Authorizing an action request in a networked computing environment

Patent metadata

Field	Value
Publication number	US-10277521-B2
Application number	US-201313909127-A
Country	US
Kind code	B2
Filing date	Jun 4, 2013
Priority date	Jun 4, 2013
Publication date	Apr 30, 2019
Grant date	Apr 30, 2019

Abstract

An approach for authorizing an action requested by a user in a networked computing environment (e.g., a cloud computing environment) is provided. In a typical embodiment, a request for a particular action associated with a computing resource is received. The connected systems which may be affected by the requested action are identified. The actual users of the connected systems are determined. A response from each of the actual users is requested. The responses are collected and weighted to determine if authorization for the requested action is granted.

First claim

What is claimed is:

1. A computer-implemented method for minimizing an effect of a disruptive action in a networked computing environment, comprising:
receiving an action request to perform a disruptive action associated with a cloud computing resource, wherein the networked computing environment is a cloud computing environment and the disruptive action is an action that has a potential to have a disruptive effect;
determining connected systems potentially affected by the requested action from a list of systems capable of being affected by the disruptive action based on a port and a protocol being accessed by the connected systems, the connected systems having an open connection to the cloud computing resource;
determining actual users of each of the connected systems by referencing a database of the cloud computing environment to find a technical owner of each of the connected systems, wherein the actual users comprise active users having an open connection to the computing resource and being actively engaged with the computing resource, passive users having an open connection to the computing resource but not actively engaged with the computing resource, and inactive users comprising an administrator;
sending a notification requesting a response to one or more of the actual users, the notification comprising a message selected from the group consisting of: an email message, a text message, an instant message, a pop-up window, and a mobile push notification;
receiving a response to the notification from one or more of the actual users, the response comprising a response activity to be executed by the cloud computing resource, the completion of which is a condition for the user to authorize the requested action, and the response comprising a message selected from the group consisting of: an email message, a text message, an instant message, a pop-up window, and a mobile push notification;
analyzing user data comprising resource usage activity associated with each responding actual user and a role of each responding actual user;
weighting the response of each responding actual user based on the resource usage activity associated with each responding actual user and the role of each responding actual user, the weighting following a set of rules comprising: assigning a higher priority to a response of an actual user having an active connection than to a response of an actual user having an inactive connection, assigning a higher priority to a response of an actual user with a history of database querying than to a response of an actual user having an open but inactive database connection, assigning a higher priority to a response of an actual user performing a database operation than to a response of an actual user having an open but inactive database connection, and assigning a higher priority to a response of an actual user who is an administrator than to a response of an actual user who is not an administrator; and
determining, based on the weighted responses, whether to grant authorization to perform the requested action, wherein the requested action is performed when authorization is granted and a sufficient failover server is available.

2. The computer-implemented method of claim 1 , wherein authorization is granted based on the weighted responses.

3. The computer-implemented method of claim 1 , wherein the user data comprises at least one of a data usage or user role.

4. The computer-implemented method of claim 1 , wherein an actual user comprises at least one of an active user, passive user, or inactive user.

5. The computer-implemented method of claim 1 , further comprising requesting a response from each actual user via a notification transmitted to each actual user.

6. The computer-implemented method of claim 5 , wherein each actual user is required to respond within a predefined amount of time and wherein, in the case that an actual user does not respond within the predefined amount of time, an automated profile, comprising response instructions of the non-responsive actual user, responds.

7. The computer-implemented method of claim 6 , wherein the system pauses until a set of responses are received from a particular set of actual uses, particular set of actual uses comprising at least one user selected from the group consisting of: an application owner, a system owner, a user having a rate of current activity above a threshold, and a user currently administering an application.

8. A system for minimizing an effect of a disruptive action in a networked computing environment, comprising:
a memory medium comprising instructions;
a bus coupled to the memory medium; and
a processor coupled to the bus that when executing the instructions causes the system to:
receive an action request to perform a disruptive action associated with a cloud computing resource, wherein the networked computing environment is a cloud computing environment and the disruptive action is an action that has a potential to have a disruptive effect;
determine connected systems potentially affected by the requested action from a list of systems capable of being affected by the disruptive action based on a port and a protocol being accessed by the connected systems, the connected systems having an open connection to the cloud computing resource;
determine actual users of each of the connected systems by referencing a database of the cloud computing environment to find a technical owner of each of the connected systems, wherein the actual users comprise active users having an open connection to the computing resource and being actively engaged with the computing resource, passive users having an open connection to the computing resource but not actively engaged with the computing resource, and inactive users comprising an administrator;
send a notification requesting a response to one or more of the actual users, the notification comprising a message selected from the group consisting of: an email message, a text message, an instant message, a pop-up window, and a mobile push notification;
receive a response from one or more of the actual users, the response comprising a response activity to be executed by the cloud computing resource, the completion of which is a condition for the user to authorize the requested action, and the response comprising a message selected from the group consisting of: an email message, a text message, an instant message, a pop-up window, and a mobile push notification;
analyze user data comprising resource usage activity associated with each responding actual user and a role of each responding actual user;
weight the response of each responding actual user based on the resource usage activity associated with each responding actual user and the role of each responding actual user, the weighting following a set of rules comprising: assigning a higher priority to a response of an actual user having an active connection than to a response of an actual user having an inactive connection, assigning a higher priority to a response of an actual user with a history of database querying than to a response of an actual user having an open but inactive database connection, assigning a higher priority to a response of an actual user performing a database operation than to a response of an actual user having an open but inactive database connection, and assigning a higher priority to a response of an actual user who is an administrator than to a response of an actual user who is not an administrator; and
determine, based on the weighted responses, whether to grant authorization to perform the requested action, wherein the requested action is performed when authorization is granted and a sufficient failover server is available.

9. The system of

Assignees

• IBM

Inventors

• Abuelsaad Kelly
• Deluca Lisa Seacat
• Jang Soobaek
• Krook Daniel C

Classifications

• H04L47/70 Primary

  Admission control; Resource allocation · CPC title

• G06F9/50 Primary

  Allocation of resources, e.g. of the central processing unit [CPU] · CPC title

• H04L47/83

  based on usage prediction · CPC title