Methods and apparatus to grant access to cloud computing resources

• US 10,075,442 B2
• Filed: 06/30/2015
• Issued: 09/11/2018
• Est. Priority Date: 06/30/2015
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Simpson, Glen Robert, Giannesini, Didier, Ross, Clive Ilan
• Primary Examiner(s): Li, Meng
• Application Number:
  US14/788,413
• Publication Number:
  US 20170006032A1
• Time in Patent Office: 1,169 Days
• CPC Class Codes: G06F 16/144 Query formulation
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 4/21 for social networking applications
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

An example method to grant authorization to a user for accessing a cloud computing resource involves receiving a first message from a user via a social media interface. The first message includes a request to access a cloud computing resource. The example method involves determining whether the user is authorized to access the cloud computing resource. When the user is not authorized to access the cloud computing resource, the example method involves determining whether the authorization can be automatically granted without human intervention. When the authorization can be automatically granted without human intervention, the authorization is granted to the user. When the authorization cannot be automatically granted, a second message is sent to an administrator to request the human intervention to grant the user the authorization to access the cloud computing resource.

Claims

1. A method to grant authorization to a user for accessing a cloud computing resource, the method comprising:

receiving a first natural-language message posted by a user on a social media network;

interpreting, with a processor and using an autonomous computer-executable process, the first natural-language message to form a search query;

determining, with a processor and using an autonomous computer-executable process, a conversation context profile based on an overlap of a user profile, a group profile, and a domain profile associated with the user;

executing, with the processor and using the autonomous computer-executable process, the search query to identify the cloud computing resource, the search executed within a scope of the conversation context profile, wherein executing the search query within the scope of the conversation context profile includes limiting results of executing the search query to information contained in the scope of the conversation context profile;

determining, with the processor and using the autonomous computer-executable process, whether the user is authorized to access the identified cloud computing resource;

when the user is not authorized to access the cloud computing resource, determining, with the processor and using the autonomous computer-executable process, whether the authorization can be automatically granted without human intervention;

when the authorization can be automatically granted without the human intervention, granting the authorization to the user; and

when the authorization cannot be automatically granted, sending a second message to an administrator to request the human intervention to grant to the user the authorization to access the cloud computing resource.

2. A method as defined in claim 1, further including providing a third message via the social media network using the autonomous computer-executable process, the third message informing the user that the request is not grantable and asking whether the user would like to obtain authorization to access the cloud computing resource, the determining of whether the authorization can be automatically granted is performed when a user-selection is received, the user selection indicating that the user would like to obtain authorization to access the cloud computing resource.

3. A method as defined in claim 1, wherein determining whether the user is authorized to access the cloud computing resource includes determining whether the user profile of the user on the social media network indicates that the user is authorized to access the cloud computing resource, the user profile to identify cloud computing resources that the user is authorized to access in a cloud computing system.

4. A method as defined in claim 1, further including accessing a pre-defined policy to determine whether the authorization can be automatically granted without the human intervention.

5. A method as defined in claim 4, wherein the pre-defined policy is defined by an entity associated with a cloud computing system in which the cloud computing resource is located, the pre-defined policy to specify authorizations that are automatically grantable for a plurality of resources in the cloud computing system.

6. A method as defined in claim 1, wherein the first message is part of a real-time text-based chat session.

7. A method as defined in claim 1, wherein the cloud computing resource includes at least one of a database, an application, or a virtual machine.

8. A method as defined in claim 1, the search query is modified as the search query is being formed.

9. A method as defined in claim 1, wherein modifying the search query includes replacing a first term in the search query with a second term based on the conversational context profile.

10. A method as defined in claim 9, wherein the overlap of the user profile, the group profile and the domain profile includes the second term.

11. A method as defined in claim 1, wherein at least one of the user profile, the group profile or the domain includes at least one of an age of the user, a sex of the user, a conversation history, a job title, a type of computer used by the user, a type of operating system used by the user, a company name, a help ticket status, a help ticket history, a user preference, or a group membership.

12. A method as defined in claim 1, wherein executing the search query within the scope of the conversation context profile includes modifying the search query before the search query is executed.

13. A method as defined in claim 1, wherein determining the conversation context profile is further based on at least one of:

a similarity between at least two of the user profile, the group profile, or the domain profile;

a difference between at least two of the user profile, the group profile, or the domain profile;

or

a merge of at least two of the user profile, the group profile, or the domain profile.

14. An apparatus to grant authorization to a user for accessing a cloud computing resource, the apparatus comprising:

a social media interface to receive a first message posted by a user to a social media network;

a natural-language processor to interpret the first message to form a search query;

a conversation context profile generator to determine a conversation context profile based on an overlap of a user profile, a group profile, and a domain profile associated with the user;

a search executor to execute the search query within a scope of the conversation context profile to identify the cloud computing resource, wherein executing the search query within the scope of the conversation context profile includes limiting results of executing the search query to information contained in the scope of the conversation context profile;

an entitlement analyzer to;

determine, using an autonomous computer-executable process, whether the user is authorized to access the cloud computing resource; and

determine, using the autonomous computer-executable process, whether the authorization can be automatically granted without human intervention; and

an entitlement interface to;

grant the authorization to the user when the authorization can be automatically granted without the human intervention; and

send a second message to an administrator to request the human intervention to grant the authorization to the user to access the cloud computing resource when the authorization cannot be automatically granted,

at least one of the social media interface, the natural language processor, the entitlement analyzer or the entitlement interface including a logic circuit.

15. An apparatus as defined in claim 14, further including a conversation manager to provide a third message via the social media interface, the third message informing the user that the request is not grantable and asking whether the user would like to obtain authorization to access the cloud computing resource, the entitlement analyzer further to determine whether the authorization can be automatically granted when a user-selection is received, the user-selection indicating that the user would like to obtain authorization to access the cloud computing resource.

16. An apparatus as defined in claim 14, wherein the entitlement analyzer is to determine whether the user profile of the user on the social media network indicates that the user is authorized to access the cloud computing resource, the user profile to identify cloud computing resources that the user is authorized to access in a cloud computing system.

17. An apparatus as defined in claim 14, wherein the entitlement analyzer is to access a pre-defined policy to determine whether the authorization can be automatically granted without the human intervention.

18. An apparatus as defined in claim 17, wherein the pre-defined policy is to be defined by an entity associated with a cloud computing system in which the cloud computing resource is located, the pre-defined policy to specify authorizations that are automatically grantable for a plurality of resources in the cloud computing system.

19. An apparatus as defined in claim 14, wherein the social media interface includes a real-time text-based chat session including the first message.

20. An apparatus as defined in claim 14, wherein the cloud computing resource includes at least one of a database, an application, or a virtual machine.

21. A non-transitory computer-readable medium comprising computer readable instructions that, when executed, cause at least one processor to at least:

receive a first natural-language message posted by a user on a social media network;

interpret, using an autonomous computer-executable process, the first natural-language message to form a search query;

determine, using an autonomous computer-executable process, a conversation context profile based on an overlap of a user profile, a group profile, and a domain profile associated with the user;

execute, using the autonomous computer-executable process, the search query to identify the cloud computing resource;

limit, using the autonomous computer-executable process, a result of the search query to information contained in a scope of the conversation context profile;

determine, using the autonomous computer-executable process, whether the user is authorized to access the cloud computing resource;

determine, using the autonomous computer-executable process, whether the authorization can be automatically granted without human intervention;

grant the authorization to the user when the authorization can be automatically granted without the human intervention; and

send a second message to an administrator to request the human intervention to grant the user the authorization to access the cloud computing resource when the authorization cannot be automatically granted.

22. A non-transitory computer-readable medium as defined in claim 21, wherein the instructions further cause the at least one processor to provide a third message via the social media interface using the autonomous computer-executable process, the third message informing the user that the request is not grantable and asking whether the user would like to obtain authorization to access the cloud computing resource, the instructions to cause the processor determine whether the authorization can be automatically granted when a user-selection is received, the user-selection indicating that the user would like to obtain authorization to access the cloud computing resource.

23. A non-transitory computer-readable medium as defined in claim 21, wherein the instructions, when executed, cause the at least one processor to determine whether the user profile of the user indicates that the user is authorized to access the cloud computing resource, the user profile to identify cloud computing resources that the user is authorized to access in a cloud computing system.

24. A non-transitory computer-readable medium as defined in claim 21, wherein the instructions, when executed, cause the at least one processor to access a pre-defined policy to determine whether the authorization can be automatically granted without the human intervention.

25. A non-transitory computer-readable medium as defined in claim 24, wherein the pre-defined policy is defined by an entity associated with a cloud computing system in which the cloud computing resource is located, the pre-defined policy to specify authorizations that are automatically grantable for a plurality of resources in the cloud computing system.

26. A non-transitory computer-readable medium as defined in claim 21, wherein the cloud computing resource includes at least one of a database, an application, or a virtual machine.