Rule based security policy enforcement

• US 7,140,035 B1
• Filed: 02/01/2000
• Issued: 11/21/2006
• Est. Priority Date: 02/01/2000
• Status: Expired due to Fees

• Current Assignee: Teleran Technologies, Inc.
• Original Assignee: Teleran Technologies, Inc.
• Inventors: Karch, Robert
• Primary Examiner(s): Moise, Emmanuel L.
• Assistant Examiner(s): Davis, Zachary A.
• Application Number:
  US09/495,509
• Time in Patent Office: 2,485 Days
• Field of Search: 713/200, 706 45- 47, 700/1, 700/28, 700/49, 705/500, 726/1, 703/2, 703/13, 703/21, 703/22
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: G06Q 99/00 Subject matter not provided for in other groups of this subclass

Abstract

A rules based system enforces security policies in a data access management system. The rules based system provides rules that preclude certain activities, but those rules are only implemented and fired upon certain conditions occurring. This results in certain actions being precluded when specified conditions are true, without additional software required to check for the condition each time the action is requested.

Claims

1. A method of enforcing security policies in a data access system, said data access system having data access management software in program memory, said method comprising:

defining a first condition;

upon occurrence of said first condition, placing a rule into data access management software in said data access system, said rule testing for a second condition and precluding an action if said second condition is present, said rule being stored remotely and only loaded into program memory for the duration of said first condition, said rule being placed into data access management for an amount of time that differs from an amount of time for which a user is logged on.

2. The method of claim 1 wherein said condition is effectuation of a first transaction by a user and said second action is the effectuation of a related transaction by the same user.

3. The method of claim 2, further comprising eliminating said rule from said data access management software immediately upon rescinding of said condition.

4. The method of claim 2 wherein a user attempting to effectuate said second action is informed of said first condition or said second condition and advised automatically that said second action is prohibited.

5. The method of claim 2 wherein said first action is the ordering of goods or services and said second action is the payment for such goods or services and said second condition is the user attempting such payment is the same user ordering said goods or services.

6. The method of claim 1 wherein said first condition is effectuation of a first transaction by a first user in a particular role, and said action is the effectuation of a second transaction and said second condition is that a specified user is associated with said second action.

7. The method of claim 6 wherein the first user and the specified user are different.

8. The method of claim 6 wherein the rule is not loaded until a user in a specified role logs on to the system.

9. The method of claim 6 wherein the rule is only tested for a user in a specified role.

10. The method of claim 1 wherein said rule is generated from a template rule.

11. The method of claim 1 wherein the rule is not loaded until a specified user logs on to the system.

12. The method of claim 1 wherein the rule is only tested for a specified user.

13. The method of claim 1 wherein the security policy is separation of duties.

14. The method of claim 1 wherein the security policy is compliance to regulation.

15. The method of claim 1 wherein the security policy is privacy of data.

16. The method of claim 1 wherein said rule is generated upon occurrence of said condition.

17. Apparatus for enforcing security policies to increase security of data access management software, said apparatus comprising:

a file of rules, said rules only being applicable to prevent specified data transactions by a first user upon the effectuation of a specified action by said first user, said specified action occurring after said user logs on to said data access management software and being defined by one or more transactions a user may effectuate;

software for recognizing that said first user has effected said specified action, and

means for reading said file, locating said rules to prevent said specified data transactions, and, upon occurrence of said specified action of said first user, integrating said rules into said data access management software such that said specified data transactions are prohibited, wherein said rules are not integrated with said data access management software prior to said occurrence of said specified action.

18. Apparatus of claim 17 wherein further comprising means for eliminating the rule from the data access management software at the conclusion of a predetermined time or upon a predetermined condition.

19. The apparatus of claim 18 wherein the eliminated rule is saved in an audit log.

20. The apparatus of claim 17 further comprising means for generating said rules upon occurrence of said specified action of said first user.

21. A method of enforcing confidentiality in the form of a wall comprising the steps of:

storing at least one rule that prohibits a known party from accessing specified information in a database or file of a data access system if a first specified condition occurs after said known party has logged on to said data access system;

upon a first specified condition occurring, modifying data access management software to include a rule that prohibits a known party from accessing specified information in a database or file;

said first specified condition being indicative of said known party having knowledge of a particular set of information; and

upon a second specified condition occurring, removing said rule from the data access management software and storing said rule for future use, said specified second condition indicating that said knowledge is no longer sensitive.

22. The method of claim 21 wherein said rule is generated from a template rule.

23. The method of claim 22 wherein said known party is defined as any individual engaged in a predetermined role.

24. The method of claim 23 wherein the rule is not loaded until a user in a specified role logs on to the system.

25. The method of claim 23 wherein the rule is only tested for a user in a specified role.

26. The method of claim 22 wherein some other individual, not the known party, is notified of the occurrence of said second condition.

27. The method of claim 26 wherein said notification is via e-mail.

28. The method of claim 22 wherein another individual, not the known party, is notified when the known party attempts the prohibited second action more than once.

29. The method of claim 28 wherein the notification is via e-mail.

30. The method of claim 28 wherein said another individual is the users manager or supervisor.

31. The method of claim 28 wherein said another individual is responsible for data security.

32. The method of claim 28 wherein said another individual is a computer process.

33. The method of claim 21 wherein said known party is notified of the occurrence of said second condition.

34. The method of claim 33 wherein said notification is via email.

35. The method of claim 21 wherein said knowledge is no longer sensitive because it has been made public or because a predetermined time has passed.

36. The method of claim 21 wherein some other individual, not the known party, is notified of the occurrence of said second condition.

37. The method of claim 36 wherein said notification is via e-mail.

38. The method of claim 21 wherein another individual, not the known party, is notified when the known party attempts to access said specified information in the database more than once.

39. The method of claim 38 wherein the notification is via e-mail.

40. The method of claim 38 wherein said another individual is the users manager or supervisor.

41. The method of claim 38 wherein said another individual is responsible for data security.

42. The method of claim 38 wherein said another individual is a computer process.

43. The method of claim 21 wherein the removed rule is saved in an audit log.

44. The method of claim 21 wherein the rule is not loaded until a specified user logs on to the system.

45. The method of claim 21 wherein the rule is only tested for a specified user.

46. The method of claim 21 wherein said rule is generated upon occurrence of said first specified condition.