Operating large scale systems and cloud services with zero-standing elevated permissions
First Claim
Patent Images
1. A method implemented by a computing device for providing large scale system operation, the method comprising:
- receiving an action request from a user;
determining, by the computing device, whether the user requires elevated permissions to perform the action request;
in response to determining that the user requires elevated permissions to perform the action request, forwarding the action request to a lockbox; and
receiving a permission response from the lockbox, wherein receiving the permission response from the lockbox comprises;
determining, by the lockbox, a current role and a requested role of the user;
determining whether elevation to the requested role from the current role complies with at least one of a plurality of policies associated with the lockbox;
wherein the at least one of the plurality of policies determines whether the user belongs to a specific user group;
wherein the specific user group comprises at least one of;
an administrator group, a security clearance group, an on-call group, and an onsite group; and
wherein determining whether the elevation complies with the at least one of the plurality of policies comprises checking an action request scope evaluation rule to determine whether the action request violates a privacy policy; and
providing, in response to determining that the elevation to the requested role complies with the at least one of the plurality of policies and that the action request does not violate the privacy policy, the permission response, wherein providing the permission response further comprises stamping an attribute in a user object with an expiry time of the granted elevated permissions; and
determining, by the computing device at a configurable interval, whether any of the granted elevated permissions should be revoked, andrevoking at least one of the granted elevated permissions based on the determination of at least one of the following;
the user is no longer associated with an organization, expiration of the expiry time, and inactivity for a predetermined length of time.
2 Assignments
0 Petitions
Accused Products
Abstract
Large scale system operation may be provided. Upon receiving an action request from a user, a determination may be made as to whether the user requires elevated permissions to perform the action request. In response to determining that the user requires elevated permissions to perform the action request, the action request may be forwarded to a lockbox for evaluation and a permission response may be received from the lockbox.
-
Citations
20 Claims
-
1. A method implemented by a computing device for providing large scale system operation, the method comprising:
-
receiving an action request from a user; determining, by the computing device, whether the user requires elevated permissions to perform the action request; in response to determining that the user requires elevated permissions to perform the action request, forwarding the action request to a lockbox; and receiving a permission response from the lockbox, wherein receiving the permission response from the lockbox comprises; determining, by the lockbox, a current role and a requested role of the user; determining whether elevation to the requested role from the current role complies with at least one of a plurality of policies associated with the lockbox;
wherein the at least one of the plurality of policies determines whether the user belongs to a specific user group;
wherein the specific user group comprises at least one of;
an administrator group, a security clearance group, an on-call group, and an onsite group; and
wherein determining whether the elevation complies with the at least one of the plurality of policies comprises checking an action request scope evaluation rule to determine whether the action request violates a privacy policy; andproviding, in response to determining that the elevation to the requested role complies with the at least one of the plurality of policies and that the action request does not violate the privacy policy, the permission response, wherein providing the permission response further comprises stamping an attribute in a user object with an expiry time of the granted elevated permissions; and determining, by the computing device at a configurable interval, whether any of the granted elevated permissions should be revoked, and revoking at least one of the granted elevated permissions based on the determination of at least one of the following;
the user is no longer associated with an organization, expiration of the expiry time, and inactivity for a predetermined length of time. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A system for providing large scale system operation, the system comprising:
-
a memory storage; and a processing unit coupled to the memory storage, wherein the processing unit is operable to; receive an action request requiring an elevated permission from a user; communicate with a lockbox, wherein the lockbox segregates duties associated with a action request; determine whether the action request complies with at least one of a plurality of permission policies, wherein at least one of the plurality of permission policies determines whether the user is associated with a security flag, the determining comprising the processing unit operable to; determine a current role and a requested role of the user, and evaluate whether elevation from the current role to the requested role complies with the at least one of the plurality of permission policies by checking at least an action request scope evaluation rule to determine whether the action request violates a privacy policy; in response to determining that the action request complies with the at least one of the plurality of permission policies, grant the user an elevated permission to perform a requested action for a temporary period and stamp an attribute in a user object with an expiry time marking an end of the temporary period; when the granted elevated permission to perform the requested action grants the user access to user data; log the user'"'"'s activity associated with the action request in at least one log entry, receive a request to modify the at least one log entry, deny the request to modify the at least one log entry, log the denial of the request to modify the at least one log entry, and determine, at a configurable interval, whether any of the granted elevated permissions should be revoked, and revoke at least one of the granted elevated permissions based on the determination of at least one of the following;
the user is no longer associated with an organization, expiration of the expiry time, and inactivity for a predetermined length of time. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A computer-readable storage device which stores a set of instructions which when executed performs a method for providing large scale system operation, the method executed by the set of instructions comprising:
-
receiving an action request from a user, wherein the user is associated with at least one user group comprising basic access permissions to at least one software service, and wherein the basic access permissions prohibit access to a plurality of user data associated with the at least one software service; determining whether the action request requires an elevated permission; in response to determining that the action request requires the elevated permission; providing a lockbox, wherein the lockbox segregates duties associated with the requested action, determining whether the action request complies with at least one of a plurality of permission policies associated with a lockbox service, wherein the plurality of permission policies comprise at least one of the following;
a user group criterion, a security flag criterion, an action scope criterion, and a schedule criterion, and wherein determining whether the action request complies with at least one of the plurality of permission policies comprises;determining a current role and a requested role of the user; and determining whether elevation from the current role to the requested role complies with the plurality of permission policies by checking at least the action request scope criterion to determine whether the action request violates a privacy policy; in response to determining that the action request complies with the at least one of a plurality of permission policies, granting the elevated permission to the user for a limited duration, wherein the limited duration is defined by at least one of the following;
the at least one permission policy, a configuration setting associated with the software service, and a configuration setting associated with the at least one user group, wherein granting the elevated permission for the limited duration further comprises stamping an attribute in a user object with an expiry time marking an end of the limited duration;permitting the user to perform the requested action; and creating a log entry associated with the user and the requested action.
-
Specification