Loading patent…
AssigneeMicrosoft Corporation
InventorsRaja Pazhanivel Perumal, Nir Ben-Zvi, Anders Samuelsson, Jeffrey B. Hamblin, Ran Kalach, Ziquan Li, Matthias H. Wollnik, Clyde Law
Estimating the term…
Described is a technology, such as implemented in an operating system security system, by which a resource's metadata (e.g., including data properties) is evaluated against an audit rule or audit rules associated with that resource (e.g., object). The audit rule may be associated with all such resources corresponding to a resource manager, and/or by a resource-specific audit rule. When a resource is accessed, each audit rule is processed against the metadata to determine whether to generate an audit event for that rule. The audit rule may be in the form of one or more conditional expressions. Audit events may be maintained and queried to obtain audit information for various usage scenarios.
In a computing environment, a method performed on at least one processor, comprising, determining whether a resource has at least one associated audit rule, including any per-resource audit rule or any resource manager audit rule, or both, and if so, processing each rule, including evaluating each eligible rule against metadata associated with the resource to determine whether to generate an audit event, and if so, generating the audit event corresponding to that audit rule.
In a computing environment, a system comprising, a security mechanism, including audit logic that processes metadata associated with a resource against audit policy, the audit policy including at least one audit rule including a conditional expression, the metadata including information corresponding to at least one variable in the conditional expression, the audit logic configured to generate an audit event when the conditional expression is met, and an event log that logs the audit event.
One or more computer-readable media having computer-executable instructions, which when executed perform steps, comprising:
Dependencies are inferred from the claim text.