Multiparty authorization for controlling resource access

• US 9,231,955 B1
• Filed: 03/26/2014
• Issued: 01/05/2016
• Est. Priority Date: 03/26/2014
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Tang, Xuan, Mehresh, Ruchika, Taylor, Millard C II, Pawar, Ankita, Okaiwele, Obeahon O.
• Primary Examiner(s): Sholeman, Abu
• Application Number:
  US14/225,697
• Time in Patent Office: 650 Days
• Field of Search: 726/4, 726/1, 713/169, 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

The subject disclosure is generally directed towards an automated mechanism in a computer network or system that controls resource access to any resource designated as needing multiparty authorization. In one aspect, a resource that needs multiparty authorization before access is allowed is identified, along with policy that specifies an authorizer (or multiple authorizers) for the resource. An access control list may contain metadata that indicates the need for multiparty authorization. Authorization may be provided via a token, which may be cached for future use.

Claims

1. A method in a computer network or computer system, the method comprising:

receiving, from a client, a request for an operation on a resource associated with a server to form a requested operation;

upon receiving the request, automatically determining, by an authorization mechanism associated with the server, whether the resource is associated with access control metadata, the access control metadata indicates the resource is multiparty access controlled and a multiparty authorization is required for the requested operation on the resource;

on condition that the resource is not associated with the access control metadata, allowing the requested operation on the resource; and

on condition the resource is associated with the access control metadata, checking a token cache, by an authorization module of the server, to determine whether one or more tokens associated with one or more entities and configured to authorize the requested operation are present in the token cache and valid,

on condition that the one or more tokens configured to authorize the requested operation are present in the token cache and valid, granting the multiparty authorization and allowing the requested operation; and

on condition that the one or more tokens configured to authorize the requested operation are not present in the token cache and valid, obtaining the multiparty authorization before allowing the requested operation on the resource.

2. The method of claim 1, wherein determining whether the resource is associated with the access control metadata that indicates the need for multiparty authorization comprises:

evaluating an attribute of an access control list, the attribute indicates the resource is protected under multiparty authorization control.

3. The method of claim 1, wherein obtaining the multiparty authorization comprises:

determining the one or more entities to contact for the multiparty authorization based on the multiparty access control metadata, wherein the multiparty access control metadata is associated with the resource in a data store.

4. The method of claim 1, wherein obtaining the multiparty authorization comprises:

on condition that a first token of the one or more tokens is stored in the token cache and a second token of the one or more tokens is not stored in the token cache, accessing the token cache to obtain the first token; and

transmitting a request for the multiparty authorization to an authorizer of the one or more entities corresponding to the second token.

5. The method of claim 1, wherein the one or more tokens comprise a signed pre-authorization token, the method further comprising:

allowing the requested operation on the resource upon receiving the signed pre-authorization token.

6. The method of claim 1, wherein the one or more tokens comprise an inline authorization token, the method further comprising:

receiving a pending change to the resource, and waiting for authorization via the inline authorization token before allowing access to commit the pending change.

7. The method of claim 1, wherein the one or more tokens comprise a post-authorization token, the method further comprising:

receiving a plurality of pending changes to the resource, and waiting for authorization via the post-authorization token before allowing access to commit at least one pending change of the plurality of pending changes.

18. The method of claim 1, wherein obtaining the multiparty authorization further comprises:

on condition the one or more tokens associated with one or more entities and configured to authorize the requested operation are not present in the token cache or the one or more tokens are not valid, contacting the one or more entities, by the authorization engine, to obtain the multiparty authorization for the requested operation; and

transmitting a request for the multiparty authorization to the one or more entities.

19. The method of claim 1, further comprising:

evaluating multiparty authorization policy metadata to identify one or more entities to contact for the multiparty authorization for the requested operation.

20. The method of claim 1, further comprising;

identifying a type of access associated with the request for the operation on the resource, wherein the multiparty authorization corresponds with the type of access.

8. A system comprising:

one or more processors;

a memory, the memory configured to contain executable code executed by the one or more processors, including code corresponding to authorization logic; and

a system bus, the system bus configured to couple the memory to the one or more processors, wherein the one or more processors execute the authorization logic to;

determine whether a resource is associated with access control metadata, the access control metadata indicates that the resource is multiparty access controlled and multiparty authorization is required for the requested operation, the resource is associated with a requested operation;

on condition that the resource is not associated with the access control metadata, allow the requested operation; and

on condition that the resource is associated with the access control metadata, determine whether authorization is not yet obtained from one or more authorizers identified in multiparty authorization policy metadata associated with the resource, wherein the multiparty authorization policy metadata identifies the one or more authorizers to contact to obtain the multiparty authorization for the requested operation,

on condition that the authorization is obtained from the one or more authorizers, access the authorization from a token cache to obtain the authorization and grant the multiparty authorization; and

on condition that the authorization is not yet obtained from the one or more authorizers, transmit a request for the authorization to the one or more authorizers.

9. The system of claim 8, wherein the authorization logic is configured to access an access control list to determine whether the resource is associated with the access control metadata, wherein an attribute of the access control list indicates that multiparty authorization is required for the requested operation.

10. The system of claim 8, wherein the authorization logic is coupled to a contact engine that identifies the one or more authorizers, and determines one or more contact modes for contacting the one or more identified authorizers.

11. The system of claim 8, wherein the authorization logic is coupled to a data store containing the multiparty authorization policy metadata.

12. The system of claim 11, wherein the data store containing the multiparty authorization policy metadata is incorporated into or coupled to a policy engine that includes policy logic.

13. The system of claim 8, further comprising:

an authorization engine, a policy engine and a contact engine, wherein the authorization logic is coupled to the policy engine via the authorization engine, and is coupled to the contact engine via the authorization engine.

14. The system of claim 8, wherein the token cache contains one or more tokens corresponding to authorizations received from authorizers, the one or more tokens including at least one of a pre-authorization token, an inline authorization token, or a post-authorization token.

15. One or more machine-readable memories having machine-executable instructions, which when executed cause one or more processors to:

determine that a resource associated with a storage device to which a user is requesting access is multiparty access controlled based on access control metadata associated with the resource, the access control metadata indicating that the resource is protected under multiparty authorization control and multiparty authorization is required for the requested access;

checking a token cache, by an authorization module associated with the storage device, for one or more tokens authorizing access to the resource;

on condition that the one or more tokens are stored in the token cache, accessing the token cache to obtain the one or more tokens and grant access to the resource;

on condition that the one or more tokens are not stored in the token cache, obtaining the one or more tokens from the one or more authorizers to authorize access to the resource;

upon obtaining the one or more tokens, allowing the user to access the resource based upon the one or more tokens; and

cache the one or more tokens in the token cache.

16. The machine-readable memories of claim 15, having further machine-executable instructions comprising:

looking up the one or more authorizers in policy data associated with the resource; and

determining one or more contact modes for contacting the one or more authorizers.

17. The machine-readable memories of claim 15, wherein determining that the resource is multiparty access controlled comprises:

reading an access control list associated with the resource, wherein an attribute of the access control list indicates the multiparty authorization is needed to allow the access to the resource.