Role-based access control using dynamically shared cloud accounts

• US 9,571,479 B1
• Filed: 03/31/2014
• Issued: 02/14/2017
• Est. Priority Date: 05/03/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sundaram, Sharada, Sawhney, Sanjay, Koeten, Robert
• Primary Examiner(s): Jacobs, Lashonda
• Application Number:
  US14/231,617
• Time in Patent Office: 1,051 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/5061 Partitioning or combining of resources
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A server computer system within a network of an organization receives a request from a user to access a cloud account. The request includes a user identifier. The server computer system authenticates the user for access to the cloud account based on the user identifier, identifies one or more predetermined roles associated with the cloud account for the user, and identifies one or more pseudo accounts associated with the cloud account. The server computer system further maps the user to the one or more pseudo accounts, and provides user access to the cloud account based on the mapping and with access privileges corresponding to the one or more pseudo accounts.

Claims

1. A method comprising:

receiving, at a server computer system within a network of an organization, a request from a user to access a cloud account, wherein the request comprises a user identifier of the user;

authenticating, at the server computer system, the user for access to the cloud account based on the user identifier;

identifying one or more predetermined roles associated with the cloud account for the user;

identifying one or more pseudo accounts associated with the cloud account, the pseudo accounts to define one or more slots associated with the one or more predetermined roles for the cloud account, wherein access privileges to the cloud account correspond to the one or more pseudo accounts;

mapping the user to the one or more pseudo accounts, wherein the mapping comprises matching the one or more predetermined roles for the user with the one or more pseudo accounts; and

providing the user access to the cloud account based on the mapping and with the access privileges corresponding to the one or more pseudo accounts.

2. The method of claim 1, wherein the cloud account is a shared Software-as-a-Service (SaaS) account.

3. The method of claim 1, wherein the user identifier further comprises a user password.

4. The method of claim 1, wherein authenticating the user further comprises providing a single sign-on access to at least the cloud account, wherein the single sign-on access uses the user identifier.

5. The method of claim 1, wherein mapping the user to the one or more pseudo accounts comprises a dynamic mapping, wherein the dynamic mapping comprises performing an action in the event the one or more pseudo accounts are unavailable.

6. The method of claim 5, wherein the action comprises at least one of notifying the user of the unavailability of the one or more pseudo accounts;

halting the mapping action;

or determining availability of one or more other pseudo accounts of equal or lesser access privileges and mapping the user to the one or more other pseudo accounts.

7. The method of claim 1, further comprising:

receiving, at the server computer system, an additional request for access to another cloud account, wherein the request comprises the user identifier;

authenticating, at the server computer system, the user for access to the other cloud account based on a single sign-on access to the other cloud account;

identifying one or more predetermined roles associated with the other cloud account for the user;

identifying one or more pseudo accounts associated with the other cloud account, wherein access privileges to the other cloud account correspond to the one or more pseudo accounts;

mapping the user to the one or more pseudo accounts, wherein the mapping comprises matching the one or more predetermined roles associated with the other cloud account for the user with one or more pseudo accounts associated with the other cloud account; and

providing the user access to the cloud account based on the mapping and with the access privileges to the other cloud account corresponding to the one or more pseudo accounts associated with the other cloud account.

8. A system comprising:

a memory; and

a processor coupled to the memory to;

receive a request from a user to access a cloud account, wherein the request comprises a user identifier of the user;

authenticate the user for access to the cloud account based on the identifier;

identify one or more predetermined roles associated with the cloud account for the user;

identify one or more pseudo accounts associated with the cloud account, the pseudo accounts to define one or more slots associated with the one or more predetermined roles for the cloud account, wherein access privileges to the cloud account correspond to the one or more pseudo accounts;

map the user to the one or more pseudo accounts, wherein the mapping comprises matching the one or more predetermined roles for the user with the one or more pseudo accounts; and

provide the user access to the cloud account based on the mapping and with the access privileges corresponding to the one or more pseudo accounts.

9. The system of claim 8, wherein the cloud account is a shared Software-as-a-Service (SaaS) account.

10. The system of claim 8, wherein the user identifier further comprises a user password.

11. The system of claim 8, wherein to authenticate the user the processor further to provide a single sign-on access to at least the cloud account, wherein the single sign-on access uses the user identifier.

12. The system of claim 8, wherein to map the user to the one or more pseudo accounts further comprises a dynamic mapping, wherein the dynamic mapping the processor further to perform an action in the event the one or more pseudo accounts are unavailable.

13. The system of claim 12, wherein to perform the action, the processor is to perform at least one of notify the user of the unavailability of the one or more pseudo accounts;

halt the mapping action;

or determine availability of one or more other pseudo accounts of equal or lesser access privileges and map the user to the one or more other pseudo accounts.

14. The system of claim 8, the processor further to:

receive, at the server computer system, an additional request for access to another cloud account, wherein the request comprises the user identifier;

authenticate, at the server computer system, the user for access to the other cloud account based on a single sign-on access to the other cloud account;

identify one or more predetermined roles associated with the other cloud account for the user;

identify one or more pseudo accounts associated with the other cloud account, wherein access privileges to the other cloud account correspond to the one or more pseudo accounts;

map the user to the one or more pseudo accounts, wherein the mapping comprises matching the one or more predetermined roles associated with the other cloud account for the user with one or more pseudo accounts associated with the other cloud account; and

provide the user access to the cloud account based on the mapping and with the access privileges to the other cloud account corresponding to the one or more pseudo accounts associated with the other cloud account.

15. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform a method comprising:

receiving, at a server computer system within a network of an organization, a request from a user to access a cloud account, wherein the request comprises a user identifier of the user;

authenticating, at the server computer system, the user for access to the cloud account based on the identifier;

identifying one or more predetermined roles associated with the cloud account for the user;

identifying one or more pseudo accounts associated with the cloud account, the pseudo accounts to define one or more slots associated with the one or more predetermined roles for the cloud account, wherein access privileges to the cloud account correspond to the one or more pseudo accounts;

mapping the user to the one or more pseudo accounts, wherein the mapping comprises matching the one or more predetermined roles for the user with the one or more pseudo accounts; and

providing the user access to the cloud account based on the mapping and with the access privileges corresponding to the one or more pseudo accounts.

16. The non-transitory computer readable storage medium of claim 15, wherein the cloud account is a shared Software-as-a-Service (SaaS) account.

17. The non-transitory computer readable storage medium of claim 15, wherein the user identifier further comprises a user password.

18. The non-transitory computer readable storage medium of claim 15, wherein authenticating the user further comprises providing a single sign-on access to at least the cloud account, wherein the single sign-on access uses the user identifier.

19. The non-transitory computer readable storage medium of claim 15, wherein mapping the user to the one or more pseudo accounts comprises a dynamic mapping, wherein the dynamic mapping comprises performing an action in the event the one or more pseudo accounts are unavailable.

20. The non-transitory computer readable storage medium of claim 19, wherein the action comprises at least one of notifying the user of the unavailability of the one or more pseudo accounts;

halting the mapping action;

or determining availability of one or more other pseudo accounts of equal or lesser access privileges and mapping the user to the one or more other pseudo accounts.