Access permissions management system and method

Patent metadata

Field	Value
Publication number	US-11496476-B2
Application number	US-202016915334-A
Country	US
Kind code	B2
Filing date	Jun 29, 2020
Priority date	Jan 27, 2011
Publication date	Nov 8, 2022
Grant date	Nov 8, 2022

Abstract

A system for providing bi-directional visualization of authority of users over SACs in an enterprise-wide network, the system including functionality for providing user-wise visualization of the authority of a given user over at least one SAC in respect of which the user has authority, and functionality for providing SAC-wise visualization for a given SAC of the authority of at least one user over the given SAC.

First claim

The invention claimed is:

1. A system comprising a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to automatically provide bi-directional visualization of authority of users over SACs in an enterprise-wide network and to enable modification of said authority of said users over said SACs to provide improved systems and methodologies for access permissions management for access permissions management in said enterprise network, said SACs comprising containers, each of said containers comprising network objects, said authority of a user over a SAC comprising an ability of said user to modify properties of said network objects, said system comprising:
monitoring and collection functionality for obtaining continuously updated information regarding at least one of access permissions and actual usage of said network objects comprised within said SACs;
a user interface for displaying, in a single view, bi-directional visualization of authority of all users of said enterprise-wide network over all SACs in said enterprise-wide network, said users being users other than owners of said SACs, each of said network objects of each of said SACs comprising only at least one of at least one user and at least one user group, said bi-directional visualization in said single view comprising:
a first uni-directional visualization comprising, for a given user:
user-wise visualization of the authority of said given user over at least one SAC in respect of which said given user has authority, said given user being a user other than an owner of said at least one SAC;
a specific indication of whether said given user was not yet authorized by said owner of said at least one SAC;
a revocation recommendation to said owner of said at least one SAC recommending whether said authority should be revoked from said given user, said revocation recommendation being based on said continuously updated information regarding said at least one of said access permissions and said actual usage of said network objects comprised within said SACs; and

a second uni-directional visualization comprising:
SAC-wise visualization for a given SAC of the authority of at least one user over said given SAC, said at least one user being a user other than an owner of said given SAC;
a specific indication of whether said at least one user was not yet authorized by said owner of said given SAC; and
a revocation recommendation to said owner of said given SAC recommending whether said authority should be revoked from said at least one user, said revocation recommendation being based on said continuously updated information regarding said at least one of said access permissions and said actual usage of said network objects comprised within said SACs; and

a user interface for enabling a human viewer of said bi-directional visualization to modify said authority of said given user over said SACs.

2. A system according to claim 1 and wherein:
said SACs do not include data elements; and
said user-wise visualization does not provide visualization of authority of a given user over data elements.

3. A system according to claim 1 and wherein:
said SACs do not include data elements; and
said user-wise visualization also provides visualization of authority of a given user over data elements.

4. A system according to claim 1 and also comprising:
a user interface for providing user-wise monitoring and reporting of the exercise of authority by a given user over at least one SAC with respect to which the user has authority; and
a user interface for providing SAC-wise monitoring and reporting of the exercise of authority over a given SAC by at least one user having authority over said given SAC.

5. A method for providing bi-directional visualization of authority of users over SACs in an enterprise-wide network and enabling modification of said authority of said users over said SACs to provide improved systems and methodologies for access permissions management in said enterprise network, said SACs comprising containers, each of said containers comprising network objects, said authority of a user over a SAC comprising an ability of said user to modify properties of said network objects, said method comprising:
monitoring and collecting continuously updated information regarding at least one of access permissions and actual usage of said network objects comprised within said SACs;
displaying, in a single view, bi-directional visualization of authority of all users of said enterprise-wide network over all SACs in said enterprise-wide network, said users being users other than owners of said SACs, each of said network objects of each of said SACs comprising only at least one of at least one user and at least one user group, said bi-directional visualization in said single view comprising
a first uni-directional visualization comprising, for each given user of said enterprise-wide network:
visualization of the authority of said given user over each SAC of said enterprise-wide network in respect of which said given user has authority, said given user being a user other than an owner of said at least one SAC;
a specific indication of whether said given user was not yet authorized by said owner of said at least one SAC; and
a revocation recommendation to said owner of said at least one SAC recommending whether said authority should be revoked from said given user, said revocation recommendation being based on said continuously updated information regarding said at least one of said access permissions and said actual usage of said network objects comprised within said SACs; and

a second uni-directional visualization comprising:
SAC-wise visualization for each given SAC of the authority of each user of said enterprise-wide network over each said given SAC;
a specific indication of whether said at least one user was not yet authorized by said owner of said given SAC; and
a revocation recommendation to said owner of said given SAC recommending whether said authority should be revoked from said at least one user, said revocation recommendation being based on said continuously updated information regarding said at least one of said access permissions and said actual usage of said network objects comprised within said SACs; and

enabling a human viewer of said bi-directional visualization to modify said authority of said given user over said SACs.

6. A method according to claim 5 and wherein:
said SACs do not include data elements; and
said providing user-wise visualization does not include providing visualization of authority of a given user over data elements.

7. A method according to claim 5 and wherein:
said SACs do not include data elements; and
said providing user-wise visualization also includes providing visualization of authority of a given user over data elements.

8. A method according to claim 5 and also comprising:
providing user-wise monitoring and reporting of the exercise of authority by a given user over at least one SAC with respect to which the user has authority; and
providing SAC-wise monitoring and reporting of the exercise of authority over a given SAC by at least one user having authority over said given SAC.

9. A system according to claim 1 and wherein said user interface enables said human viewer to revoke said authority of said user over said SACs.

10. A method according to claim 5 and wherein said enabling said human viewer comprises enabling said human viewer to revoke said authority of said user over said SACs.

Assignees

• Faitelson Yakov
• Korkus Ohad
• KRETZER KATZIR Ophir
• Varonis Systems Inc

Inventors

• Faitelson Yakov
• Korkus Ohad
• Kretzer-Katzir Ophir

Classifications

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title