On-demand authorization management

• US 9,069,984 B2
• Filed: 12/21/2011
• Issued: 06/30/2015
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Said, Bare, Eberlein, Peter
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US13/334,009
• Publication Number:
  US 20130167199A1
• Time in Patent Office: 1,287 Days
• Field of Search: 726/4, 726/22, 726/27, 713/165, 713/168
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods and apparatus, including computer program products, are provided for authorization management. In one aspect, there is provided a computer-implemented method. The method may include receiving a request to authorize at least one user to at least one module of a system; mapping the received request to a semantic tag; processing, based on the semantic tag, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and sending a response to the request to authorize the at least one user, wherein the response is in accordance with the result of the processing. Related apparatus, systems, methods, and articles are also described.

Claims

1. A non-transitory computer-readable storage medium containing instructions to configure at least one processor to cause operations comprising:

receiving a request to authorize at least one user to at least one module of a system;

determining at least one of a role or a work center of the at least one user;

mapping, based on the determining, the received request in a first format to a semantic tag in a common format, wherein the common format indicates the at least one of the role or the work center;

processing, based on the semantic tag in the common format, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and

detecting, based on at least one segregation of duty rule, whether the request by the at least one user poses a segregation of duty violation, wherein the at least one segregation of duty rule represents a rule to segregate an action indicated by the received request from the determined at least one of the role or the work center of the at least one user; and

authorizing, when the processing grants the access and the segregation of duty violation is not detected, the at least one user access to the at least one module;

sending a first message indicating the authorizing, when the processing grants the access and the segregation of duty violation is not detected;

sending a second message indicating access is not granted, when at least one of the processing does not grant the access or the segregation of duty violation is detected.

2. The computer-readable storage medium of claim 1, wherein the at least one module is implemented as at least one of an on-premises module and an on-demand module.

3. The computer-readable storage medium of claim 1 further comprising:

converting the first message to at least one of the first format or a second format before sending the first message.

4. A method comprising:

receiving a request to authorize at least one user to at least one module of a system;

determining at least one of a role or a work center of the at least one user;

mapping, based on the determining, the received request in a first format to a semantic tag in a common format, wherein the common format indicates the at least one of the role or the work center;

processing, based on the semantic tag in the common format, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and

detecting, based on at least one segregation of duty rule, whether the request by the at least one user poses a segregation of duty violation, wherein the at least one segregation of duty rule represents a rule to segregate an action indicated by the received request from the determined at least one of the role or the work center of the at least one user; and

authorizing, when the processing grants the access and the segregation of duty violation is not detected, the at least one user access to the at least one module;

sending a first message indicating the authorizing, when the processing grants the access and the segregation of duty violation is not detected;

sending a second message indicating access is not granted, when at least one of the processing does not grant the access or the segregation of duty violation is detected.

5. The method of claim 4, wherein the at least one module is implemented as at least one of an on-premises module and an on-demand module.

6. The method of claim 4 further comprising:

converting the first message to at least one of the first format or a second format before sending the first message.

7. A system comprising:

at least one processor; and

at least one memory including code which when executed by the at least one processor causes operations comprising;

receiving a request to authorize at least one user to at least one module of a system;

determining at least one of a role or a work center of the at least one user;

mapping, based on the determining, the received request in a first format to a semantic tag in a common format, wherein the common format indicates the at least one of the role or the work center;

processing, based on the semantic tag in the common format, the request to authorize the at least one user to determine whether to grant the at least one user access to the at least one module; and

detecting, based on at least one segregation of duty rule, whether the request by the at least one user poses a segregation of duty violation, wherein the at least one segregation of duty rule represents a rule to segregate an action indicated by the received request from the determined at least one of the role or the work center of the at least one user; and

authorizing, when the processing grants the access and the segregation of duty violation is not detected, the at least one user access to the at least one module;

sending a first message indicating the authorizing, when the processing grants the access and the segregation of duty violation is not detected;

sending a second message indicating access is not granted, when at least one of the processing does not grant the access or the segregation of duty violation is detected.

8. The system of claim 7, wherein the at least one module is implemented as at least one of an on-premises module and an on-demand module.

9. The system of claim 7 further comprising:

converting the first message to at least one of the first format or a second format before sending the first message.