Access control for event data stored in cloud-based data stores based on inherited roles

• US 9,871,803 B2
• Filed: 10/28/2016
• Issued: 01/16/2018
• Est. Priority Date: 08/12/2011
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Das, Robin Kumar, Ago, Ledio, Shanaghy, Declan Gerard, Gupta, Gaurav
• Primary Examiner(s): To, Baoquoc N
• Application Number:
  US15/336,834
• Publication Number:
  US 20170048247A1
• Time in Patent Office: 445 Days
• Field of Search: 707705, 707706
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/134 Distributed indices
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 16/901 Indexing; Data structures therefor; Storage structures for retrieval from the web G06F16/951
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9537 Spatial or temporal dependent retrieval, e.g. spatiotemporal queries
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/4887 involving deadlines, e.g. rate based, periodic
• CPC Class Codes: G06F 9/5088 involving task migration
• CPC Class Codes: G06Q 20/145 Payments according to the detected use or quantity
• CPC Class Codes: H04L 12/1435 volume-based
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Embodiments are directed towards a system and method for a cloud-based front end that may abstract and enable access to the underlying cloud-hosted elements and objects that may be part of a multi-tenant application, such as a search application. Search objects may be employed to access indexed objects. An amount of indexed data accessible to a user may be based on an index storage limit selected by the user, such that data that exceeds the index storage limit may continue to be indexed. Also, one or more projects can be elastically scaled for a user to provide resources that may meet the specific needs of each project.

Claims

1. A method, comprising:

receiving, by a cloud-based access control server, a request from a first user to access a set of time stamped, searchable events, the set of time stamped, searchable events among a plurality of sets of time stamped, searchable events stored in a plurality of cloud-based data stores, each of the time stamped, searchable events is parsed from raw data collected from one or more data sources, the raw data reflects activity in an information technology system and is produced by a component of the information technology system;

determining, by the cloud-based access control server, that the first user has an inherited role from a second user for the set of time stamped, searchable events;

determining, by the cloud-based access control server, whether the first user has permission to access the set of time stamped, searchable events based on the inherited role determined for the first user;

allowing, by the cloud-based access control server, the first user to access the set of time stamped, searchable events to perform operations on the set of time stamped, searchable events when the inherited role indicates that the first user has permission to access the set of time stamped, searchable events;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to provide data to be parsed into time stamped, searchable events at a cloud-based data store.

3. The method of claim 1, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to provide data to be parsed into time stamped, searchable events at a cloud-based data store and grants the first user permission to search time stamped, searchable events stored by the cloud-based data store.

4. The method of claim 1, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to access cloud-based resources associated with the set of time stamped, searchable events.

5. The method of claim 1, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to search time stamped, searchable events stored by a particular cloud-based data store.

6. The method of claim 1, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to search time stamped, searchable events stored by a particular cloud-based data store, and wherein the search is performed by a cloud-based search application.

7. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:

receiving, by a cloud-based access control server, a request from a first user to access a set of time stamped, searchable events, the set of time stamped, searchable events among a plurality of sets of time stamped, searchable events stored in a plurality of cloud-based data stores, each of the time stamped, searchable events is parsed from raw data collected from one or more data sources, the raw data reflects activity in an information technology system and is produced by a component of the information technology system;

determining, by the cloud-based access control server, that the first user has an inherited role from a second user for the set of time stamped, searchable events;

determining, by the cloud-based access control server, whether the first user has permission to access the set of time stamped, searchable events based on the inherited role determined for the first user;

allowing, by the cloud-based access control server, the first user to access the set of time stamped, searchable events to perform operations on the set of time stamped, searchable events when the inherited role indicates that the first user has permission to access the set of time stamped, searchable events.

8. The one or more non-transitory computer-readable storage media of claim 7, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to provide data to be parsed into time stamped, searchable events at a cloud-based data store.

9. The one or more non-transitory computer-readable storage media of claim 7, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to provide data to be parsed into time stamped, searchable events at a cloud-based data store and grants the first user permission to search time stamped, searchable events stored by the cloud-based data store.

10. The one or more non-transitory computer-readable storage media of claim 7, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to access cloud-based resources associated with the set of time stamped, searchable events.

11. The one or more non-transitory computer-readable storage media of claim 7, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to search time stamped, searchable events stored by a particular cloud-based data store.

12. The one or more non-transitory computer-readable storage media of claim 7, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to search time stamped, searchable events stored by a particular cloud-based data store, and wherein the search is performed by a cloud-based search application.

13. An apparatus, comprising:

a user input receiver, at a cloud-based access control server, implemented at least partially in hardware, that receives a request from a first user to access a set of time stamped, searchable events, the set of time stamped, searchable events among a plurality of sets of time stamped, searchable events stored in a plurality of cloud-based data stores, each of the time stamped, searchable events is parsed from raw data collected from one or more data sources, the raw data reflects activity in an information technology system and is produced by a component of the information technology system;

a role processor, at the cloud-based access control server, implemented at least partially in hardware, that determines that the first user has an inherited role from a second user for the set of time stamped, searchable events;

wherein the role processor determines whether the first user has permission to access the set of time stamped, searchable events based on the inherited role determined for the first user;

wherein the role processor allows the first user to access the set of time stamped, searchable events to perform operations on the set of time stamped, searchable events when the inherited role indicates that the first user has permission to access the set of time stamped, searchable events.

14. The apparatus of claim 13, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to provide data to be parsed into time stamped, searchable events at a cloud-based data store.

15. The apparatus of claim 13, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to provide data to be parsed into time stamped, searchable events at a cloud-based data store and grants the first user permission to search time stamped, searchable events stored by the cloud-based data store.

16. The apparatus of claim 13, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to access cloud-based resources associated with the set of time stamped, searchable events.

17. The apparatus of claim 13, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to search time stamped, searchable events stored by a particular cloud-based data store.

18. The apparatus of claim 13, wherein the inherited role of the first user for the set of time stamped, searchable events grants the first user permission to search time stamped, searchable events stored by a particular cloud-based data store, and wherein the search is performed by a cloud-based search application.