Techniques for providing role-based access control using dynamic shared accounts

• US 8,869,244 B1
• Filed: 12/29/2011
• Issued: 10/21/2014
• Est. Priority Date: 05/03/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sundaram, Sharada, Sawhney, Sanjay, Koeten, Robert
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US13/340,264
• Time in Patent Office: 1,027 Days
• Field of Search: 726/2, 726/4
• US Class Current: 726/4
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/5061 Partitioning or combining of resources
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

Techniques for providing role-based access control using dynamic shared accounts are disclosed. In one particular exemplary embodiment, the techniques may be realized as a system and method for providing role-based access using dynamic shared accounts. For example, the system may comprise one or more processors communicatively coupled to a network. The one or more processors may be configured to: receive a request for access to an account, wherein the request comprises an identifier associated with a user; authenticate the user for access to the account; identify one or more predetermined roles associated with the account for the user; identify one or more pseudo accounts corresponding to the one or more predetermined roles; map the user to the one or more pseudo accounts; and provide user access to the account based on the mapping and with access privileges associated with the one or more predetermined roles associated with the user.

Claims

1. A system for providing role-based access using dynamic shared accounts comprising:

one or more processors communicatively coupled to a network, wherein the one or more processors are configured to;

receive a request for access to an account, wherein the request comprises an identifier associated with a user;

authenticate the user for access to the account;

identify one or more predetermined roles associated with the account for the user;

identify one or more pseudo accounts corresponding to the one or more predetermined roles, wherein the one or more pseudo accounts enable role-based access control using dynamic shared accounts compatible across multiple applications;

determine availability of the one or more pseudo accounts and possible alternative pseudo accounts based upon current status;

map the user to the one or more pseudo accounts; and

provide user access to the account based on the mapping and with access privileges associated with the one or more predetermined roles associated with the user.

2. The system of claim 1, wherein the account is a shared Software-as-a-Service (SaaS) account.

3. The system of claim 1, wherein the identifier comprises at least one of a user identifier and password.

4. The system of claim 1, wherein authenticating the user further comprises providing single sign-on access to at least the account.

5. The system of claim 1, wherein mapping the user to the one or more pseudo accounts comprises a dynamic mapping, wherein the dynamic mapping comprises performing an action in the event the one or more pseudo accounts are unavailable.

6. The system of claim 5, wherein the action comprises at least one of following:

notifying the user of the unavailability of the one or more pseudo accounts;

halting the mapping action; and

determining availability of one or more other pseudo accounts of equal or lesser access privileges and mapping the user to the one or more other pseudo accounts.

7. The system of claim 1, wherein the one or more processors are further configured to:

receive a request for access to a second account;

authenticate the user for access to the second account based on a single sign-on access to the second account;

identify one or more predetermined roles associated with the second account for the user;

identify one or more pseudo accounts corresponding to the one or more predetermined roles associated with the second account;

map the user to the one or more pseudo accounts associated with the second account; and

provide access to the second account based on the mapping and with access privileges associated with the one or more predetermined roles associated with the user for the second account.

8. A method for providing role-based access using dynamic shared accounts comprising:

receiving a request for access to an account, wherein the request comprises an identifier associated with a user;

authenticating, using at least one computer processor, the user for access to the account;

identifying one or more predetermined roles associated with the account for the user;

identifying one or more pseudo accounts corresponding to the one or more predetermined roles, wherein the one or more pseudo accounts enable role-based access control using dynamic shared accounts compatible across multiple applications;

determining availability of the one or more pseudo accounts and possible alternative pseudo accounts based upon current status;

mapping the user to the one or more pseudo accounts; and

providing user access to the account based on the mapping and with access privileges associated with the one or more predetermined roles associated with the user.

9. The method of claim 8, wherein the account is a shared Software-as-a-Service (SaaS) account.

10. The method of claim 8, wherein the identifier comprises at least one of a user identifier and password.

11. The system of claim 8, wherein authenticating the user further comprises providing single sign-on access to at least the account.

12. The method of claim 8, wherein mapping the user to the one or more pseudo accounts comprises a dynamic mapping, wherein the dynamic mapping comprises performing an action in the event the one or more pseudo accounts are unavailable.

13. The method of claim 12, wherein the action comprises at least one of following:

notifying the user of the unavailability of the one or more pseudo accounts;

halting the mapping action; and

determining availability of one or more other pseudo accounts of equal or lesser access privileges and mapping the user to the one or more other pseudo accounts.

14. The method of claim 8, further comprising:

receiving a request for access to a second account;

authenticating the user for access to the second account based on a single sign-on access to the second account;

identifying one or more predetermined roles associated with the second account for the user;

identifying one or more pseudo accounts corresponding to the one or more predetermined roles associated with the second account;

mapping the user to the one or more pseudo accounts associated with the second account; and

providing user access to the second account based on the mapping and with access privileges associated with the one or more predetermined roles associated with the user for the second account.

15. A non-transitory computer-readable storage medium storing a computer program of instructions configured to be readable by at least one computer processor for instructing the at least one computer processor to execute a computer process for performing the method of claim 8.

16. A system for providing role-based access using dynamic shared accounts comprising:

one or more processors communicatively coupled to a network, wherein the one or more processors are configured to;

create at least one account associated with a service;

create one or more roles for the at least one account;

create at least one pseudo account corresponding to each of the one or more roles, wherein the at least one pseudo account enables role-based access control using dynamic shared accounts compatible across multiple applications;

determine availability of the at least one pseudo account and possible alternative pseudo accounts based upon current status; and

assign at least one of the one or more roles to a user for dynamically mapping the user to the at least one pseudo account for access to the at least one account based on the one or more roles.

17. The system of claim 16, wherein the at least one account is at least one shared account and the service is a Software-as-a-Service.

18. A method for providing role-based access using dynamic shared accounts comprising:

creating at least one account associated with a service;

creating one or more roles for the at least one account;

creating, using at least one computer processor, at least one pseudo account corresponding to each of the one or more roles, wherein the at least one pseudo account enables role-based access control using dynamic shared accounts compatible across multiple applications;

determining availability of the at least one pseudo account and possible alternative pseudo accounts based upon current status; and

assigning at least one of the one or more roles to a user for dynamically mapping the user to the at least one pseudo account for access to the at least one account based on the one or more roles.

19. The method of claim 18, wherein the at least one account is at least one shared account and the service is a Software-as-a-Service.

20. A non-transitory computer-readable storage medium storing a computer program of instructions configured to be readable by at least one computer processor for instructing the at least one computer processor to execute a computer process for performing the method of claim 18.