Monitoring and controlling electronic activity using third party rule submission and validation

• US 9,584,545 B2
• Filed: 06/08/2015
• Issued: 02/28/2017
• Est. Priority Date: 11/28/2011
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: El Houmaidi, Mounire
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US14/733,128
• Publication Number:
  US 20150271210A1
• Time in Patent Office: 631 Days
• Field of Search: 713168-174, 713182-186, 713/202, 709/206, 709/225, 709/229, 709/249, 709/389, 726 2- 8
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Concepts and technologies are disclosed herein for monitoring and controlling electronic activity. A policy service can be called for policies for controlling electronic activity occurring at one or more managed devices. The policies can include a number of rules, each of which can include a number of variables. The rules can be defined by a manager device and/or received from third parties. Third party rule submissions can be validated. If electronic activity at the managed device deviates from a rule, the manager device can be notified and the electronic activity can be blocked. The manager device can update the policy and/or issue exceptions, if desired.

Claims

1. A method comprising:

generating, at a policy server, a policy based upon a rule, wherein the policy defines electronic activity allowed at a device, and wherein the rule comprises a variable and a value specified for the variable;

storing, by the policy server, the policy at a policy repository in communication with the policy server;

receiving, by the policy server, a further rule from a third party device, the further rule comprising a further value;

determining, by the policy server, that third party rule submissions are enabled;

validating, by the policy server, the further rule to determine that the further rule is legitimate;

updating, by the policy server, the policy based upon the further rule to obtain an updated policy; and

storing, by the policy server, the updated policy at the policy repository.

2. The method of claim 1, further comprising:

detecting electronic activity associated with the device;

determining that the updated policy relates to the electronic activity; and

determining, based upon the updated policy, if the electronic activity should be permitted.

3. The method of claim 2, further comprising:

in response to a determination that the electronic activity should not be permitted, blocking the electronic activity.

4. The method of claim 3, further comprising:

generating a notification for a manager device, the notification indicating that the electronic activity was blocked; and

sending the notification to the manager device.

5. The method of claim 2, further comprising:

in response to a determination that the electronic activity should be permitted, allowing the electronic activity.

6. The method of claim 2, further comprising:

in response to a determination that the electronic activity should not be permitted,

notifying a manager device;

receiving an exception to the updated policy from the manager device; and

in response to receiving the exception, allowing the electronic activity.

7. The method of claim 6, further comprising:

in response to receiving the exception, determining that the updated policy is to be updated; and

updating the updated policy.

8. The method of claim 2, further comprising:

in response to a determination that the electronic activity should not be permitted,

notifying a manager device;

determining that an exception to the updated policy was not received from the manager device; and

blocking the electronic activity.

9. A computer storage medium having computer executable instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

generating a policy based upon a rule, wherein the policy defines electronic activity allowed at a device, and wherein the rule comprises a variable and a value specified for the variable;

storing the policy at a policy repository;

receiving a further rule from a third party device, the further rule comprising a further value;

determining that third party rule submissions are enabled;

validating the further rule to determine that the further rule is legitimate;

updating the policy based upon the further rule to obtain an updated policy; and

storing the updated policy at the policy repository.

10. The computer storage medium of claim 9, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

detecting electronic activity associated with the device;

determining that the updated policy relates to the electronic activity; and

determining, based upon the updated policy, if the electronic activity should be permitted.

11. The computer storage medium of claim 10, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

in response to a determination that the electronic activity should not be permitted, blocking the electronic activity.

12. The computer storage medium of claim 11, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

generating a notification for a manager device, the notification indicating that the electronic activity was blocked; and

sending the notification to the manager device.

13. The computer storage medium of claim 10, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

in response to a determination that the electronic activity should not be permitted,

notifying a manager device;

receiving an exception to the updated policy from the manager device; and

in response to receiving the exception, allowing the electronic activity.

14. The computer storage medium of claim 13, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

in response to receiving the exception, determining that the updated policy is to be updated; and

updating the updated policy.

15. The computer storage medium of claim 10, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

in response to a determination that the electronic activity should not be permitted,

notifying a manager device;

determining that an exception to the updated policy was not received from the manager device; and

blocking the electronic activity.

16. A system comprising:

a processor; and

a memory that stores computer executable instructions that, when executed by the processor, cause the processor to perform operations comprising

generating a policy based upon a rule, wherein the policy defines electronic activity allowed at a device, and wherein the rule comprises a variable and a value specified for the variable,

storing the policy at a policy repository,

receiving a further rule from a third party device, the further rule comprising a further value,

determining that third party rule submissions are enabled,

validating the further rule to determine if the further rule is legitimate,

updating the policy based upon the further rule to obtain an updated policy, and

storing the updated policy at the policy repository.

17. The system of claim 16, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

detecting electronic activity associated with the device;

determining that the updated policy relates to the electronic activity; and

determining, based upon the updated policy, if the electronic activity should be permitted.

18. The system of claim 17, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

in response to a determination that the electronic activity should not be permitted, blocking the electronic activity;

generating a notification for a manager device, the notification indicating that the electronic activity was blocked; and

sending the notification to the manager device.

19. The system of claim 17, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

in response to a determination that the electronic activity should not be permitted,

notifying a manager device;

receiving an exception to the updated policy from the manager device; and

in response to receiving the exception, allowing the electronic activity.

20. The system of claim 19, wherein the computer executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

in response to receiving the exception, determining that the updated policy is to be updated; and

updating the updated policy.