Access control system for enterprise cloud storage

Patent metadata

Field	Value
Publication number	US-10432644-B2
Application number	US-201615277451-A
Country	US
Kind code	B2
Filing date	Sep 27, 2016
Priority date	Sep 28, 2015
Publication date	Oct 1, 2019
Grant date	Oct 1, 2019

Abstract

Systems and corresponding computer-implemented methods for context-based rule evaluation in an electronic data storage system are described. A request to perform an operation with respect to a resource is received from a client device, with the request including various attributes associated with the client device. At least one set of rules applicable to the operation is identified. The rules can be formed from a combination of primitives arranged to dynamically evaluate attributes associated with the resource and attributes associated with the client device. Based on the evaluation of the rule set(s), an action is identified to be performed with respect to the resource.

First claim

What is claimed is:

1. A computer-implemented method for rule-based access control, the method comprising:
receiving from a client device a request to perform an operation with respect to a resource stored in a cloud storage environment, the request comprising a plurality of attributes associated with the resource being requested and the client device;
identifying at least one set of rules applicable to the operation, the at least one set of rules performing access control of the resource in the cloud storage environment, the at least one set of rules comprises a combination of primitives arranged to dynamically evaluate two types of attributes, wherein a first type of attribute corresponds to a first set of attributes from the plurality of attributes associated with the resource being requested and a second type of attribute corresponds to a second set of attributes from the plurality of attributes associated with the client device;
determining that evaluation of a first one of the rules includes a first call to an external service to retrieve first information for evaluating the first rule;
determining that evaluation of a second one of the rules includes a second call to the external service to retrieve second information for evaluating the second rule;
combining the first call and the second call to form a batched call to the external service;
evaluating the at least one set of rules by:
performing the batched call to the external service,
receiving, in response to the batched call, the first information to evaluate the first rule and the second information to evaluate the second rule, and
determining whether the first rule is satisfied based at least in part on the first information, and determining whether the second rule is satisfied based at least in part on the second information, wherein the at least one set of rules corresponds to the primitives that correlate to a combination of the two types of attributes; and

determining an action to perform with respect to the resource based on a result of the evaluation of the at least one set of rules.

2. The method of claim 1 , wherein the operation comprises: logging into a system, providing access to the resource, downloading the resource, previewing the resource, or creating a shared link based on the resource.

3. The method of claim 1 , wherein each rule in the set of rules comprises an associated action that can be performed based on a result of an evaluation of the rule.

4. The method of claim 3 , wherein the associated actions are organized into a hierarchy based on a respective restrictiveness of each action.

5. The method of claim 1 , wherein a particular primitive comprises a function to determine whether a network address is blacklisted.

6. The method of claim 1 , wherein a particular primitive comprises a function to determine whether the resource has associated metadata matching a given value.

7. The method of claim 1 , wherein a particular attribute associated with the client device comprises at least one of: whether the client device is trusted, a geographical location of the client device, an IP address associated with the client device, or an access level of a user associated with the client device.

8. The method of claim 1 , wherein a particular attribute associated with the resource comprises at least one of: contents of the resource, a classification of the resource, or a value of metadata associated with the resource.

9. The method of claim 1 , wherein the action comprises: blocking the operation, denying access to the resource, watermarking the resource, applying a retention policy to the resource, requiring further authentication, displaying a message to a user of the client device, logging the operation, or taking no action.

10. The method of claim 1 , wherein identifying the at least one set of rules applicable to the operation comprises:
identifying a first set of rules applicable to all users performing the operation;
identifying a second set of rules applicable to users of a particular enterprise performing the operation; and
combining the first set of rules and the second set of rules into a single set of rules for evaluation.

11. The method of claim 1 , wherein determining the action to perform comprises:
identifying a subset of rules in the at least one set of rules that are satisfied when evaluated; and
selecting, as the action to perform, a most restrictive action from actions associated with the subset of rules.

12. The method of claim 1 , further comprising notifying the client device of the action to perform.

13. A system for rule-based access control, the system comprising:
at least one memory for storing computer-executable instructions; and
at least one processing unit for executing the instructions, wherein execution of the instructions programs the at least one processing unit to perform operations comprising:
receiving from a client device a request to perform an operation with respect to a resource stored in a cloud storage environment, the request comprising a plurality of attributes associated with the resource being requested and the client device;
identifying at least one set of rules applicable to the operation, the at least one set of rules performing access control of the resource in the cloud storage environment, the at least one set of rules comprises a combination of primitives arranged to dynamically evaluate two types of attributes, wherein a first type of attribute corresponds to a first set of attributes from the plurality of attributes associated with the resource being requested and a second type of attribute corresponds to a second set of attributes from the plurality of attributes associated with the client device;
determining that evaluation of a first one of the rules includes a first call to an external service to retrieve first information for evaluating the first rule;
determining that evaluation of a second one of the rules includes a second call to the external service to retrieve second information for evaluating the second rule;
combining the first call and the second call to form a batched call to the external service;
evaluating the at least one set of rules by:
performing the batched call to the external service,
receiving, in response to the batched call, the first information to evaluate the first rule and the second information to evaluate the second rule, and
determining whether the first rule is satisfied based at least in part on the first information, and determining whether the second rule is satisfied based at least in part on the second information, wherein the at least one set of rules corresponds to the primitives that correlate to a combination of the two types of attributes; and

determining an action to perform with respect to the resource based on a result of the evaluation of the at least one set of rules.

14. The system of claim 13 , wherein the operation comprises: logging into a system, providing access to the resource, downloading the resource, previewing the resource, or
creating a shared link based on the resource.

15. The system of claim 13 , wherein each rule in the set of rules comprises an associated action that can be performed based on a result of an evaluation of the rule.

16. The system of claim 15 , wherein the associated actions are organized into a hierarchy based on a respective restrictiveness of each action.

17. The system of claim 13 , wherein a particular primitive comprises a function to determine whether a network address is blacklisted.

18. The system of claim

Assignees

• Box Inc

Inventors

• Burns Seena
• Chander Nakul
• Chang Adelbert
• Fan Jonathan Shih-Shuo
• Jain Divya
• Kantorovskiy Lev
• Kus Benjamin John
• Peng Justin

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/108 Primary

  when the policy decisions are valid for a limited amount of time · CPC title