Policy enforcement using ESSO
View Patent ↗A method for enforcing policies used with a computer client, the method including receiving, at policy decision point (PDP) processor, information from a single sign-on (SSO) system indicating an occurrence of an event of interest on the computer client, performing, using the PDP processor, a policy check in response to the occurrence of the event of interest, wherein a policy check result is generated, and providing the generated policy check result to the SSO system.
1. A method for enforcing policies used with a computer client, the method comprising:
receiving, at policy decision point (PDP) processor, information from an enterprise single sign-on (ESSO) system indicating an occurrence of an event of interest of a client application running on the computer client;
performing, using the PDP processor and the information from the ESSO system, a policy check in response to the occurrence of the event of interest, wherein a policy check result is generated; and
providing the generated policy check result to a policy enforcement point (PEP), the PEP being the ESSO system configured for policy enforcement at the computer client, wherein the ESSO system forces a shutdown of the client application running on the computer client and the enforcement is transparent to the client application.
2. The method of claim 1 wherein performing the policy check includes performing a separation of duty policy check.
3. The method of claim 2 wherein the separation of duty policy check is a dynamic separation of duty policy check.
4. The method of claim 1 wherein the event of interest is selected from the group consisting of launching a computer application, logging onto the computer application, attempting to start the computer application, accessing a webpage, and accessing a remote server.
5. The method of claim 1 further comprising limiting access to a computer application until the policy check result is generated.
6. The method of claim 1 further comprising limiting access to a computer application as a function of the policy check result.
7. The method of claim 1 further comprising automating a logon process of a computer application as a function of the policy check result.
8. The method of claim 1 further comprising receiving, at the PDP processor, information relating to events of interest on a plurality of computer clients.
9. The method of claim 8 wherein the events of interest are selected from the group consisting of attempting access to a computer application, accessing the computer application, shutting down of the computer application, and logging off of the computer application.
10. The method of claim 9 further comprising preventing access to a computer application running on a first computer client in response to a computer application running on a second computer client.
11. The method of claim 1 further comprising storing the policy check result in a log file.
12. The method of claim 1 further comprising maintaining a list of active computer applications based upon the information received from the ESSO system.
13. The method of claim 12 wherein the list of active computer applications relates to a plurality of computer clients.
14. The method of claim 13 wherein the performing the policy check is performed using the list of active computer applications.
15. The method of claim 12 further comprising updating the list of active computer applications in response to at least one of a shutdown event and a logoff event.
16. A policy enforcement system for use with a computer client configured to execute computer applications, the system comprising:
a first hardware processor coupled to memory configured as an enterprise single sign-on (ESSO) system that is configured to monitor the computer client for an occurrence of an event of interest of a running client application;
a second hardware processor coupled to memory configured as a policy decision point (PDP) in communication with the ESSO system and configured to:
receive from the processor configured as an ESSO system an indication of the occurrence of the event of interest;
perform a policy check in response to the occurrence of the event of interest;
provide a policy check result to the processor configured as an ESSO system; and
wherein the processor configured as an ESSO system is further configured to manage the computer application as a function of the policy check result wherein the ESSO system forces a shutdown of the client application running on the computer client and forcing the shutdown is transparent to the client application.
17. The system of claim 16 wherein the processor configured as a PDP is configured to perform a separation of duty policy check.
18. The system of claim 17 wherein the separation of duty policy check is a dynamic separation of duty policy check.
19. The system of claim 16 wherein the event of interest is selected from the group consisting of launching a computer application, logging onto the computer application, attempting to start the computer application, accessing a webpage, and accessing a remote server.
20. The system of claim 16 wherein the processor configured as an ESSO system is configured to limit access to the computer application until the policy check result is generated.
21. The system of claim 16 wherein the processor configured as an ESSO system is further configured to automate the logon process of the computer application as a function of the policy check result.
22. The system of claim 16 wherein the processor configured as a PDP processor is further configured to receive information relating to events of interests on a plurality of computer clients.
23. The system of claim 22 wherein the events of interest are selected from the group consisting of attempting access to the computer application, accessing the computer application, shutting down of the computer application, and logging off of the computer application.
24. The system of claim 16 wherein the processor configured as a PDP processor is configured to identify a policy violation in response to a computer application running on another computer client.
25. The system of claim 16 wherein the processor configured as a PDP processor is configured to store the policy check result in a log file.
26. The system of claim 16 wherein the processor configured as a PDP processor is further configured to maintain a list of active computer applications based upon the information received from the ESSO system.
27. The system of claim 26 wherein the list of active computer applications relates to a plurality of computer clients.
28. The system of claim 27 wherein the processor configured as a PDP processor is further configured to perform the policy check using the list of active computer applications.
29. The system of claim 26 wherein the processor configured as a PDP processor is further configured to update the list of active computer applications in response to at least one of a shutdown event and a logoff event.
30. A method for enforcing policies used with a plurality of computer clients, the method comprising:
receiving, at policy decision point (PDP) processor, information from an enterprise single sign-on (ESSO) system indicating an occurrence of an event of interest of a first client application on one of the plurality of computer clients, the event associated with a user identity, wherein the PDP processor is a hardware processor coupled to memory;
performing, using the PDP processor and the information from the ESSO system, a dynamic segregation of duty policy check, the policy check including checking a list indicating currently active applications associated with the user identity, wherein a policy check result is generated, the policy check being performed in response to the occurrence of the event of interest; and
providing the generated policy check result to the ESSO system for policy enforcement at one or more of the plurality of computer clients, the enforcement being performed by the ESSO system and includes forcing a shutdown of at least one of the currently active applications, the enforcement being transparent to the first client application and the currently active applications.