing at least part of the data representing instructions for monitoring and detecting the one or more trigger events to at least one asset used to implement the application;

using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events to detect a trigger event involving the at least one asset; and

using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events to automatically implement the at least one responsive action associated with the detected trigger event.

20. The system for providing security aware applications of claim 19 wherein at least one of the operational parameters for assets used to implement an application to be monitored is selected from the group operational parameters consisting of:

a deployment pattern associated with the application, and/or an asset used to implement the application;

a communications channel associated with the application, and/or an asset used to implement the application;

a communications channel configuration associated with the application, and/or an asset used to implement the application;

expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a pattern of wireless communications associated with the application, and/or an asset used to implement the application; and

a periodic event associated with the application, and/or an asset used to implement the application.

21. The system for providing security aware applications of claim 19 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in a user ID associated with a user of the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

22. The system for providing security aware applications of claim 19 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

disabling one or more communications channels associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

23. The system for providing security aware applications of claim 19 wherein the at least one asset used to implement the application is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

24. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

25. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate at least one virtual asset used to implement the application.

26. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by the owner of the application.

27. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of a production environment in which the application is implemented.

28. The system for providing security aware applications of claim 19 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.

29. A method for providing security aware applications comprising:

defining one or more operational parameters associated with assets used to implement an application;

obtaining baseline values for the one or more operational parameters associated with assets used to implement the application;

defining a trigger deviation value for each of the one or more operational parameters associated with assets used to implement the application;

defining one or more trigger events that when detected in an asset used to implement the application require at least one responsive action, the trigger events including the occurrence of a trigger deviation value for any of the one or more operational parameters associated with assets used to implement the application;

defining at least one responsive action to be associated with each of the one or more trigger events;

generating data representing instructions for monitoring and detecting the one or more trigger events in assets used to implement the application;

generating data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events;

providing at least part of the data representing instructions for monitoring and detecting the one or more trigger events to at least one asset used to implement the application;

using the at least part of the data representing instructions for monitoring and detecting the one or more trigger events to detect a trigger event involving the at least one asset; and

using the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events to automatically implement the at least one responsive action associated with the detected trigger event.

30. The method for providing security aware applications of claim 29 wherein at least one of the operational parameters for an asset used to implement an application to be monitored is selected from the group operational parameters consisting of:

a deployment pattern associated with the application, and/or an asset used to implement the application;

a communications channel associated with the application, and/or an asset used to implement the application;

a communications channel configuration associated with the application, and/or an asset used to implement the application;

expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a pattern of wireless communications associated with the application, and/or an asset used to implement the application; and

a periodic event associated with the application, and/or an asset used to implement the application.

31. The method for providing security aware applications of claim 29 wherein at least one of the defined trigger events is selected from the group of trigger events consisting of:

a change in software associated with the application, and/or an asset used to implement the application;

a change in a software stack associated with the application, and/or an asset used to implement the application;

the receipt of one or more defined commands by the application, and/or an asset used to implement the application;

a change in a deployment pattern associated with the application, and/or an asset used to implement the application;

a change in a communications channel associated with the application, and/or an asset used to implement the application;

a change in a communications channel configuration associated with the application, and/or an asset used to implement the application;

a deviation from an expected communications traffic pattern associated with the application, and/or an asset used to implement the application;

a geo-location of the recipient of communications traffic associated with the application, and/or an asset used to implement the application;

a geo-location of the originator of communications traffic associated with the application, and/or an asset used to implement the application;

a change in a pattern of wireless communications associated with the application, and/or an asset used to implement the application;

a change in a phone number associated with communications associated with the application, and/or an asset used to implement the application;

a change in a user ID associated with a user of the application, and/or an asset used to implement the application;

a change in the profile of a user associated with the application, and/or an asset used to implement the application;

a change in a periodic event associated with the application, and/or an asset used to implement the application; and

a deviation from any defined expected normal operations parameter associated with the application, and/or an asset used to implement the application.

32. The method for providing security aware applications of claim 29 wherein at least one of the defined responsive actions is selected from the group of responsive actions consisting of:

notifying a party or entity of the detected trigger event;

disabling one or more operations performed by the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more operations performed by the application, and/or an asset used to implement the application;

disabling one or more communications channels associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling one or more communications channels associated with the application, and/or an asset used to implement the application;

blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently blocking a portion of communications traffic associated with the application, and/or an asset used to implement the application;

disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

permanently disabling the application, and/or an asset used to implement the application, until one or more required actions have taken place;

obtaining data from the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application; and

directing a transfer of data from the application, and/or an asset used to implement the application, to a location outside the application, and/or an asset used to implement the application, before disabling the application, and/or an asset used to implement the application.

33. The method for providing security aware applications of claim 29 wherein the at least one asset used to implement the application is a virtual asset selected from the group of the virtual assets consisting of:

a virtual machine;

a virtual server;

a database or data store;

an instance in a cloud environment;

a cloud environment access system;

part of a mobile device;

part of a remote sensor;

part of a server computing system; and

part of a desktop computing system.

34. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by providing a security policy library to the application, and/or one or more assets used to implement the application.

35. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided through a virtual asset creation template used to instantiate at least one virtual asset used to implement the application.

36. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by the owner of the application.

37. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a provider of at least part of a production environment in which the application is implemented.

38. The method for providing security aware applications of claim 29 wherein the data representing instructions for monitoring and detecting the one or more trigger events in an asset and the data representing instructions for implementing the at least one responsive action associated with each of the one or more trigger events is provided by a third party service provider.