Cookie compliance management
A cookie compliance management system enables automated evaluation of cookie compliance within an enterprise. The system determines whether a cookie set by an application in the environment is compliant with a policy. It comprises a workflow engine, a cookie discovery engine (CDE), a cookie characterization engine (CCE), a cookie policy engine (PE), and a cookie registry. The workflow engine receives a request to initiate an evaluation of an application for cookie compliance. The CDE is invoked and returns cookies that are set by the application. The CCE receives a set of base attributes associated with a cookie discovered by the CDE, and computes a set of descriptive attributes determined to be required to enable evaluation of the cookie according to a policy. The policy engine receives policy rules and the set of descriptive attributes and, in response, determines whether the cookie is compliant with the policy. The cookie registry stores cookie data.
1. A compliance management system, comprising:
a discovery engine configured to identify a hypertext transfer protocol (HTTP) cookie set by an application and a set of one or more base attributes associated with the HTTP cookie;
a characterization engine configured to characterize the HTTP cookie by a set of one or more descriptive attributes required to evaluate the HTTP cookie according to a policy, wherein the set of one or more descriptive attributes associated with the HTTP cookie are calculated based on the set of one or more base attributes identified by the discovery engine; and
a policy engine configured to apply the policy to the HTTP cookie identified by the discovery engine and characterized by the characterization engine;
wherein the discovery engine, the characterization engine, and the policy engine are configured to execute in an automated manner as software in one or more hardware processors.
2. The compliance management system as described in claim 1 , further including an orchestrator engine to manage the discovery engine, the characterization engine, and the policy engine.
3. The compliance management system as described in claim 1 , wherein the policy is selected from the group consisting of: a cookie standard, an application legal restriction, and an enterprise-specific cookie policy.
4. The compliance management system as described in claim 1 , further including a registry to store the HTTP cookie, the set of one or more base attributes, the set of one or more descriptive attributes, and a compliance determination output by the policy engine.
5. The compliance management system as described in claim 4 , wherein the registry is queried by the policy engine to provide a response to a query.
6. The compliance management system as described in claim 5 , wherein the query is a cookie name and the response is a source that set the HTTP cookie together with a compliance status.
7. The compliance management system as described in claim 5 , wherein the query is a source, and the response is one or more HTTP cookies set by the source together with their compliance status.
8. A method to manage cookie compliance for an application in an enterprise computer environment, comprising:
identifying, by a discovery engine, a hypertext transfer protocol (HTTP) cookie set by the application and a set of one or more base attributes associated with the HTTP cookie;
characterizing, by a characterization engine, the HTTP cookie by a set of one or more descriptive attributes required to evaluate the HTTP cookie according to a policy, wherein the set of one or more descriptive attributes associated with the HTTP cookie are calculated based on the set of one or more base attributes identified by the discovery engine; and
applying, by a policy engine, the policy to the HTTP cookie identified by the discovery engine and characterized by the characterization engine.
9. The method as described in claim 8 , further including orchestrating, by an orchestrator engine, the discovery engine, the characterization engine, and the policy engine.
10. The method as described in claim 8 , wherein the policy is selected from the group consisting of: a cookie standard, an application legal restriction, and an enterprise-specific cookie policy.
11. The method as described in claim 8 , further including storing, in a registry, the HTTP cookie, the set of one or more base attributes, the set of one or more descriptive attributes, and a compliance determination output by the policy engine.
12. The method as described in claim 11 , further including issuing a query, by the policy engine, to the registry and providing a response to the query.
13. The method as described in claim 12 , wherein the query is a cookie name and the response is a source that set the HTTP cookie together with a compliance status.
14. The method as described in claim 12 , wherein the query is a source, and the response is one or more HTTP cookies set by the source together with their compliance status.
15. A computer program product in a non-transitory computer readable medium for use in a data processing system to manage cookie compliance for an application in an enterprise computer environment, the computer program product holding computer program instructions that, when executed by the data processing system, are configured as:
a discovery engine that identifies a hypertext transfer protocol (HTTP) cookie set by the application and a set of one or more base attributes associated with the HTTP cookie;
a characterization engine that characterizes the HTTP cookie by a set of one or more descriptive attributes required to evaluate the HTTP cookie according to a policy, wherein the set of one or more descriptive attributes associated with the HTTP cookie are calculated based on the set of one or more base attributes identified by the discovery engine; and
a policy engine that applies the policy to the HTTP cookie identified by the discovery engine and characterized by the characterization engine.
16. The computer program product as described in claim 15 , wherein the computer program instructions include program code further configured as an orchestrator engine that manages the discovery engine, the characterization engine, and the policy engine.
17. The computer program product as described in claim 15 , wherein the policy is selected from the group consisting of: a cookie standard, an application legal restriction, and an enterprise-specific cookie policy.
18. The computer program product as described in claim 15 , wherein the computer program instructions include program code further configured to manage a registry to store the HTTP cookie, the set of one or more base attributes, the set of one or more descriptive attributes, and a compliance determination output by the policy engine.
19. The computer program product as described in claim 18 , wherein the computer program instructions include program code further configured to control the policy engine to query the registry and to provide a response to a query.
20. The computer program product as described in claim 19 , wherein the query is a cookie name and the response is a source that set the HTTP cookie together with a compliance status.
21. The computer program product as described in claim 19 , wherein the query is a source, and the response is one or more HTTP cookies set by the source together with their compliance status.