US 11,695,802 B2Granted

Integrated control frameworks

AssigneeJPMorgan Chase Bank, N.A.

InventorsMark F. Novak, Todd Hrycenko, Roy E. Crowder, III, Marshall C. McCain

Life of this patent

Estimating the term…

Loading patent…

Abstract

Integrated controls frameworks are disclosed. In one embodiment, in an information processing apparatus comprising at least one computer processor, a method for using an integrated control framework for an application comprising a plurality of application modules may include: (1) defining an application profile, an application model, and a target cloud environment for an application; (2) identifying a plurality of security, resiliency, and controls requirements for the target cloud environment; (3) configuring a plurality of security controls for the application based on the plurality of security, resiliency, and controls requirements; and (4) deploying the security controls to the target cloud environment.

Claims18

Dependent claims

An integrated control framework, comprising:

an application model layer that defines an application profile, an application model, and a target cloud environment for an application, the application comprising a plurality of application modules;
a control selection and parameterization layer comprising:
a standards catalog comprising a plurality of controls;
a controls catalog comprising control requirements for at least one of the target cloud environment, a jurisdiction, an industry standard, and a best practice;
and
a controls selection engine that identifies a list of inline, preventive, detective and reactive controls for the application based on the application profile and an application module of the plurality of application modules;
a control configuration and deployment layer that configures selected controls from the plurality of controls to implement the list of inline, preventive, detective and reactive controls for the application based on the target cloud environment and the application model or the application profile, comprising:
a deployment pipeline that applies preventive controls and deploys the application, wherein the application passes the preventive controls;
a runtime validation module that deploys the detective controls on the application module to identify a deviation from an expected configuration or behavior;
an inline control module that deploys inline controls;
a runtime response module comprising reactive controls;
and
a control-specific validation module that triggers a control-specific response module that applies a reactive control;
and
an evidencing, visualization, and alerting layer comprising:
an event sink that receives control events from the inline controls and the control-specific response module;
an alerting module that generates an alert in response to a control event;
an evidencing repository that logs supporting information and results of decisions for the deployed controls to a log;
and
a presentation layer that provides access to the evidencing repository.

17 more elements

A method, comprising:

defining, in an application model layer, an application profile, an application model, and a target cloud environment for an application, the application comprising a plurality of application modules;
providing a standards catalog comprising a plurality of controls;
providing a controls catalog comprising control requirements for at least one of the target cloud environment, a jurisdiction, an industry standard, and a best practice;
identifying, in a control selection engine, a list of inline, preventive, detective and reactive controls for the application based on the application profile and an application module of the plurality of application modules;
configuring, in a control configuration and deployment layer, selected controls from the plurality of controls to implement the list of inline, preventive, detective and reactive controls for the application based on the target cloud environment and the application model or the application profile, wherein the control configuration and deployment layer comprises:
a deployment pipeline that applies preventive controls and deploys the application, wherein the application passes the preventive controls;
a runtime validation module that deploys detective controls on the application module to identify a deviation from an expected configuration or behavior;
an inline control module that deploys inline controls;
a runtime response module comprising reactive controls;
and
a control-specific validation module that triggers a control-specific response module that applies a reactive control;
and
providing an evidencing, visualization, and alerting layer comprising:
an event sink that receives control events from the inline controls and the control-specific response module;
an alerting module that generates an alert in response to a control event;
an evidencing repository that logs supporting information and results of decisions for the deployed controls to a log;
and
a presentation layer that provides access to the evidencing repository.

15 more elements

A non-transitory computer readable storage medium, including instructions stored thereon, which instructions, when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

defining, in an application model layer, an application profile, an application model, and a target cloud environment for an application, the application comprising a plurality of application modules;
providing a standards catalog comprising a plurality of controls;
providing a controls catalog comprising control requirements for at least one of the target cloud environment, a jurisdiction, an industry standard, and a best practice;
identifying, in a control selection engine, a list of inline, preventive, detective and reactive controls for the application based on the application profile and an application module of the plurality of application modules;
configuring, in a control configuration and deployment layer, selected controls from the plurality of controls to implement the list of inline, preventive, detective and reactive controls for the application based on the target cloud environment and the application model or the application profile, wherein the control configuration and deployment layer comprises:
a deployment pipeline that applies preventive controls and deploys the application, wherein the application passes the preventive controls;
a runtime validation module that deploys detective controls on the application module to identify a deviation from an expected configuration or behavior;
an inline control module that deploys inline controls;
a runtime response module comprising reactive controls;
and
a control-specific validation module that triggers a control-specific response module that applies a reactive control;
and
providing an evidencing, visualization, and alerting layer comprising:
an event sink that receives control events from the inline controls and the control-specific response module;
an alerting module that generates an alert in response to a control event;
an evidencing repository that logs supporting information and results of decisions for the deployed controls to a log;
and
a presentation layer that provides access to the evidencing repository.

15 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/998,907Filed 20 Aug 2020 · us provisional application
Priority: 20 Aug 2019
Published: US 2021/0058430 A125 Feb 2021
Granted: 4 Jul 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 63/105
For controlling access to devices or network resources: multiple levels of security
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis