# US 2021/0279329 A1 · Security policy and audit log two way inquiry, collation, and tracking system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0279329 A1
- Document ID: US20210279329A1
- Status: Published application
- Kind: A1
- Application number: 16/345,785
- Filed: 2019-03-21
- Published: 2021-09-09
- Earliest claimed: 2018-06-01
- Assignees: Secuve.Co., Ltd.
- Applicants: Secuve.Co., Ltd.
- Inventors: Ki Yoong HONG; Kyu Ho LEE; Sung Geun LEE; Joo Yang SON; Jong Man SONG
- Web page: https://patentgrep.com/patent/US20210279329A1

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/554: {involving event detection and direct action}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present invention relates to a security policy and audit log two-way inquiry, collation, and tracking system and method capable of effectively inquiring and confirming various pieces of log information generated due to setting and change of various security policies, and capable of inquiring and confirming a security policy related to log information based on the collected log information. According to the present invention, it is possible to inquire, collate, and track logs generated and recorded by the various security policies, it is possible to inquire, collate, and track the security policy applied to the collected log, and it is possible to inquire, collate, and track the security policy and the log in two ways and in real time.

## Claims

### Claim 1

A security policy and audit log two-way inquiry, collation, and tracking system comprising:
a security policy setting unit configured to record a security policy in an integrated security policy history DB by assigning unique policy identification information whenever the security policy is generated and changed, manage the security policy, and transmit security policy information to a security software agent, wherein the policy identification information consists of a security policy ID or the security policy ID and policy configuration information;
the security software agent configured to apply the security policy received by the security policy setting unit and generate an audit log by including the unique security policy ID or the policy configuration information related to the generated log in the log information when a log complying with the security policy or a log violating the security policy is generated;
an audit log collection unit configured to collect the audit log generated by the security software agent, extract the security policy ID or the policy configuration information from the audit log, map collected audit log to the policy identification information by setting the security policy ID or the policy configuration information as the policy identification information, and record the mapped audit log and policy identification information in the audit log DB; and
a two-way inquiry tracking unit configured to inquire, collate and track the audit log related to the security policy, and inquire, collate, and track the security policy related to the audit log by comparing the policy identification information recorded in the integrated security policy history DB with the policy identification information recorded in the audit log DB to.

### Claim 2 (depends on 1)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 1, wherein the security policy setting unit generates the policy configuration information that consists of the security policy ID capable of uniquely identifying the security policy or consists of the security policy ID and multiple items, maps the security policy ID and the security policy or maps the policy configuration information consisting of the security policy ID and the multiple items with the security policy, and records the mapped security policy ID and security policy or records the mapped policy configuration information and security policy in the integrated security policy history DB.

### Claim 3 (depends on 2)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 2, wherein the security policy setting unit collects the security policy without the security policy ID of the security software, sets the policy configuration information consisting of multiple items that includes subject information indicating an actor extracted from the security policy or an access path of the actor, object information indicating a target to be accessed through the actor or the access path, action information indicating contents to be executed with respect to the target to be accessed through the actor or the access path, maps the policy configuration information consisting of the security policy ID and the multiple items to the security policy by assigning the security policy ID, and records the mapped policy configuration information and the security policy in the integrated security policy history DB.

### Claim 4 (depends on 3)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 3, wherein the security policy setting unit assigns the security policy ID to the security policy of the security software to which the security policy ID is able to be applied, records the security policy and the assigned security policy ID in the integrated security policy history DB, transmits the security policy information including the security policy ID to the security software agent, sets the policy configuration information with respect to the security policy of the security software to which the security policy ID is not able to be applied, assigns the security policy ID, records the policy configuration information, the security policy, and the assigned security policy ID in the integrated security policy history DB, and transmits only the security policy information in which the security policy ID is not included to the security software agent.

### Claim 5 (depends on 4)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 4, wherein the security policy setting unit maps the security system ID to each security policy for the security software, and records the mapped security policy and security system ID in the integrated security policy history DB,
the audit log collection unit maps a security system ID for each audit log, and records the mapped audit log and security system ID in the audit log DB, and
the two-way inquiry tracking unit performs a two-way inquiry, collation and tracking between the security policy and the audit log by comparing the security system ID recorded in the integrated security policy history DB with the security system ID recorded in the audit log DB.

### Claim 6 (depends on 1)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 1, wherein the security software agent searches for the corresponding log from the security policy information received by the security policy setting unit when the log complying with the security policy or the log violating the security policy is generated, in a case in which the corresponding security policy ID of the log is present, the security software agent records the audit log by including the security policy ID in the log, and in a case in which the corresponding security policy ID of the log is not present in the security policy information as a result of the search, the security software agent records the audit log by including the policy configuration information in the log.

### Claim 7 (depends on 6)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 6, wherein, in a case in which the security software agent is not able to include the security policy ID in the log, the security software agent records the audit log by including the policy configuration information that contains subject information indicating an actor extracted from the security policy or an access path of the actor, object information indicating a target to be accessed through the actor or the access path, action information indicating contents to be executed with respect to the target to be accessed through the actor or the access path, and permission/denial information indicating whether to permit or deny contents to be executed with respect to the target to be accessed.

### Claim 8 (depends on 1)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 1, wherein, in a case in which the security policy ID is recorded in the collected audit log, the audit log collection unit extracts the security policy ID and uses the security policy ID as the policy identification information, and in a case in which the security policy ID is not recorded in the collected audit log, the audit log collection unit extracts the policy configuration information, inquires the integrated security policy history DB by using the policy configuration information, obtains the security policy ID, and uses the security policy ID as the policy identification information.

### Claim 9 (depends on 1)

The security policy and audit log two-way inquiry, collation, and tracking system of claim 1, further comprising:
an application information setting unit configured to record and manage information including an application ID, applicant information of the security policy, and security policy application contents in an application information DB, wherein the corresponding application ID applying the security policy is assigned to each security policy in the integrated security policy history DB, and
wherein the security policy and audit log two-way inquiry, collation, and tracking system further comprises an application information confirmation unit configured to inquire the corresponding application information for the security policy by searching the application information DB based on the application ID in the integrated security policy history DB, or inquire the corresponding application information for the security policy by searching the application information DB based on the application ID after confirming the corresponding application ID for the security policy by searching for the integrated security policy history DB based on the security policy IDs assigned to each audit log in the audit log DB.

### Claim 10

A security policy and audit log two-way inquiry, collation, and tracking method comprising:
a security policy setting step of recording and managing a security policy in an integrated security policy history DB by assigning unique policy identification information whenever the security policy is generated and changed and transmitting security policy information to a security software agent, wherein the policy identification information consists of a security policy ID or the security policy ID and policy configuration information;
a security policy application step of, by the security software agent, applying the received security policy and generating an audit log by including a unique security policy ID or the policy configuration information related to the generated log in the log information when a log complying with the security policy or a log violating the security policy is generated;
a collection step of collecting the generated audit log, extracting the security policy ID or the policy configuration information from the audit log, mapping collected audit log to the policy identification information by setting the security policy ID or the policy configuration information as the policy identification information, and recording the mapped audit log and policy identification information in the audit log DB; and
a two-way inquiry tracking step of inquiring, collating and tracking the audit log related to the security policy, and inquiring, collating, and tracking the security policy related to the audit log by comparing the policy identification information recorded in an integrated security policy history DB with the policy identification information recorded in the audit log DB.

### Claim 11 (depends on 10)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 10, wherein, in the security policy setting step, the policy configuration information that consists of the security policy ID capable of uniquely identifying the security policy or consists of the security policy ID and multiple items is generated, the security policy ID is mapped to the security policy or the policy configuration information consisting of the security policy ID and the multiple items is mapped to the security policy, and the mapped security policy ID and security policy or the mapped policy configuration information and security policy are recorded in the integrated security policy history DB.

### Claim 12 (depends on 11)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 11, wherein, in the security policy setting step, the security policy without the security policy ID is collected, the policy configuration information consisting of the multiple items that includes subject information indicating an actor extracted from the security policy or an access path of the actor, object information indicating a target to be accessed through the actor or the access path, action information indicating contents to be executed with respect to the target to be accessed through the actor or the access path is set, the policy configuration information consisting of the security policy ID and the multiple items is mapped to the security policy by assigning the security policy ID, and the mapped policy configuration information, security policy ID, and security policy are recorded in the integrated security policy history DB.

### Claim 13 (depends on 12)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 12, wherein, in the security policy setting step, the security policy ID is assigned to the security policy of the security software to which the security policy ID is able to be applied, the security policy and the assigned security policy ID are recorded in the integrated security policy history DB, the security policy information including the security policy ID is transmitted to the security software agent, the policy configuration information is set with respect to the security policy of the security software to which the security policy ID is not able to be applied, the security policy ID is assigned, the policy configuration information, the security policy, and the assigned security policy ID are recorded in the integrated security policy history DB, and only the security policy information in which the security policy ID is not included is transmitted to the security software agent.

### Claim 14 (depends on 13)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 13, wherein, in the security policy setting step, the security system ID is mapped to each security policy for the security software, and the mapped security policy and security system ID are recorded in the integrated security policy history DB,
in the audit log collection step, a security system ID is mapped for each audit log, and the mapped audit log and security system ID are recorded in the audit log DB, and
in the two-way inquiry tracking step, a two-way inquiry, collation and tracking are performed between the security policy and the audit log by comparing the security system ID recorded in the integrated security policy history DB with the security system ID recorded in the audit log DB.

### Claim 15 (depends on 10)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 10, wherein, in the security policy application step, the corresponding log is searched from the security policy information received by the security policy setting unit when the log complying with the security policy or the log violating the security policy is generated, in a case in which the corresponding security policy ID of the log is present, the audit log is recorded by including the security policy ID in the log, and in a case in which the corresponding security policy ID of the log is not present in the security policy information as a result of the search, the audit log is recorded by including the policy configuration information in the log.

### Claim 16 (depends on 15)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 15, wherein, in the security policy application step, in a case in which the security software agent is not able to include the security policy ID in the log, the audit log is recorded by including the policy configuration information that contains subject information indicating an actor extracted from the security policy or an access path of the actor, object information indicating a target to be accessed through the actor or the access path, action information indicating contents to be executed with respect to the target to be accessed through the actor or the access path, and permission/denial information indicating whether to permit or deny the contents to be executed with respect to the target to be accessed.

### Claim 17 (depends on 10)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 10, wherein, in the audit log collection step, in a case in which the security policy ID is recorded in the collected audit log, the security policy ID is extracted and used as the policy identification information, and in a case in which the security policy ID is not recorded in the collected audit log, the policy configuration information is extracted, the integrated security policy history DB is inquired by using the extracted policy configuration information, the security policy ID is obtained, and the security policy ID is used as the policy identification information.

### Claim 18 (depends on 10)

The security policy and audit log two-way inquiry, collation, and tracking method of claim 10, wherein information including an application ID, applicant information of the security policy, and security policy application contents are recorded and managed in an application information DB and the corresponding application ID applying the security policy is assigned to each security policy in the integrated security policy history DB, and
wherein the method further comprises an application information confirmation step of inquiring the corresponding application information for the security policy by searching the application information DB based on the application ID in the integrated security policy history DB, or inquiring the corresponding application information for the security policy by searching the application information DB based on the application ID after confirming the corresponding application ID for the security policy by searching for the integrated security policy history DB based on the security policy IDs assigned to each audit log in the audit log DB.