Self-service systems and methods for granting access to resources

• US 8,639,827 B1
• Filed: 04/21/2011
• Issued: 01/28/2014
• Est. Priority Date: 04/23/2010
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Dinn, Stephen Brian, Frosst, Ian Murray
• Primary Examiner(s): BATES, KEVIN T
• Application Number:
  US13/092,051
• Time in Patent Office: 1,013 Days
• Field of Search: 709/229, 709/225, 709/217
• US Class Current: 709/229
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A self-service system is provided that can automatically identify one or more existing groups to which a user can self-select to access a resource. The self-service system can identify any suitable existing group without requiring an administrator to predefine groups according to roles. In some implementations, the system intelligently identifies one or more suitable groups for a user from a list of available groups by analyzing a set of rules or criteria. For instance, the system can perform a weighted analysis of various rules and/or criteria to automatically and dynamically identify groups that have a closest fit to the access rights needed or requested by the user. Further, the system can evaluate certain best or preferred grouping practices to identify suitable groups. As a result, in certain embodiments, the self-service system alleviates planning burdens on administrators and provides greater flexibility in providing users with access to resources.

Claims

1. A method of automatically identifying suitable groups for a user to join and thereby gain access to a network resource, the method comprising:

receiving a request from a user to obtain access to a network resource for which the user does not currently have access, the request comprising a requested level of access for accessing the network resource;

identifying available groups that have access to the network resource;

computing a suitability of each of the available groups based at least partly on the requested level of access rights and on one or more characteristics of the available groups;

recommending one or more of the available groups to the user as one or more suitable groups based on the computed suitability for the one or more available groups, thereby making the one or more suitable groups available for the user to join, enabling the user to obtain access to the network resource;

receiving a user selection of one of the one or more available groups from the user; and

submitting the user selection to an administrator for approval;

wherein at least said computing is implemented by a computer system comprising computer hardware.

2. The method of claim 1, wherein said computing the suitability comprises calculating a relatively higher suitability score if a selected one of the available groups has access rights matching the requested level of access rights and computing a relatively lower suitability score if the access rights do not match the requested level of access rights.

3. The method of claim 2, wherein said computing the suitability comprises calculating a relatively lower suitability score if a selected one of the available groups has access rights that are inherited from another group and computing a relatively higher suitability score if the access rights are not inherited.

4. The method of claim 1, wherein said computing the suitability comprises scoring the available groups based on the access rights held by each of the available groups and based on the one or more characteristics of the available groups.

5. The method of claim 4, further comprising applying user-determined weightings to scores obtained by computing the suitability.

6. The method of claim 1, wherein said computing the suitability of each of the available groups further comprises computing the suitability based further on a type of the user that is requesting access to the network resource.

7. The method of claim 1, wherein the network resource comprises one of the following:

a computing system, a peripheral, a document, a mailbox, a calendar, an application, a folder, a directory, and a file.

8. Non-transitory physical computer storage comprising instructions stored thereon for implementing, in one or more processors, a method of automatically identifying suitable groups for a user to join and thereby gain access to a network resource, the method comprising:

receiving a request for access to a network resource for which a user does not currently have access;

identifying available groups that have access to the network resource;

computing a suitability of each of the available groups based on one or more suitability factors, the one or more suitability factors reflecting one or more of the following;

access rights held by the available groups, one or more characteristics of the available groups, one or more characteristics of the resource, and one or more characteristics of the user;

outputting one or more of the available groups as one or more suitable groups based on the computed suitability for the one or more available groups; and

wherein said outputting comprises making the one or more suitable groups available for selection by the user.

9. The non-transitory physical computer storage of claim 8, wherein said identifying the available groups comprises accessing a security descriptor of the network resource.

10. The non-transitory physical computer storage of claim 8, wherein the one or more characteristics of the available groups comprise a type of the available groups.

11. The non-transitory physical computer storage of claim 8, wherein the one or more characteristics of the available groups comprise a domain of the available groups.

12. The non-transitory physical computer storage of claim 8, wherein the one or more characteristics of the available groups comprise a number of users of the available groups.

13. The non-transitory physical computer storage of claim 8, wherein the one or more characteristics of the available groups comprise a nesting distance of the available groups from the resource.

14. The non-transitory physical computer storage of claim 8, wherein the one or more characteristics of the available groups comprise a number of resources to which the available groups have access.

15. The non-transitory physical computer storage of claim 8, wherein said outputting comprises making the one or more suitable groups available for selection by an administrator.

16. A system for automatically identifying suitable groups for a user to join and thereby gain access to a network resource, the system comprising:

a group identifier module configured to receive a request for access to a network resource for which a user does not currently have access and to identify available groups that have access to the network resource;

a suitability calculator implemented by a computer system comprising computer hardware, the suitability calculator configured to compute a suitability of each of the available groups based on one or more suitability factors, the one or more suitability factors reflecting one or more of the following;

access rights held by the available groups, one or more characteristics of the available groups, and one or more characteristics of the user;

a recommendation module configured to output one or more of the available groups as one or more suitable groups based on the computed suitability for the one or more available groups; and

wherein the recommendation module is further configured to receive a user selection of one of the one or more suitable groups from the user.

17. The system of claim 16, further comprising a management console configured to report the user selection to an administrator for approval.

18. The system of claim 16, wherein the one or more characteristics of the available groups comprises one or more of the following:

a type of the available groups, a domain of the available groups, a nesting distance of the available groups from the resource, a number of resources to which the available groups have access, and publication status of the available groups.