Creating roles and controlling access within a computer network

Patent metadata

Field	Value
Publication number	US-11516220-B1
Application number	US-201816235739-A
Country	US
Kind code	B1
Filing date	Dec 28, 2018
Priority date	Dec 28, 2018
Publication date	Nov 29, 2022
Grant date	Nov 29, 2022

Abstract

This disclosure is directed to devices, systems, and techniques for enforcing access to resources within a computer network. In some examples, a system includes a network managed by a service provider and configured to provide a plurality of microservices to a plurality of tenants each having one or more users and a controller having access to the network. The controller is configured to output, to a user interface, data indicative of a plurality of capabilities for presentation by the user interface and receive, from the user interface, data indicative of a user selection of a set of capabilities and a user selection of a new role identifier. The controller is further configured to create, based on the set of capabilities and the role identifier, a role which enables access to a set of actions within a computer network, the set of actions corresponding to the set of capabilities.

First claim

What is claimed is:

1. A system comprising:
a network managed by a service provider and configured to provide a plurality of microservices to a plurality of tenants each having one or more users; and
a controller having access to the network, wherein the controller is configured to:
output, to a user interface, data indicative of a plurality of capabilities for presentation by the user interface;
receive, from the user interface, data indicative of a user selection of a first set of capabilities from the plurality of capabilities and a user selection of a first role identifier, wherein the first role identifier corresponds to the first set of capabilities;
receive, from the user interface, data indicative of a user selection of a second set of capabilities from the plurality of capabilities and a user selection of a second role identifier, wherein the second role identifier corresponds to the second set of capabilities;
create, based on the first set of capabilities and the first role identifier, a first role which enables access to a first set of actions within a computer network, the first set of actions corresponding to the first set of capabilities, wherein at least some capabilities of the plurality of capabilities include elements of a subscription program offered by a service provider which operates at least some aspects of the computer network, wherein the subscription program comprises a set of subscription levels, and wherein the first set of capabilities are associated with a first subscription level of the set of subscription levels;
create, based on the second set of capabilities and the second role identifier, a second role which enables access to a second set of actions within a computer network, the second set of actions corresponding to the second set of capabilities, wherein the second set of capabilities are associated with a second subscription level of the set of subscription levels, and wherein the second subscription level represents a higher class of service than the first subscription level; and
associate the first role with a user corresponding to a tenant of the plurality of tenants, enabling the user to perform the first set of actions associated with the first set of capabilities corresponding to the role and associated with the first subscription level of the set of subscription levels.

2. The system of claim 1 , wherein the controller is further configured to output data indicative of the first role to a role data store, wherein the role data store includes a group of roles including a set of pre-defined roles and a set of user-created roles, and wherein the first role represents a user-created role of the set of user-created roles.

3. The system of claim 1 , wherein before associating the first role with the user, the controller is further configured to:
receive, from the user interface, data indicative of instructions to associate the first role with the user corresponding to the tenant of the plurality of tenants.

4. The system of claim 1 , wherein the plurality of capabilities include network configuration capabilities, network security capabilities, network policy capabilities, object deployment capabilities, or any combination thereof.

5. The system of claim 1 , wherein the controller is further configured to:
receive, from the user interface, data indicative of a modification of the first role;
modify the first role based on the data indicative of the modification by performing at least one of: adding at least one capability to the first set of capabilities associated with the first role, or removing at least one capability of the first set of capabilities associated with the first role, or any combination thereof; and
output data indicative of the modification to the role data store.

6. The system of claim 1 , wherein to output the data indicative of the plurality of capabilities to the user interface, the controller is configured to output data enabling the user interface to display the plurality of capabilities in a list.

7. The system of claim 1 , further configured to:
receive, from the user interface, data indicative of a combination of capabilities selected by a user; and
associate, with the selected role identifier, the combination of capabilities.

8. The system of claim 2 , wherein the group of roles includes service provider roles, tenant roles, or any combination thereof.

9. The system of claim 3 , wherein the controller is further configured to:
receive a token specifying a set of roles, wherein the set of roles is associated with the user; and
retrieve, from the role data store, the plurality of capabilities, wherein the plurality of capabilities is associated with the set of roles, and wherein the plurality of capabilities represents the plurality of capabilities for presentation by the user interface.

10. A system comprising:
a network managed by a service provider and configured to provide a plurality of microservices to a plurality of tenants each having one or more users;
a user interface; and
a controller having access to the network and configured for communication with the user interface, wherein the controller is configured to:
output, to the user interface, data indicative of a plurality of capabilities for presentation by the user interface;
receive, from the user interface, data indicative of a user selection of a first set of capabilities from the plurality of capabilities and a user selection of a first role identifier, wherein the first role identifier corresponds to the first set of capabilities;
receive, from the user interface, data indicative of a user selection of a second set of capabilities from the plurality of capabilities and a user selection of a second role identifier, wherein the second role identifier corresponds to the second set of capabilities;
create, based on the first set of capabilities and the role identifier, a first role which enables access to a first set of actions within a computer network, the first set of actions corresponding to the first set of capabilities, wherein at least some capabilities of the plurality of capabilities include elements of a subscription program offered by a service provider which operates at least some aspects of the computer network, wherein the subscription program comprises a set of subscription levels, and wherein the first set of capabilities are associated with a first subscription level of the set of subscription levels;
create, based on the second set of capabilities and the second role identifier, a second role which enables access to a second set of actions within a computer network, the second set of actions corresponding to the second set of capabilities, wherein the second set of capabilities are associated with a second subscription level of the set of subscription levels, and wherein the second subscription level represents a higher class of service than the first subscription level; and
associate the first role with a user corresponding to a tenant of the plurality of tenants, enabling the user to perform the first set of actions associated with the first set of capabilities corresponding to the role and associated with the first subscription level of the set of subscription levels.

11. The system of claim 10 , wherein the controller is further configured to output data indicative of the first role to a role data store, wherein the role data store includes a group of roles including a set of pre-defined roles and a set of user-created roles, and wherein the first role represents a user-created role of the set of user-created roles.

12. The system of claim 10 , wherein before associating the first role with the user, th

Assignees

• Juniper Networks Inc

Inventors

• Singh Gurminder
• Yang pei-yu
• Xie Rong

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/104 Primary

  Grouping of entities · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title