# US 11,122,086 B2 · Cookie compliance management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,086 B2 - Document ID: US11122086B2 - Status: Granted - Kind: B2 - Application number: 16/427,329 - Filed: 2019-05-30 - Published: 2020-12-03 - Granted: 2021-09-14 - Earliest claimed: 2019-05-30 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Richard James McCarty; Ning Yan; Vishwas Chouhan - Web page: https://patentgrep.com/patent/US11122086B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - G06F 21/554: {involving event detection and direct action} - G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/105: {Multiple levels of security} - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 63/0815: {providing single-sign-on or federations} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A cookie compliance management system enables automated evaluation of cookie compliance within an enterprise. The system determines whether a cookie set by an application in the environment is compliant with a policy. It comprises a workflow engine, a cookie discovery engine (CDE), a cookie characterization engine (CCE), a cookie policy engine (PE), and a cookie registry. The workflow engine receives a request to initiate an evaluation of an application for cookie compliance. The CDE is invoked and returns cookies that are set by the application. The CCE receives a set of base attributes associated with a cookie discovered by the CDE, and computes a set of descriptive attributes determined to be required to enable evaluation of the cookie according to a policy. The policy engine receives policy rules and the set of descriptive attributes and, in response, determines whether the cookie is compliant with the policy. The cookie registry stores cookie data. ## Claims ### Claim 1 An automated method for managing cookie compliance for an application in an enterprise computer environment, comprising: responsive to receipt of an operation associated with the application, receiving a set of one or more cookies discovered to have been set by the application; analyzing a cookie in the set to compute a set of one or more descriptive attributes required to evaluate the cookie according to a policy; receiving a data set characterizing the cookie, the data set including the set of one or more descriptive attributes; and evaluating one or more policy rules and the data set to make a determination whether setting of the cookie by the application is compliant with the policy. ### Claim 2 (depends on 1) The method as described in claim 1, further including saving in a registry the cookie, the data set characterizing the cookie, and the determination indicating whether the cookie setting is compliant with the policy. ### Claim 3 (depends on 2) The method as described in claim 2, wherein the registry is configured to include a cookie name-to-source mapping. ### Claim 4 (depends on 1) The method as described in claim 1, wherein the set of one or more descriptive attributes is one of: an indication of a content encoding type, a content type, an indication that multiple sources have set the cookie, an observation regarding how the cookie relates to other cookies set by the application or by other applications, and an indication that the cookie is associated with a given consent. ### Claim 5 (depends on 1) The method as described in claim 1, further including invoking a cookie discovery operation in response to receipt of the operation associated with the application, wherein the set of one or more cookies are discovered by the cookie discovery operation. ### Claim 6 (depends on 1) The method as described in claim 1, wherein the determination also includes one of: an indication of a deviation from the policy, and guidance on how to address a compliance issue identified by the evaluating. ### Claim 7 (depends on 1) The method as described in claim 1, wherein the policy rules comprise one of: a standard for cookie handling, an applicable legal restriction, and an enterprise-specific cookie handling rule. ### Claim 8 (depends on 1) The method as described in claim 1, further including receiving web storage information discovered from a client storage, wherein at least one policy rule is configured to evaluate the web storage information during the evaluating operation. ### Claim 9 Apparatus, comprising: a processor; computer memory holding computer program instructions executed by the processor to manage cookie compliance for an application in an enterprise computer environment, the computer program instructions including program code configured to: responsive to receipt of an operation associated with the application, receive a set of one or more cookies discovered to have been set by the application; analyze a cookie in the set to compute a set of one or more descriptive attributes required to evaluate the cookie according to a policy; receive a data set characterizing the cookie, the data set including the set of one or more descriptive attributes; and evaluate one or more policy rules and the data set to make a determination whether setting of the cookie by the application is compliant with the policy. ### Claim 10 (depends on 9) The apparatus as described in claim 9, wherein the computer program instructions are further configured to save in a registry the cookie, the data set characterizing the cookie, and the determination indicating whether the cookie setting is compliant with the policy. ### Claim 11 (depends on 10) The apparatus as described in claim 10, wherein the registry is configured to include a cookie name-to-source mapping. ### Claim 12 (depends on 9) The apparatus as described in claim 9, wherein the set of one or more descriptive attributes is one of: an indication of a content encoding type, a content type, an indication that multiple sources have set the cookie, an observation regarding how the cookie relates to other cookies set by the application or by other applications, and an indication that the cookie is associated with a given consent. ### Claim 13 (depends on 9) The apparatus as described in claim 9, wherein the computer program instructions are further configured to invoke a cookie discovery operation in response to receipt of the operation associated with the application, wherein the set of one or more cookies are discovered by the cookie discovery operation. ### Claim 14 (depends on 9) The apparatus as described in claim 9, wherein the determination also includes one of: an indication of a deviation from the policy, and guidance on how to address a compliance issue identified by the evaluating. ### Claim 15 (depends on 9) The apparatus as described in claim 9, wherein the policy rules comprise one of: a standard for cookie handling, an applicable legal restriction, and an enterprise-specific cookie handling rule. ### Claim 16 (depends on 9) The apparatus as described in claim 9, wherein the computer program instructions are further configured to receive web storage information discovered from a client storage, wherein at least one policy rule is configured to evaluate the web storage information during the evaluating operation. ### Claim 17 A computer program product in a non-transitory computer readable medium for use in a data processing system to manage cookie compliance for an application in an enterprise computer environment, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to: responsive to receipt of an operation associated with the application, receive a set of one or more cookies discovered to have been set by the application; analyze a cookie in the set to compute a set of one or more descriptive attributes required to evaluate the cookie according to a policy; receive a data set characterizing the cookie, the data set including the set of one or more descriptive attributes; and evaluate one or more policy rules and the data set to make a determination whether setting of the cookie by the application is compliant with the policy. ### Claim 18 (depends on 17) The computer program product as described in claim 17, wherein the computer program instructions are further configured to save in a registry the cookie, the data set characterizing the cookie, and the determination indicating whether the cookie setting is compliant with the policy. ### Claim 19 (depends on 18) The computer program product as described in claim 18, wherein the registry is configured to include a cookie name-to-source mapping. ### Claim 20 (depends on 17) The computer program product as described in claim 17, wherein the set of one or more descriptive attributes is one of: an indication of a content encoding type, a content type, an indication that multiple sources have set the cookie, an observation regarding how the cookie relates to other cookies set by the application or by other applications, and an indication that the cookie is associated with a given consent. ### Claim 21 (depends on 17) The computer program product as described in claim 17, wherein the computer program instructions are further configured to invoke a cookie discovery operation in response to receipt of the operation associated with the application, wherein the set of one or more cookies are discovered by the cookie discovery operation. ### Claim 22 (depends on 17) The computer program product as described in claim 17, wherein the determination also includes one of: an indication of a deviation from the policy, and guidance on how to address a compliance issue identified by the evaluating. ### Claim 23 (depends on 17) The computer program product as described in claim 17, wherein the policy rules comprise one of: a standard for cookie handling, an applicable legal restriction, and an enterprise-specific cookie handling rule. ### Claim 24 (depends on 17) The computer program product as described in claim 17, wherein the computer program instructions are further configured to receive web storage information discovered from a client storage, wherein at least one policy rule is configured to evaluate the web storage information during the evaluating operation. ### Claim 25 A cookie compliance management system, comprising: a workflow engine configured to receive a request to initiate an evaluation of an application for cookie compliance; a cookie discovery engine configured to receive a request to initiate cookie discovery against the application, the request to initiate being invoked by the workflow engine in response to receipt of the request; a cookie characterization engine configured to receive a set of base attributes associated with a cookie discovered by the cookie discovery engine, the cookie characterization engine being further configured to compute a set of one or more descriptive attributes, the descriptive attributes being required to evaluate the cookie according to a policy; a cookie policy engine configured to receive one or more policy rules and the set of descriptive attributes and, in response, to determine whether the cookie is compliant with the policy; and a cookie registry to store the cookie, the set of base attributes, the set of descriptive attributes, and a compliance determination; wherein the engines are configured to execute in an automated manner as software in one or more hardware processors.