Visualization of access permission status

• US 10,148,661 B2
• Filed: 01/09/2018
• Issued: 12/04/2018
• Est. Priority Date: 10/11/2007
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Faitelson, Yakov, Korkus, Ohad, Kretzer, Ophir
• Primary Examiner(s): Dwivedi, Mahesh H
• Application Number:
  US15/865,363
• Publication Number:
  US 20180198793A1
• Time in Patent Office: 329 Days
• CPC Class Codes: G06F 16/168 Details of user interfaces specifically adapted to file systems, e.g. browsing and visualisation, 2d or 3d GUIs query results presentation G06F16/156
• CPC Class Codes: G06F 16/28 Databases characterised by their database models, e.g. relational or object models
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Queries regarding access permissions of users and rights to directories in a complex enterprise are executed in near real-time, using lookups to tables that form a condensed database maintained for each file server. User information is condensed by arranging users in user groups having common data access rights. Directory permissions storage is condensed by showing only distinctive permissions to a directory in a table entry, and referencing inherited permissions of parent directories. The tables indicate recursive and ancestral relationships among the user groups and directories. They are developed and updated in advance of any queries. A consolidated view of the query results is presented on a single display screen. Using the tables results can be obtained without exhaustive searches of large file system tables.

Claims

1. A method for displaying data access privilege status for data in an enterprise, comprising:

defining user groups offering common rights of access to a plurality of file servers, said user groups comprising ancestral user groups having members that are other user groups, and participant members of said other user groups having access rights that derive from said user groups and respective ancestral user groups thereof, said file servers being organized as a hierarchy of storage elements having ancestors;

maintaining a user database of said user groups and said members, entries in said user database comprising identifiers of respective said ancestral user groups;

maintaining a storage element permissions database containing only non-inherited access permissions for distinctive storage elements, and an inheritance indicator employing only partially identical permission profiles, that identifies other said distinctive storage elements that are ancestral thereto in said hierarchy thereby to reduce data storage requirements;

consulting said user database to determine a user-oriented set of user groups offering respective said common rights of access to selected ones of said participant members;

consulting said storage element permissions database to determine a storage element-oriented set of said user groups that provide said common rights of access to selected ones of said storage elements; and

reporting members of said storage element-oriented set and said user-oriented set.

2. The method according to claim 1, further comprising the steps of:

making a determination that said user-oriented set has an intersection with said storage element-oriented set; and

responsively to said determination issuing a report that said participant members are able to access said selected ones of said storage elements.

3. The method according to claim 1, wherein said user database comprises:

a table of memberships having entries identifying ones of said user groups that respectively offer said common rights of access to said participant members; and

a table of relationships having entries identifying respective relationships among said user groups and said ancestral user groups thereof, the method further comprising the steps of;

prior to performing said step of consulting said user database, constructing said table of memberships and said table of relationships and updating said table of memberships and said table of relationships responsively to changes in a composition of any of said user groups.

4. The method according to claim 1, wherein said storage element permissions database comprises:

a table of permissions having entries that identify one of said user groups and a respective one of said storage elements;

a table of derived relationships having entries that identify one of said storage elements and a respective instance of said list, the method further comprising the steps of;

prior to performing said step of consulting said storage element permissions database constructing said table of permissions and said table of derived relationships and updating said table of permissions and said table of derived relationships responsively to changes in said access permissions.

5. A computer product for displaying data access privilege status for data in an enterprise, including a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to define user groups possessing common rights of access to a plurality of file servers, said user groups comprising ancestral user groups having members that are other user groups, and participant members of said other user groups having access rights that derive from said user groups and respective ancestral user groups thereof, said file servers being organized as a hierarchy of storage elements having ancestors, maintain a user database of said user groups and said members, entries in said user database comprising identifiers of respective said ancestral user groups, maintain a storage element permissions database containing only non-inherited access permissions for distinctive storage elements and an inheritance indicator employing only partially identical permission profiles, that identifies other said distinctive storage elements that are ancestral thereto in said hierarchy thereby to reduce data storage requirements, consult said user database to determine a user-oriented set of user groups offering respective said common rights of access to selected ones of said participant members, consult said storage element permissions database to determine a storage element-oriented set of said user groups that offer provide said common rights of access to selected ones of said storage elements, respectively, and reporting members of said storage element-oriented set and said user-oriented set.

6. The computer product according to claim 5, wherein said computer is further instructed to make a determination that said user-oriented set has an intersection with said storage element-oriented set and responsively to said determination issue a report that said participant members are able to access said selected ones of said storage elements.

7. The computer product according to claim 5, wherein said user database comprises:

a table of memberships having entries identifying ones of said user groups that respectively offer said common rights of access to said participant members; and

a table of relationships having entries identifying respective relationships among said user groups and said ancestral user groups thereof, wherein said computer is further instructed to construct said table of memberships and said table of relationships and update said table of memberships and said table of relationships responsively to changes in a composition of any of said user groups prior to a consultation of said user database.

8. The computer product according to claim 5, wherein said storage element permissions database comprises:

a table of permissions having entries that identify one of said user groups and a respective one of said storage elements; and

a table of derived relationships having entries that identify one of said storage elements and a respective instance of said list, wherein said computer is further instructed to construct said table of permissions and said table of derived relationships and update said table of permissions and said table of derived relationships responsively to changes in said access permissions prior to a consultation of said directory database.

9. A data processing system for displaying data access privilege status for data in an enterprise, comprising:

a processor linked to a plurality of file servers, said file servers being organized as a hierarchy of storage elements having ancestors, a display; and

a memory accessible by said processor, wherein said processor is operative to define user groups possessing common rights of access to said file servers, said user groups comprising ancestral user groups having members that are other user groups, and participant members of said other user groups having access rights that derive from said user groups and respective ancestral user groups thereof, to maintain a user database of said user groups and said members, entries in said user database comprising identifiers of respective said ancestral user groups and to maintain a storage element permissions database containing only non-inherited access permissions for distinctive storage elements and an inheritance indicator employing only partially identical permission profiles, that identifies other said distinctive storage elements that are ancestral thereto in said hierarchy thereby to reduce data storage requirements, to consult said user database to determine a user-oriented set of user groups offering respective said common rights of access to selected ones of said participant members and consult said storage element permissions database to determine a storage element-oriented set of said user groups that provide said common rights of access to selected ones of said storage elements, and to report members of said storage element-oriented set and said user-oriented set.

10. The data processing system according to claim 9, wherein said processor is operative to make a determination that said user-oriented set has an intersection with said storage element-oriented set and responsively to said determination issue a report that said participant members are able to access said selected ones of said storage elements.

11. The data processing system according to claim 9, wherein said user database comprises:

a table of memberships having entries identifying ones of said user groups that respectively offer said common rights of access to said participant members; and

a table of relationships having entries identifying respective relationships among said user groups and said ancestral user groups thereof, wherein said processor is operative to construct said table of memberships and said table of relationships and update said table of memberships and said table of relationships responsively to changes in a composition of any of said user groups prior to a consultation of said user database.

12. The data processing system according to claim 9, wherein said storage element permissions database comprises:

a table of permissions having entries that identify one of said user groups and a respective one of said storage elements; and

a table of derived relationships having entries that identify one of said storage elements and a respective instance of said list, wherein said processor is operative to construct said table of permissions and said table of derived relationships and update said table of permissions and said table of derived relationships responsively to changes in said access permissions prior to a consultation of said storage element permissions database.