Method and apparatus for associating data loss protection (DLP) policies with endpoints

• US 20160226918A1
• Filed: 04/08/2016
• Published: 08/04/2016
• Est. Priority Date: 12/09/2010
• Status: Active Grant

• Current Assignee: SailPoint Technologies Holdings, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Readshaw, Neil Ian, Ramanathan, Jayashree, Bray, Gavin George
• Granted Patent: US 10,432,666 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of policy management in a Data Loss Prevention (DLP) system uses a policy model that associates a user with one or more DLP endpoints. When an endpoint is added to the system, a set of policies for that endpoint are determined using an identity of the user that is associated with the endpoint and a list of roles or groups for that user. At policy distribution time, the method determines a set of endpoints to which the policy is to be distributed.

Claims

1. A method of policy management in a data loss prevention (DLP) system, comprising:

defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;

determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user; and

determining a set of endpoints to which a policy is to be distributed;

wherein at least one of the determining steps is performed using a computer program executing in a hardware element.

2. The method as described in claim 1 wherein the set of policies for the endpoint reference each role or group to which the user is associated.

3. The method as described in claim 1 wherein the step of determining the set of endpoints to which the policy is to be distributed generates an endpoint set.

4. The method as described in claim 3 wherein the endpoint set for the policy is generated by the following sub-steps:

for each role or group that is a target of the policy, identifying each user associated with the role or group;

for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and

adding the one or more endpoints from the list into the endpoint set.

5. The method as described in claim 4 further including generating a policy distribution list that includes the endpoint set associated with one or more policies to be distributed to the endpoints.

6. The method as described in claim 5 further including distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.

7. Apparatus for policy management in a data loss prevention (DLP) system, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method comprising;

defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;

determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user; and

determining a set of endpoints to which a policy is to be distributed.

8. The apparatus as described in claim 7 wherein the set of policies for the endpoint reference each role or group to which the user is associated.

9. The apparatus as described in claim 7 wherein the step of determining the set of endpoints to which the policy is to be distributed generates an endpoint set.

10. The apparatus as described in claim 9 wherein the endpoint set for the policy is generated by the following sub-steps:

for each role or group that is a target of the policy, identifying each user associated with the role or group;

for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and

adding the one or more endpoints from the list into the endpoint set.

11. The apparatus as described in claim 10 wherein the method further includes generating a policy distribution list that includes the endpoint set associated with one or more policies to be distributed to the endpoints.

12. The apparatus as described in claim 11 wherein the method further includes distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.

13. A computer program product in a non-transitory computer readable medium for policy management in a data loss prevention (DLP) system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:

defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;

determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user; and

determining a set of endpoints to which a policy is to be distributed.

14. The computer program product as described in claim 13 wherein the set of policies for the endpoint reference each role or group to which the user is associated.

15. The computer program product as described in claim 13 wherein the step of determining the set of endpoints to which the policy is to be distributed generates an endpoint set.

16. The computer program product as described in claim 15 wherein the endpoint set for the policy is generated by the following sub-steps:

for each role or group that is a target of the policy, identifying each user associated with the role or group;

for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and

adding the one or more endpoints from the list into the endpoint set.

17. The computer program product as described in claim 16 wherein the method further includes generating a policy distribution list that includes the endpoint set associated with one or more policies to be distributed to the endpoints.

18. The computer program product as described in claim 17 wherein the method further includes distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.

19. A method of policy management in a data loss prevention (DLP) system, comprising:

in response to creation or modification of a policy, using a computer program executing in a hardware element to determine which subset of a set of endpoints should receive the policy by the following sub-steps;

for each role or group that is a target of the policy, identifying each user associated with the role or group; and

for each user associated with the role or group, identifying one or more endpoints with which the user is associated; and

distributing the policy to the subset of the set of endpoints identified by the determining step.

20. The method as described in claim 19 wherein the DLP system includes a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group.

21. The method as described in claim 20 further including determining a set of policies for an endpoint using an identity of the user that is associated with the endpoint and a list of roles or groups for the user.