US 10,097,586 B1Granted

Identifying inconsistent security policies in a computer cluster

AssigneeHortonworks, Inc.

InventorsSheetal Dinkar Dolas, Paul Daniel Codding

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for identifying inconsistent security policies. One of the methods includes identifying running software components on a cluster of computers, a first subset of the components managing datasets, a second subset of the components managing other components; identifying entity pairs, each being either: (1) (i) a component paired with (ii) a dataset, or (2) two components paired with each other; determining, for each entity pair, a directed relationship from a first to a second entity, where the first entity is a component, and where the directed relationship represents the first entity executing a type of interaction with the second entity; identifying security policies affecting each entity that each limit user access to a type of interaction; and analyzing, for each entity, entity pairs including the entity and one or more security policies affecting the entity to identify inconsistent security policies.

Claims19

Dependent claims

A method, comprising:

identifying, by a system comprising one or more computer nodes, a plurality of running software components on a cluster of two or more computers, the plurality of components comprising one or more first components managing a dataset stored in the cluster, the first components exposing data of the dataset, the plurality of components comprising one or more second components (i) managing, directly or indirectly, the first components, and (ii) exposing data of the dataset exposed by the first components;
identifying, by the system, one or more security policies affecting any one of the dataset, the one or more first components, and the one or more second components;
identifying inconsistent security policies from the one or more security policies, wherein the inconsistent security policies are policies that allow different scopes of user access to the data of the dataset depending on whether the user access is (i) directly to the dataset, (ii) directly to any of the one or more first components, or (iii) directly to any of the one or more second components;
generating, by the system, a specification of one or more actions to rectify inconsistences in the inconsistent security policies;
and
performing the one or more actions to rectify inconsistences in the inconsistent security policies.

3 more elements

A system comprising:

one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
identifying a plurality of running software components on a cluster of two or more computers, the plurality of components comprising one or more first components managing a dataset stored in the cluster, the first components exposing data of the dataset, the plurality of components comprising one or more second components (i) managing, directly or indirectly, the first components, and (ii) exposing data of the dataset exposed by the first components;
identifying one or more security policies affecting any one of the dataset, the one or more first components, and the one or more second components;
identifying inconsistent security policies from the one or more security policies, wherein the inconsistent security policies are policies that allow different scopes of user access to the data of the dataset depending on whether the user access is (i) directly to the dataset, (ii) directly to any of the one or more first components, or (iii) directly to any of the one or more second components;
and
generating a specification of one or more actions to rectify inconsistences in the inconsistent security policies;
and
performing the one or more actions to rectify inconsistences in the inconsistent security policies.

5 more elements

One or more non-transitory computer-readable storage media encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

identifying a plurality of running software components on a cluster of two or more computers, the plurality of components comprising one or more first components managing a dataset stored in the cluster, the first components exposing data of the dataset, the plurality of components comprising one or more second components (i) managing, directly or indirectly, the first components, and (ii) exposing data of the dataset exposed by the first components;
identifying one or more security policies affecting any one of the dataset, the one or more first components, and the one or more second components;
identifying inconsistent security policies from the one or more security policies, wherein the inconsistent security policies are policies that allow different scopes of user access to the data of the dataset depending on whether the user access is (i) directly to the dataset, (ii) directly to any of the one or more first components, or (iii) directly to any of the one or more second components;
generating a specification of one or more actions to rectify inconsistences in the inconsistent security policies;
and
performing the one or more actions to rectify inconsistences in the inconsistent security policies.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/204,876Filed 7 Jul 2016 · continuation
Priority: 9 Jun 2015
Granted: 9 Oct 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification14 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
G06F 16/21
Of structured data, e.g. relational data: design, administration or maintenance of databases
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…