System and method for as needed connection escalation

Patent metadata

Field	Value
Publication number	US-9426226-B2
Application number	US-201313886798-A
Country	US
Kind code	B2
Filing date	May 3, 2013
Priority date	May 3, 2013
Publication date	Aug 23, 2016
Grant date	Aug 23, 2016

Abstract

A method includes selecting a first connection between a connection manager and a managed system, the first connection being associated with a first privilege level, communicating by the connection manager a first command to the managed system via the first connection, determining that a second command is executable on the managed system using a connection that is associated with a second privilege level, the second privilege level being a lower privilege level than the first privilege level, selecting a second connection between the connection manager and the managed system, the second connection being associated with the second privilege level, and communicating, by the connection manager, the second command to the managed system via the second connection.

First claim

What is claimed is:

1. A method comprising:
receiving a first command associated with a first privilege level on a managed system;
selecting a first connection between a connection manager and the managed system in response to receiving the first command, the first connection being associated with the first privilege level;
communicating, by the connection manager, the first command to the managed system via the first connection;
receiving a second command associated with a second privilege level on the managed system, the second privilege level being a lower privilege level than the first privilege level;
selecting a second connection between the connection manager and the managed system in response to receiving the second command, the second connection being associated with the second privilege level; and
communicating, by the connection manager, the second command to the managed system via the second connection.

2. The method of claim 1 , further comprising:
receiving a third command associated with a third privilege level on the managed system, the third privilege level being a higher privilege level than the first privilege level;
selecting a third connection between the connection manager and the managed system in response to receiving the third command, the third connection being associated with the third privilege level; and
communicating, by the connection manager, the third command to the managed system via the third connection.

3. The method of claim 1 , wherein:
the first connection and the second connection comprise pre-established connections between the connection manager and the managed system; and
in response to selecting the second connection, the method further comprises maintaining the first connection between the connection manager and the managed system.

4. The method of claim 1 , further comprising:
closing the first connection in response to selecting the second connection.

5. The method of claim 1 , further comprising:
providing the first command from a first plurality of commands from a first script; and
evaluating, by the connection manager, the first script to determine that a first highest privilege level associated with the first plurality of commands is the first privilege level;
wherein selecting the first connection is in response to evaluating the first script.

6. The method of claim 5 , further comprising:
providing the second command from a second plurality of commands from a second script; and
evaluating, by the connection manager, the second script to determine that a second highest privilege level associated with the second plurality of commands is the second privilege level;
wherein selecting the second connection is in response to evaluating the second script.

7. The method of claim 1 , further comprising:
receiving the first command from an authenticated administrator associated with the managed system; and
evaluating, by the connection manager, the first command to determine that a first command privilege level associated with the first command is the first privilege level;
wherein selecting the first connection is in response to evaluating the first command.

8. The method of claim 7 , further comprising:
receiving the second command from the administrator; and
evaluating, by the connection manager, the second command to determine that a second command privilege level associated with the second command is the second privilege level;
wherein selecting the second connection is in response to evaluating the second command.

9. A connection manager for a managed network, the connection manager comprising:
a memory including code; and
a processor operable to execute the code to:
receive a first command associated with a first privilege level on a managed system;
select a first connection between the connection manager and a managed system in response to receiving the first command, the first connection being associated with a first privilege level;
communicate the first command to the managed system via the first connection;
receive a second command associated with a second privilege level on the managed system, the second privilege level being a lower privilege level than the first privilege level;
select a second connection between the connection manager and the managed system in response to receiving the second command, the second connection being associated with the second privilege level;
communicate the second command to the managed system via the second connection; and
close the first connection in response to selecting the second connection.

10. The connection manager of claim 9 , the processor further operable to execute the code to:
receive a third command associated with a third privilege level on the managed system, the third privilege level being a higher privilege level than the first privilege level;
select a third connection between the connection manager and the managed system in response to receiving the third command, the third connection being associated with the third privilege level; and
communicate the third command to the managed system via the third connection.

11. The connection manager of claim 9 , the processor further operable to execute the code to:
provide the first command from a first plurality of commands from a first script; and
evaluate the first script to determine that a first highest privilege level associated with the first plurality of commands is the first privilege level;
wherein selecting the first connection is in response to evaluating the first script.

12. The connection manager of claim 11 , the processor further operable to execute the code to:
provide the second command from a second plurality of commands from a second script; and
evaluate, by the connection manager, the second script to determine that a second highest privilege level associated with the second plurality of commands is the second privilege level;
wherein selecting the second connection is in response to evaluating the second script.

13. The connection manager of claim 9 , the processor further operable to execute the code to:
receive the first command from an authenticated administrator associated with the managed system; and
evaluate, by the connection manager, the first command to determine that a first command privilege level associated with the first command is the first privilege level;
wherein selecting the first connection is in response to evaluating the first command.

14. The connection manager of claim 13 , the processor further operable to execute the code to:
receive the second command from the administrator; and
evaluate, by the connection manager, the second command to determine that a second command privilege level associated with the second command is the second privilege level;
wherein selecting the second connection is in response to evaluating the second command.

15. A non-transitory computer-readable medium including code for performing a method, the method comprising:
receiving a first command associated with a first privilege level on a managed system of a managed network;
selecting a first connection between a connection manager and the managed system in response to receiving the first command, the first connection being associated with a first logged session between the connection manager and the managed system, the first logged session being at a first privilege level;
communicating, by the connection manager, a first command to the managed system via the first connection;
receiving a second command associated with a second privilege level on the managed s

Assignees

• Dell Products Lp
• Secureworks Corp

Inventors

• Duby Carolyn
• King Mark B
• Ledell Aric
• Oren Elchanan
• Vincent Michael

Classifications

• H04L67/141 Primary

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L65/1069 Primary

  Session establishment or de-establishment · CPC title