Patent Application
20080059643
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further purposes and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, where:
A method, apparatus and computer-usable medium are disclosed for a virtual policy control router comprising applicable control elements relating to one or more external or internal policies. In different embodiments of the invention, two or more policy control repositories are aggregated to create a virtual policy control router, accessible and navigable by users to provide relevant and applicable control elements for establishing policy compliance initiatives.
As will be appreciated by one skilled in the art, the present invention may be embodied as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module,” or “system.” Furthermore, the present invention may take the form of a computer program product on a computer-usable storage medium having computer-usable program code embodied in the medium.
Any suitable computer usable or computer readable medium may be utilized. The computer-usable or computer-readable medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a transmission media such as those supporting the Internet or an intranet, or a magnetic storage device. Note that the computer-usable or computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-usable medium may include a propagated data signal with the computer-usable program code embodied therewith, either in baseband or as part of a carrier wave. The computer usable program code may be transmitted using any appropriate medium, including but not limited to the Internet, wireline, optical fiber cable, RF, etc.
Computer program code for carrying out operations of the present invention may be written in an object oriented programming language such as Java, Smalltalk, C++ or the like. However, the computer program code for carrying out operations of the present invention may also be written in conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
The present invention is described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
Client computer 102 is able to communicate with a service provider server 150 via a network 128 using a network interface 130, which is coupled to system bus 106. Network 128 may be an external network such as the Internet, or an internal network such as an Ethernet Network or a Virtual Private Network (VPN). Using network 128, client computer 102 is able to use the present invention to access service provider server 150.
A hard drive interface 132 is also coupled to system bus 106. Hard drive interface 132 interfaces with a hard drive 134. In a preferred embodiment, hard drive 134 populates a system memory 136, which is also coupled to system bus 106. Data that populates system memory 136 includes client computer 102's operating system (OS) 138 and application programs 144.
OS 138 includes a shell 140 for providing transparent user access to resources such as application programs 144. Generally, shell 140 is a program that provides an interpreter and an interface between the user and the operating system. More specifically, shell 140 executes commands that are entered into a command line user interface or from a file. Thus, shell 140 (as it is called in UNIX®), also called a command processor in Windows®, is generally the highest level of the operating system software hierarchy and serves as a command interpreter. The shell provides a system prompt, interprets commands entered by keyboard, mouse, or other user input media, and sends the interpreted command(s) to the appropriate lower levels of the operating system (e.g., a kernel 142) for processing. While shell 140 generally is a text-based, line-oriented user interface, the present invention can also support other user interface modes, such as graphical, voice, gestural, etc.
As depicted, OS 138 also includes kernel 142, which includes lower levels of functionality for OS 138, including essential services required by other parts of OS 138 and application programs 144, including memory management, process and task management, disk management, and mouse and keyboard management.
Application programs 144 may include a browser 146. Browser 146 includes program modules and instructions enabling a World Wide Web (WWW) client (i.e., client computer 102) to send and receive network messages to the Internet using HyperText Transfer Protocol (HTTP) messaging, thus enabling communication with service provider server 150.
Application programs 144 in client computer 102's system memory also include a compliance initiative control system 148. Compliance initiative control system 148 includes code for implementing the processes described hereinbelow. In one embodiment, client computer 102 is able to download compliance initiative control system 148 from a service provider server 150.
The hardware elements depicted in client computer 102 are not intended to be exhaustive, but rather are representative to highlight components used by the present invention. For instance, client computer 102 may include alternate memory storage devices such as magnetic cassettes, Digital Versatile Disks (DVDs), Bernoulli cartridges, and the like. These and other variations are intended to be within the spirit and scope of the present invention.
In different embodiments of the invention, policy control repositories 212, 214, 216, 218 and 220 are aggregated to create a virtual policy control router 206 which is accessible and navigable to provide relevant and applicable control elements for establishing policy compliance initiatives 238. In these embodiments, similar, duplicate, conflicting and contradictory policy controls within the virtual policy control router 206 are identified and referenced to each other, their source repository (e.g., 212, 214, 216, 218 and 220), and their associated policy for appropriate reconciliation. The resulting virtual policy control router 206 is then accessed and navigated by policy compliance initiative user 202 such that predetermined control elements and processes are selected, combined, and virtually associated as appropriate to establish control environments for policy compliance initiatives 238.
In selected embodiments, virtual policy control router 206 is implemented on a centralized server that allows a policy compliance initiative user 202 to access and navigate relevant and applicable control elements for establishing policy compliance initiatives. In selected embodiments, compliance initiatives 238 are stored on a compliance initiative reference system 226. When policy compliance initiative user 202 runs reports on policy compliance initiatives 238, the compliance initiative reference system 236 queries the virtual policy control router 206 through network 204 to retrieve results for each policy control element comprising a report. Related control element results are then aggregated to create reports, thereby reducing redundant reporting activity across multiple systems.
In an embodiment of the invention, web service agents 222, 224, 226, 228, and 230 are implemented at each repository 212, 214, 216, 218 and 220 with a web service using a services oriented architecture (SOA) to access policy control elements in their respective native policy control repository 212, 214, 216, 218 and 220. Once implemented, web service agents 222, 224, 226, 228, and 230 communicate policy control information (e.g., description, last update, current status, etc.) to the virtual policy control router 206, contingent upon each control repository's existing security model and access controls. As policy control information is received from each web service agent 222, 224, 226, 228, and 230, it is relationally associated with predetermined users and/or initiatives in routing tables 232 by the virtual policy control router 236 with access control provided by access control lists 224. The router table(s) 232 may provide no additional security beyond basic authentication, and may associate records with individual users and/or initiatives. In another embodiment of the invention, web service agents 222, 224, 226, 228, and 230 cache or dynamically retrieve policy control information from their native policy control repository 212, 214, 216, 218 and 220 to service policy compliance initiative user 202 requests communicated by the virtual policy control router 206.
The compliance initiative control system 300 restarts in step 320 when a user logs-in. Once logged-in, the user views their applicable policy initiatives in step 322 to determine in step 324 if they wish to view all applicable policy initiatives or a single initiative. If the user determines in step 324 to view all applicable policy initiatives, then they are displayed in step 326 until the user ends the policy initiative in step 330. Otherwise, the user selects the appropriate filter in step 324 to view a single applicable policy initiative, which is then displayed in step 328 until the user ends the policy initiative in step 330.
While the present invention has been particularly shown and described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention. Furthermore, as used in the specification and the appended claims, the term “computer” or “system” or “computer system” or “computing device” includes any data processing system including, but not limited to, personal computers, servers, workstations, network computers, main frame computers, routers, switches, Personal Digital Assistants (PDAs), telephones, and any other system capable of processing, transmitting, receiving, capturing and/or storing data.
