Just-in-time access based on geolocation to maintain control of restricted data in cloud computing environments

Patent metadata

Field	Value
Publication number	US-10924497-B2
Application number	US-201916601134-A
Country	US
Kind code	B2
Filing date	Oct 14, 2019
Priority date	Nov 5, 2015
Publication date	Feb 16, 2021
Grant date	Feb 16, 2021

Abstract

A JIT service in a cloud computing environment manages just-in-time access to resources in the cloud computing environment for an external device. When JIT access to a resource is requested by a device, the JIT service retrieves a JIT policy for the resource that includes geolocation criteria limiting the geolocation from which JIT access can be automatically granted. The geolocation of the device is evaluated against the geolocation criteria. If the geolocation criteria and any other criteria of the JIT policy are satisfied, the JIT service provisions JIT access to the resource for the device.

First claim

What is claimed is:

1. A computerized system comprising:
one or more hardware processors; and
one or more computer storage media storing computer-useable instructions that, when used by the one or more hardware processors, cause the one or more hardware processors to:
receive, at a service within a cloud computing environment, a request for just-in-time (JIT) access to a resource within a production environment of the cloud computing environment, the request specifying request parameters including a level or type of access requested and information regarding an incident in the cloud computing environment;
access, from a database of JIT policies stored in the cloud computing environment for a plurality of resources within the production environment of the cloud computing environment, a JIT policy for the resource specified by the request, the JIT policy stored in the database for processing by the service within the cloud computing environment to allow the service to automatically determine whether to grant JIT access to the resource;
determine, from the JIT policy for the resource, geolocation criteria restricting JIT access to the resource based on geolocation;
determine, by the service within the cloud computing environment, to approve the request for JIT access based at least in part on automatically evaluating the request parameters using the JIT policy for the resource to determine whether the level or type of access requested is automatically approved depending on a type of the incident and whether the incident is active and comparison of the geolocation criteria to a geolocation of a device associated with the request for JIT access; and
based on determining to automatically approve the request for JIT access, provision a JIT access session for the device including setting a time limit for the JIT access session.

2. The system of claim 1 , wherein the JIT policy includes additional criteria, and wherein the determination to approve the request for JIT access is also based on the additional criteria being satisfied.

3. The system of claim 1 , wherein the geolocation criteria specifies one or more allowed geolocations, and wherein determining to approve the request for JIT access is based at least in part on determining the geolocation of the device matches one of the one or more allowed geolocations.

4. The system of claim 1 , wherein the geolocation criteria specifies one or more restricted geolocations, and wherein determining to approve the request for JIT access is based at least in part on determining the geolocation of the device does not match any of the one or more restricted geolocations.

5. The system of claim 1 , wherein information identifying the geolocation of the device is included in the request for JIT access.

6. The system of claim 1 , wherein information identifying the geolocation of the device is provided by a secondary device.

7. The system of claim 1 , wherein the JIT access session is revoked when the time limit for the JIT access session expires.

8. The system of claim 1 , wherein the JIT access session is revoked in response to a command during the JIT access session.

9. One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:
receiving, at a service within a cloud computing environment, a request for a just-in-time (JIT) access session to access a resource in a production environment of a cloud computing environment, the request specifying request parameters including a level or type of access requested and information regarding an incident in the cloud computing environment;
accessing a JIT policy for the resource from a database of JIT policies stored in the cloud computing environment for a plurality of resources in the production environment of the cloud computing environment, the JIT policy stored in the database for processing by the service within the cloud computing environment to allow the service to automatically determine whether to grant JIT access to the resource;
determining that the JIT policy for the resource includes geolocation criteria restricting JIT access to the resource;
determining, by the service within the cloud computing environment, to automatically approve the request for the JIT access session based at least in part on automatically evaluating the request parameters using the JIT policy for the resource to determine whether the level or type of access requested is automatically approved depending on a type of the incident and whether the incident is active and determining whether geolocation information for a device associated with the request for the JIT access session satisfies the geolocation criteria of the JIT policy for the resource; and
based on determining to automatically approve the request for the JIT access session, provisioning the JIT access session for the device including setting a time limit for the JIT access.

10. The one or more computer storage media of claim 9 , wherein the JIT policy includes one or more additional criteria, and wherein determining to automatically approve the request for the JIT access session comprises determining whether information regarding the request for the JIT access session also satisfies the one or more additional criteria.

11. The one or more computer storage media of claim 9 , wherein the geolocation criteria of the JIT policy for the resource comprises one or more allowable geolocations, and wherein determining whether the geolocation information for the device satisfies the geolocation criteria comprises determining whether the geolocation information for the device matches one of the one or more allowable geolocations.

12. The one or more computer storage media of claim 9 , wherein the geolocation criteria of the JIT policy for the resource comprises one or more restricted geolocations, and wherein determining whether the geolocation information for the device satisfies the geolocation criteria comprises determining whether the geolocation information for the device does not match any of the one or more restricted geolocations.

13. The one or more computer storage media of claim 9 , wherein the JIT access session is revoked when the time limit for the JIT access expires.

14. The one or more computer storage media of claim 9 , wherein provisioning the JIT access session comprises providing the device the level or type of access to the resource for the time limit.

15. A computerized method comprising:
receiving, at a service within a cloud computing environment, a request for a just-in-time (JIT) access session to a resource within the cloud computing environment, the request specifying request parameters including a level or type of access requested and information regarding an incident in the cloud computing environment;
identifying geolocation criteria from a JIT policy for the resource stored in a database of JIT policies within the cloud computing environment, the JIT policy stored in the database for processing by the service within the cloud computing environment to allow the service to automatically determine whether to grant JIT access to the resource;
determining, by the service within the cloud computing environment, to approve the request for the JIT access session based at least in part on automatically evaluating the request parameters using the JIT policy for the resource to determine whether the level or type of access requested is automatically approved depending on a type of the incident and whether the incident is active and comparison of a geoloca

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Prasad Ramnath
• Nair Pradeep Ayyappan
• Ramachandran Veena
• Kalarickal Sandeep
• Knudson Thomas
• Bandla Pavan Gopal
• Shankar Chetan
• Sanyal Ranajoy
• Wu Qingsu
• Zhou Chi
• Keane Thomas

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/107 Primary

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• G06F16/29

  Geographical information databases · CPC title