System and method for implementing a model-based application control framework

Abstract

A system and method for implementing a model-based application control framework are disclosed. In one embodiment, in an information processing device including at least one computer processor, a method for implementing a model-based application control framework may include: (1) decomposing an application into a plurality of modules, wherein each module includes an independently executable component of the application; (2) determining a plurality of attributes of each module; (3) identifying a deployment platform for each module; (4) constructing an attribute model of the application based on the modules, attributes, and deployment platform; (5) identifying control requirements of the attribute model; (6) identifying actions to implement the control requirements; and (7) deploying the actions to implement the control requirements for the application.

Description

Technical Field

[0001] The present invention generally relates to systems and methods for implementing a model-based application control framework. Background Art

[0002] The technology landscape is vast—but it can be so specific, for example depending on geography and / or deployment type (e.g., on-premises vs. in the cloud), that it’s impossible for technology experts to understand which controls (e.g., technology governance risk and compliance, technology strategy and portfolio management, technology asset management, identity and access management, data protection, secure configuration, vulnerability management, security operations, technology development, technology operations, incident and event management, technology resiliency, etc.) apply to them and ensure their applications adhere to those controls. Summary of the Invention

[0003] A system and method for implementing a model-based application control framework are disclosed. In one embodiment, in an information processing device including at least one computer processor, a method for implementing a model-based application control framework may include: (1) decomposing an application into a plurality of modules, wherein each module includes an independently executable component of the application; (2) determining a plurality of attributes of each module; (3) identifying a deployment platform for each module; (4) constructing an attribute model of the application based on the modules, attributes, and deployment platform; (5) identifying control requirements of the attribute model; (6) identifying actions to implement the control requirements; and (7) deploying the actions to implement the control requirements for the application.

[0004] In one embodiment, the attributes may include at least one of an OS type, a data classification, and an external interface.

[0005] In one embodiment, the method may further include applying multiple questions in a question chain to refine the attributes.

[0006] In one embodiment, the attributes may be automatically identified using at least one of a code scan, an inventory system scan, and a server scan.

[0007] In one embodiment, the control requirements may be based on the organization's policies.

[0008] In one embodiment, the actions to implement the control requirements may be specific to the deployment platform.

[0009] In one embodiment, the method may further include tracking the implementation of the control requirements in the application program.

[0010] According to another embodiment, in an information processing device including at least one computer processor, a method for implementing a model-based application control framework may include: (1) decomposing an application into multiple modules, wherein each module includes an independently executable component of the application; (2) determining multiple attributes of each module; (3) identifying a deployment platform for each module; (4) identifying a design pattern associated with one of the module, the module's attributes, and the module's deployment platform; (5) identifying a control requirement for the design pattern; (6) identifying an action to implement the control requirement; and (7) deploying the action to implement the control requirement for the application.

[0011] In one embodiment, the attributes may include at least one of an OS type, a data classification, and an external interface.

[0012] In one embodiment, the attributes may be automatically identified using at least one of a code scan, an inventory system scan, and a server scan.

[0013] In one embodiment, the control requirements may be based on the organization's policies.

[0014] In one embodiment, the actions to implement the control requirements may be specific to the deployment platform.

[0015] In one embodiment, the method may further include tracking the implementation of the control requirements in the application program.

[0016] According to another embodiment, a system for implementing a model-based application control framework may include an environment for hosting an application, the environment including a monitoring agent for monitoring actions of the application; a database including a plurality of control requirements; and an electronic device including at least one computer processor. In response to actions identified by the monitoring agent, the electronic device may decompose the application into a plurality of modules, each module including independently executable components of the application; determine a plurality of attributes of each module; identify a deployment platform for each module; construct an attribute model of the application based on the modules, attributes, and deployment platform; identify control requirements for the attribute model in the database; identify actions to implement the control requirements; and deploy the actions to implement the control requirements for the application.

[0017] In one embodiment, the attributes may include at least one of an OS type, a data classification, and an external interface.

[0018] In one embodiment, the electronic device may apply multiple questions in a question chain to refine the attributes.

[0019] In one embodiment, the attributes may be automatically identified using at least one of a code scan, an inventory system scan, and a server scan.

[0020] In one embodiment, the control requirements may be based on the organization's policies.

[0021] In one embodiment, the actions to implement the control requirements may be specific to the deployment platform.

[0022] In one embodiment, the environment may be a development environment or a production environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] For a more complete understanding of the present invention, its objects and advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0024] Figure 1 A system for implementing a model-based application control framework according to one embodiment is described;

[0025] Figure 2 A method for implementing a model-based application control framework according to one embodiment is described; and

[0026] Figure 3 Described is a method for implementing a model-based application control framework using associated patterns according to one embodiment. DETAILED DESCRIPTION

[0027] Embodiments disclosed herein relate to systems and methods for implementing a model-based application control framework.

[0028] refer to Figure 1 According to one embodiment, a system for implementing a model-based application control framework is disclosed. The system 100 may include a development environment 110, a control database 120, an electronic device 130 executing a computer program / application 135, and a production environment 140.

[0029] In one embodiment, development environment 110 may be an environment in which software applications may be developed. In one embodiment, development environment 110 may include a program / application repository (not shown), a code database (not shown), a software development / management system (not shown), and the like.

[0030] In one embodiment, the development environment 110 may include or may be equipped with a monitoring agent 115 that can monitor the software, programs, applications, etc. in the development environment 110 and can initiate a control requirement review process when certain thresholds or trigger conditions (e.g., changes, etc.) are met.

[0031] Control database 120 may store controls applicable to applications developed in development environment 110. Examples of controls include risk management and security controls, such as technology governance risk and compliance controls, technology policy and portfolio management controls, technology asset management controls, identity and access management controls, data protection controls, security configuration controls, vulnerability management controls, security operations controls, technology development controls, technology operations controls, incident and event management controls, technology resiliency controls, etc. These controls are merely exemplary; the controls may depend on the type of application and / or the environment in which the application will execute.

[0032] Electronic device 130 may be any suitable electronic device, including a server, workstation, desktop computer, laptop computer, desktop computer, cloud container, etc. Electronic device 130 may execute a computer program / application 135 that may implement a model-based application control framework.

[0033] In one embodiment, user 150 can access computer program / application 135. In one embodiment, user 150 can define or review control requirements, update properties and / or modules, adopt design patterns, etc. In one embodiment, user 150 can be a developer, technical expert, information security manager, or anyone who may need to respond to a request. For example, an information security manager may want to understand which controls apply to certain applications and any gaps that exist.

[0034] The production environment 140 may be an environment in which an application is deployed after one or more controls are implemented. In one embodiment, the production environment may be a local deployment (e.g., server), off-site (e.g., public cloud, private cloud), in a virtual server, etc.

[0035] In one embodiment, the production environment 140 may also include sub-environments, such as a test environment.

[0036] In one embodiment, the production environment 140 may include or be provided with a monitoring agent 145, which may monitor the software, programs, applications, etc. in the production environment 140 and may initiate a control requirement review process when certain thresholds or trigger conditions (e.g., changes, etc.) are met.

[0037] In one embodiment, a single monitoring agent 115 or 145 may be provided for both the development environment 110 and the production environment 140 .

[0038] refer to Figure 2 According to one embodiment, a method for implementing a model-based application control framework is disclosed.

[0039] In step 205, the application may be broken down into its component parts or modules. In one embodiment, the application may be under development, completed but not yet deployed, etc. In one embodiment, the component parts or modules may be capable of running independently. Examples of modules include monolithic components, data stores, microservices, user interfaces, mobile components, robotic components, etc. Any other suitable modules or module types may be used as needed and / or desired.

[0040] In one embodiment, manual input can be used to identify the module. In another embodiment, an automated method for identifying the module can be used. For example, code analysis, infrastructure scanning, etc. can be used to identify the module.

[0041] In step 210, one or more attributes of each module and / or application may be determined. Example attributes may include the module's OS type, data classification, external interface, etc. Any suitable attributes may be used as needed and / or desired.

[0042] In one embodiment, if necessary, a chain of questions may be applied to an attribute to refine the attribute. For example, if the attribute indicates PII data, a chain of questions may be presented to determine the type of PII data, the source of the PII data, or any other information as needed and / or desired.

[0043] In one embodiment, question chaining may provide a tree-based approach to labeling attributes and may further refine the attributes.

[0044] In one embodiment, question chaining can be used with new applications.

[0045] In another embodiment, the attributes may be automatically identified using, for example, code scanning, inventory systems, server scanning, etc. In one embodiment, the automated system may be used with existing procedures.

[0046] In one embodiment, a combination of manual systems (eg, question-based) and automated systems may be used as needed and / or desired.

[0047] In step 215, a deployment platform for each module and / or application may be determined. Example deployment platforms include private clouds, public clouds, physical servers, virtual servers, and the like.

[0048] In one embodiment, the deployment platform may be identified as an attribute in step 210 above.

[0049] In step 220, an attribute model may be constructed based on the module, one or more attributes, and one or more deployment platforms. For example, the attribute module may identify attributes that may need to be controlled, deployment platforms, etc.

[0050] In step 225, control requirements for the application can be identified based on the attribute model and assigned to the requirement system. For example, backup may be applicable to a database, but the method of backing up different databases may vary depending on the deployment location, other attributes, etc.

[0051] In one embodiment, the organization's policies may be applied to the attribute model to identify control requirements.

[0052] In step 230, actions to implement the control requirements may be identified and provided to developers, build systems, etc. In one embodiment, the actions may specify the control requirements to be implemented, or may provide the control requirements to be implemented in the application. In one embodiment, the specific actions may be based on the deployment platform.

[0053] In step 235, the development of the application can be tracked to verify that the control has been implemented in the application. For example, a test standard can be provided to test the application. In another embodiment, the developer can prove the implementation of the control in the application. Other methods for verifying control implementation can be used as needed and / or desired.

[0054] In another embodiment, an automated mechanism may be provided that is consistent with a number of control requirements. For example, if a design pattern is selected or otherwise identified, the individual control requirements associated with the design pattern may be applied.

[0055] refer to Figure 3 According to another embodiment, a method for implementing a model-based application control framework is disclosed.

[0056] In step 305, the application can be broken down into its component parts or modules. This can be similar to step 205 above.

[0057] In step 310, the attributes of the module may be identified. This may be similar to step 210 above.

[0058] In step 315, the deployment platform for each module and / or application may be determined. This may be similar to step 215 above.

[0059] In step 320, a property pattern based on modules, properties, and deployment platforms may be generated, and in step 325, a design pattern based on modules, properties, and deployment platforms may be identified. For example, the design pattern may identify a set of approved control requirements.

[0060] In one embodiment, design patterns may be defined using machine learning and may be based on prior control requirements applied to modules, properties, and deployment platforms.

[0061] In step 330, the identified pattern may be applied.

[0062] In step 335 , any remaining actions for implementing the control requirements (ie, actions remaining after applying the design pattern) may be identified and provided to a developer, build system, etc. This may be similar to step 230 above.

[0063] In step 340, the development of the application can be tracked to verify that the control has been implemented in the application. This can be similar to step 235 above.

[0064] In one embodiment, a combination of attribute recognition and design pattern matching can be used to identify control requirements for a module. For example, a design pattern can be identified but rejected in favor of using an attribute model. In another embodiment, the same application can include a module that uses an attribute model to identify control requirements and a module that uses design patterns to identify control requirements.

[0065] In the following, general aspects of implementation of the systems and methods of the present invention will be described.

[0066] The system of the present invention, or a portion thereof, may be in the form of a "processor," such as a general-purpose computer. As used herein, the term "processor" should be understood to include at least one processor utilizing at least one memory. The at least one memory stores an instruction set. The instructions may be permanently or temporarily stored in one or more memories of the processor. The processor executes the instructions stored in the one or more memories to process data. The instruction set may include various instructions for performing one or more specific tasks, such as those described above. Such an instruction set for performing specific tasks may be characterized as a program, a software program, or simply software.

[0067] In one embodiment, the processing machine may be a special purpose processor.

[0068] As described above, the processing machine executes instructions stored in one or more memories to process data. Such processing of data may be, for example, in response to commands from one or more users of the processing machine, in response to previous processing, in response to a request from another processing machine, and / or in response to any other input from an automated schedule.

[0069] As described above, the processing machine used to implement the present invention can be a general-purpose computer. However, the processing machine can also utilize any of a variety of other technologies, including special-purpose computers, computer systems including, for example, microcomputers, minicomputers, or mainframes, programmed microprocessors, microcontrollers, peripheral integrated circuit components, CSICs (customer-specific integrated circuits) or ASICs (application-specific integrated circuits) or other integrated circuits, logic circuits, digital signal processors, programmable logic devices (such as FPGAs, PLDs, PLAs, or PALs), or any other device or arrangement of devices capable of implementing the steps of the process of the present invention.

[0070] The processor for implementing the present invention may utilize a suitable operating system. Thus, embodiments of the present invention may include operating systems such as iOS, OS X, Android, Microsoft Windows, and the like. TM (Microsoft Windows) operating system, Unix operating system, Linux operating system, Xenix operating system, IBM AIX TM Operating system, Hewlett-Packard UX TM Operating system, Novell Netware TM Operating system, Sun Microsystems Solaris TM Operating system, OS / 2T TM Operating system, BeOS TM Operating system, Macintosh operating system, Apache operating system, OpenStep TM Operating system or other operating system or platform processor.

[0071] It should be understood that in order to practice the methods of the present invention as described above, the processors and / or memory of a processing machine need not be physically located in the same geographic location. That is, each of the processors and memory used by the processing machine can be located in geographically different locations and connected for communication in any suitable manner. Furthermore, it should be understood that each of the processors and / or memory can be comprised of different physical pieces of equipment. Thus, the processor need not be a single piece of equipment in one location, and the memory a separate piece of equipment in another location. That is, it is contemplated that the processors can be two pieces of equipment located in two different physical locations. The two different pieces of equipment can be connected in any suitable manner. Furthermore, the memory can comprise two or more portions of memory located in two or more physical locations.

[0072] For further explanation, as described above, processing is performed by various components and various memories. However, it should be understood that according to another embodiment of the present invention, as described above, processing performed by two different components can be performed by a single component. In addition, as described above, processing performed by a different component can be performed by two different components. In a similar manner, according to another embodiment of the present invention, as described above, memory storage performed by two different memory portions can be performed by a single memory portion. In addition, as described above, memory storage performed by a different memory portion can be performed by two memory portions.

[0073] In addition, various technologies may be used to provide communication between the various processors and / or memories, as well as to allow the processors and / or memories of the present invention to communicate with any other entity; i.e., for example, to obtain further instructions or to access and use remote memory storage. Such technologies for providing such communication may include, for example, a network, the Internet, an intranet, an extranet, a local area network, an Ethernet, wireless communication via a cellular tower or satellite, or any client-server system that provides communication. Such communication technologies may use any suitable protocol, such as TCP / IP, UDP, or OSI.

[0074] As described above, an instruction set may be used in the processing of the present invention. The instruction set may be in the form of a program or software. The software may be, for example, in the form of system software or application software. The software may also be in the form of, for example, a collection of separate programs, a program module within a larger program, or a portion of a program module. The software used may also include modular programming in the form of object-oriented programming. The software tells the processor how to process the data being processed.

[0075] In addition, it should be understood that the instructions or instruction sets used in the embodiments and operations of the present invention can be in a suitable form so that the processing machine can read the instructions. For example, the instructions forming the program can be in the form of a suitable programming language, which is converted into machine language or object code to allow one or more processors to read the instructions. That is, a compiler, assembler or interpreter is used to convert the written lines of programming code or source code in a specific programming language into machine language. Machine language is a binary-coded machine instruction that is specific to a specific type of processing machine (i.e., a specific type of computer). The computer understands machine language.

[0076] According to various embodiments of the present invention, any suitable programming language may be used. Illustratively, the programming language used may include, for example, assembly language, Ada, APL, Basic, C, C++, COBOL, dBase, Forth, Fortran, Java, Modula-2, Pascal, Prolog, REXX, Visual Basic, and / or JavaScript, Phyton. Furthermore, it is not necessary to utilize a single type of instruction or a single programming language in conjunction with the operation of the systems and methods of the present invention. Rather, any number of different programming languages may be utilized as needed and / or desired.

[0077] Likewise, the instructions and / or data used in the practice of the present invention can utilize any compression or encryption technique or algorithm as needed. An encryption module can be used to encrypt data. Additionally, for example, a suitable decryption module can be used to decrypt files or other data.

[0078] As described above, the present invention can be illustratively embodied in the form of a processing machine (including, for example, a computer or computer system) including at least one memory. It should be understood that, as needed, the instruction set (i.e., software) that enables the computer operating system to perform the above-mentioned operations can be contained on any of a variety of one or more media. In addition, the data processed by the instruction set can also be contained on any of a variety of one or more media. That is, the specific medium (i.e., the memory in the processing machine) for storing the instruction set and / or data used in the present invention can, for example, take any of a variety of physical forms or transmissions. Illustratively, the medium can be paper, paper transparency, optical disc, DVD, integrated circuit, hard disk, floppy disk, optical disc, magnetic tape, RAM, ROM, PROM, EPROM, wire, cable, optical fiber, communication channel, satellite transmission, memory card, SIM card or other remote transmission and any other medium or data source that may be read by the processor of the present invention.

[0079] Furthermore, the one or more memories used in a processor implementing the present invention may be in any of a variety of forms to allow the memory to store instructions, data, or other information as needed. Thus, the memory may take the form of a database to store data. The database may use any desired file arrangement, such as a flat file arrangement or a relational database arrangement.

[0080] In the system and method of the present invention, various "user interfaces" can be utilized to allow the user to dock with one or more processors for realizing the present invention. As used herein, the user interface includes any hardware, software or combination of hardware and software that the user and the processor use that the processor uses. The user interface can, for example, be in the form of a dialogue screen. The user interface can also include any of a mouse, touch screen, keyboard, keypad, voice reader, voice recognizer, dialogue screen, menu box, list, check box, toggle switch, button or any other device that allows the user to receive information about the operation of the processor when the processor is processing an instruction set and / or providing information to the processor. Therefore, the user interface is any device that provides communication between the user and the processor. The information that the user provides to the processor through the user interface can, for example, be a form of command, data selection or some other input.

[0081] As mentioned above, the processing machine of execution instruction set utilizes user interface so that processing machine is user processing data.User interface is usually used for interacting with user to transmit information or receiving information from user by processing machine.Yet should be appreciated that according to some embodiments of system and method of the present invention, human user does not actually need to interact with the employed user interface of processing machine of the present invention.On the contrary, it can also be expected that user interface of the present invention can interact (that is, transmit and receive information) with another processing machine rather than human user.Therefore, another processing machine can be characterized as user.In addition, it can be expected that the user interface utilized in system and method of the present invention can partially interact with another or more processing machines, also partially interact with human user.

[0082] Those skilled in the art will readily appreciate that the present invention is susceptible to widespread use and application. Many embodiments and adaptations of the present invention in addition to those described herein, as well as many variations, modifications, and equivalent arrangements will be apparent or reasonably suggested by the present invention and the foregoing description without departing from the spirit or scope of the present invention.

[0083] Therefore, although exemplary embodiments related to the present invention have been described in detail herein, it should be understood that the present disclosure is merely illustrative and exemplary of the present invention and provides an enabling disclosure of the present invention. Therefore, the foregoing disclosure is not intended to interpret or limit the present invention, or otherwise exclude any other such embodiments, adaptations, variations, modifications, or equivalent arrangements.

Claims

1. A method for implementing a model-based software application control framework, the method comprising: In an information processing device comprising at least one computer processor: identifying a plurality of executable modules in a software application, the plurality of executable modules being configured to execute independently of one another; decomposing the software application into the plurality of executable modules; determining a plurality of attributes of each of the plurality of executable modules; Identify the deployment platform for each executable module; constructing an attribute model of the software application based on the executable module, the attributes, and the deployment platform; identifying control requirements for the attribute model; identifying actions for achieving the control requirements; as well as The actions are performed to implement the control requirements for the software application. 2 . The method according to claim 1 , wherein the attribute comprises at least one of an OS type, a data classification, and an external interface. 3 . The method according to claim 1 , wherein the deployment platform comprises a public cloud, a private cloud, a physical server and / or a virtual server. The method of claim 1 , wherein the attribute model identifies attributes requiring control and / or a deployment platform. The method of claim 1 , wherein the attribute is automatically identified using at least one of a code scan, an inventory system, and a server scan. The method of claim 1 , wherein the control requirement is based on an organization's policy. The method of claim 1 , wherein the actions for implementing the control requirements are specific to the deployment platform.

8. The method according to claim 1, further comprising: Implementation of the control requirements in the software application is tracked.

9. A method for implementing a model-based software application control framework, the method comprising: In an information processing device comprising at least one computer processor: identifying a plurality of executable modules in a software application, the plurality of executable modules being configured to execute independently of one another; decomposing the software application into the plurality of executable modules; determining a plurality of attributes of each of the plurality of executable modules; Identify the deployment platform for each executable module; identifying a design pattern associated with one of the executable module, the attribute of the executable module, and the deployment platform of the executable module; Identify the control requirements for the design pattern; identifying actions for achieving the control requirements; as well as The actions are deployed to implement the control requirements for the software application.

10. The method of claim 9, wherein the attribute comprises at least one of an OS type, a data classification, and an external interface.

11. The method of claim 9, wherein the attribute is automatically identified using at least one of a code scan, an inventory system, and a server scan.

12. The method of claim 9, wherein the control requirements are based on a policy of an organization.

13. The method of claim 9, wherein the actions for implementing the control requirements are specific to the deployment platform.

14. The method according to claim 9, further comprising: Implementation of the control requirements in the software application is tracked.

15. A system for implementing a model-based software application control framework, the system comprising: an environment for hosting a software application, the environment including a monitoring agent that monitors actions of the software application; A database containing multiple control requirements; and An electronic device comprising at least one computer processor, wherein the electronic device performs the following operations: In response to the action identified by the monitoring agent, identifying a plurality of executable modules in the software application, the plurality of executable modules being configured to execute independently of one another; decomposing the software application into the plurality of executable modules; determining a plurality of attributes of each of the executable modules; Identify the deployment platform for each executable module; constructing an attribute model of the software application based on the executable module, the attributes, and the deployment platform; identifying control requirements for the attribute model in the database; identifying actions for achieving the control requirements; as well as The actions are deployed to implement the control requirements for the software application.

16. The system of claim 15, wherein the attributes include at least one of an OS type, a data classification, and an external interface.

17. The system of claim 15, wherein the electronic device further applies a plurality of questions in a question chain to refine the attribute.

18. The system of claim 15, wherein the attributes are automatically identified using at least one of a code scan, an inventory system, and a server scan.

19. The system of claim 15, wherein the control requirements are based on a policy of an organization.

20. The system of claim 15, wherein the actions for implementing the control requirements are specific to the deployment platform.

Images