Automatic folder access management

• US 20070244899A1
• Filed: 04/12/2007
• Published: 10/18/2007
• Est. Priority Date: 04/14/2006
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Faitelson, Yakov, Korkus, Ohad
• Granted Patent: US 8,561,146 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Methods and systems are provided for decentralizing user data access rights control activities in networked organizations having diverse access control models and file server protocols. A folder management application enables end users of the file system to make requests for access to storage elements, either individually, or by becoming members of a user group having group access privileges. Responsibility for dealing with such requests is distributed to respective group owners and data owners, who may delegate responsibility to authorizers. The application may also consider automatically generated proposals for changes to access privileges. An automatic system continually monitors and analyzes access behavior by users who have been pre-classified into groups having common data access privileges. As the organizational structure changes, these groups are adaptively changed both in composition and in data access rights.

Claims

1. A computer-implemented method for controlling data access by users of a file system, comprising the steps of:

receiving a request for a change in user access rights of one of said users to a designated storage element of said file system, wherein said file system comprises storage elements, respective first portions of said storage elements being owned by data owners that control said user access rights thereto, and a user repository in said file system includes groups of said users, wherein said groups have common access rights to respective second portions of said storage elements;

identifying one of said groups, wherein said common access rights of said identified group include said designated storage element;

obtaining a consent to said request from said data owner of said designated storage element; and

responsively to said consent adjusting a membership of said one user in said identified group to conform said user access rights of said one user to said designated storage element to said request.

2. The method according to claim 1, further comprising the step of establishing at least one data authorizer to act on behalf of said data owner, wherein said step of obtaining a consent comprises obtain said consent from said at least one data authorizer.

3. The method according to claim 1, wherein said identified group has a group owner that controls said membership thereof, further comprising the step of obtaining a concurrence from said group owner of said identified group to change said membership of said one user therein.

4. The method according to claim 3, further comprising the step of establishing at least one group authorizer to act on behalf of said group owner, wherein said step of obtaining a concurrence comprises obtain said concurrence from said at least one group authorizer.

5. The method according to claim 3, wherein said request comprises an addition of said user access rights of said one user to said designated storage element and said step of adjusting a membership comprises accepting said one user as a member of said identified group.

6. The method according to claim 3, further comprising the steps of:

monitoring accesses of said users to said storage elements and deriving respective access profiles thereof; and

responsively to said access profiles automatically generating said request.

7. The method according to claim 6, further comprising the step of automatically defining said groups responsively to said access profiles.

8. The method according to claim 1, wherein said request comprises a deletion of said user access rights of said one user to said designated storage element and said step of adjusting a membership comprises removing said one user as a member of said identified group.

9. The method according to claim 1, further comprising the steps of:

establishing a rule having at least one satisfaction criterion;

determining that said request complies with said criterion; and

responsively to said step of determining performing said step of obtaining a consent to said request automatically.

10. A computer software product for controlling data access by users of a file system, including a tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to receive a request for a change in user access rights of one of said users to a designated storage element of said file system, wherein said file system comprises storage elements, respective first portions of said storage elements being owned by data owners that control said user access rights thereto, and a user repository in said file system includes groups of said users, wherein said groups have common access rights to respective second portions of said storage elements, said computer being caused by said instructions to identify one of said groups, wherein said common access rights of said identified group include said designated storage element, obtain a consent to said request from said data owner of said designated storage element, and responsively to said consent adjust a membership of said one user in said identified group to thereby conform said user access rights of said one user to said designated storage element to said request.

11. The computer software product according to claim 10, wherein said identified group has a group owner that controls said membership thereof, further wherein said computer is further instructed to obtain a concurrence from said group owner of said identified group to change said membership of said one user therein.

12. The computer software product according to claim 11, wherein said request comprises an addition of said user access rights of said one user to said designated storage element and said computer is further instructed to add said one user as a member of said identified group.

13. The computer software product according to claim 10, wherein said request comprises a deletion of said user access rights of said one user to said designated storage element and wherein said computer is further instructed to remove said one user as a member of said identified group.

14. The computer software product according to claim 10, further wherein said computer is further instructed to instantiate a rule having at least one satisfaction criterion, make a determination that said request complies with said criterion, and responsively to said determination automatically provide said consent to said request.

15. A data processing apparatus for controlling data access by users of a file system, comprising:

a processor; and

a memory accessible to said processor having instructions resident therein, said processor operative by executing said instructions to receive a request for a change in user access rights of one of said users to a designated storage element of said file system, wherein said file system comprises storage elements, respective first portions of said storage elements being owned by data owners that control said user access rights thereto, and a user repository in said file system includes groups of said users, wherein said groups have common access rights to respective second portions of said storage elements, identify one of said groups, wherein said common access rights of said identified group include said designated storage element, obtain a consent to said request from said data owner of said designated storage element and responsively to said consent adjust a membership of said one user in said identified group to thereby conform said user access rights of said one user to said designated storage element to said request.

16. The data processing apparatus according to claim 15, wherein said identified group has a group owner that controls said membership thereof, further wherein said processor is operative to obtain a concurrence from said group owner of said identified group to change said membership of said one user therein.

17. The data processing apparatus according to claim 16, wherein said request comprises an addition of said user access rights of said one user to said designated storage element and said processor is instructed by said instructions to add said one user as a member of said identified group.

18. The data processing apparatus according to claim 15, wherein said request comprises a deletion of said user access rights of said one user to said designated storage element and said processor is operative to remove said one user as a member of said identified group.

19. The data processing apparatus according to claim 15, further wherein said processor is operative to instantiate a rule having at least one satisfaction criterion, make a determination that said request complies with said criterion, and responsively to said determination automatically provide said consent to said request.