Operating large scale systems and cloud services with zero-standing elevated permissions

Patent metadata

Field	Value
Publication number	US-9460303-B2
Application number	US-201213413078-A
Country	US
Kind code	B2
Filing date	Mar 6, 2012
Priority date	Mar 6, 2012
Publication date	Oct 4, 2016
Grant date	Oct 4, 2016

Abstract

Large scale system operation may be provided. Upon receiving an action request from a user, a determination may be made as to whether the user requires elevated permissions to perform the action request. In response to determining that the user requires elevated permissions to perform the action request, the action request may be forwarded to a lockbox for evaluation and a permission response may be received from the lockbox.

First claim

We claim:

1. A method implemented by a computing device for providing large scale system operation, the method comprising:
receiving an action request from a user;
determining, by the computing device, whether the user requires elevated permissions to perform the action request;
in response to determining that the user requires elevated permissions to perform the action request, forwarding the action request to a lockbox; and
receiving a permission response from the lockbox, wherein receiving the permission response from the lockbox comprises:
determining, by the lockbox, a current role and a requested role of the user;
determining whether elevation to the requested role from the current role complies with at least one of a plurality of policies associated with the lockbox; wherein the at least one of the plurality of policies determines whether the user belongs to a specific user group; wherein the specific user group comprises at least one of: an administrator group, a security clearance group, an on-call group, and an onsite group; and wherein determining whether the elevation complies with the at least one of the plurality of policies comprises checking an action request scope evaluation rule to determine whether the action request violates a privacy policy; and
providing, in response to determining that the elevation to the requested role complies with the at least one of the plurality of policies and that the action request does not violate the privacy policy, the permission response, wherein providing the permission response further comprises stamping an attribute in a user object with an expiry time of the granted elevated permissions; and

determining, by the computing device at a configurable interval, whether any of the granted elevated permissions should be revoked, and
revoking at least one of the granted elevated permissions based on the determination of at least one of the following: the user is no longer associated with an organization, expiration of the expiry time, and inactivity for a predetermined length of time.

2. The method of claim 1 , further comprising:
determining whether the permission response comprises an approval; and
in response to determining that the permission response comprises the approval, granting the user temporary elevated permission to perform the action request.

3. The method of claim 2 , further comprising:
determining whether a pre-configured interval has elapsed since receiving the permission response from the lockbox; and
in response to determining that the pre-configured interval has elapsed since receiving the permission response from the lockbox, revoking the temporary elevated permission from the user.

4. The method of claim 1 , further comprising:
in response to determining that the action request complies with the at least one of the plurality of policies, providing the permission response comprising an approval.

5. The method of claim 1 , further comprising:
in response to determining that the action request does not comply with the at least one of the plurality of policies, forwarding the action request to at least one approval user.

6. The method of claim 1 , wherein the at least one of the plurality of policies comprises one of a plurality of pre-defined permission elevation policies.

7. The method of claim 1 , wherein the at least one of the plurality of policies comprises a user role evaluation rule.

8. The method of claim 1 , wherein the at least one of the plurality of policies comprises a permission elevation expiration rule.

9. The method of claim 1 , wherein the at least one of the plurality of policies comprises an action request denial rule.

10. The method of claim 1 , further comprising:
checking a user group membership rule, wherein checking the user group membership rule comprises determining whether the user is an on-site operator or an off-site operator and
checking a security flag rule, wherein checking the security flag rule comprises determining whether the user has undergone a security clearance.

11. A system for providing large scale system operation, the system comprising:
a memory storage; and
a processing unit coupled to the memory storage, wherein the processing unit is operable to:
receive an action request requiring an elevated permission from a user;
communicate with a lockbox, wherein the lockbox segregates duties associated with a action request;
determine whether the action request complies with at least one of a plurality of permission policies, wherein at least one of the plurality of permission policies determines whether the user is associated with a security flag, the determining comprising the processing unit operable to:
determine a current role and a requested role of the user, and
evaluate whether elevation from the current role to the requested role complies with the at least one of the plurality of permission policies by checking at least an action request scope evaluation rule to determine whether the action request violates a privacy policy;

in response to determining that the action request complies with the at least one of the plurality of permission policies, grant the user an elevated permission to perform a requested action for a temporary period and stamp an attribute in a user object with an expiry time marking an end of the temporary period;
when the granted elevated permission to perform the requested action grants the user access to user data:
log the user's activity associated with the action request in at least one log entry,
receive a request to modify the at least one log entry,
deny the request to modify the at least one log entry,
log the denial of the request to modify the at least one log entry, and
determine, at a configurable interval, whether any of the granted elevated permissions should be revoked, and
revoke at least one of the granted elevated permissions based on the determination of at least one of the following: the user is no longer associated with an organization, expiration of the expiry time, and inactivity for a predetermined length of time.

12. The system of claim 11 , wherein the configurable time interval comprises a pre-define interval upon a manual request.

13. The system of claim 11 , wherein the at least one of the plurality of permission policies determines whether the user belongs to a specific user group.

14. The system of claim 13 , wherein the specific user group comprises at least one of the following: an administrator group, a security clearance group, an on-call group, and an onsite group.

15. The system of claim 11 , wherein the processing unit is further operative to create a log entry comprising the user, the action request, and the granted elevated permissions.

16. The system of claim 15 , wherein the processing unit is further operative to create at least one second log entry associated with at least one second action request received from the user while the user is associated with the granted elevated permissions.

17. The system of claim 16 , wherein the processing unit is further operative to provide an audit report comprising a plurality of log entries.

18. The system of claim 11 , wherein the elevated permission comprises a set of permissions associated with a task.

19. The system of claim 11 , wherein the at least one of the plurality of permissions policies comprises a permission elevation expiration rule defining the expiry time.

20. A computer-readable storage device which stores a set of instructions which when exe

Assignees

• Macleod Alexander
• Lukyanov Andrey
• Nash Colin
• Singh Jaskaran
• Rajagopalan Rajmohan
• Sharma Vivek
• Microsoft Technology Licensing Llc

Inventors

• Macleod Alexander
• Lukyanov Andrey
• Nash Colin
• Singh Jaskaran
• Rajagopalan Rajmohan
• Sharma Vivek

Classifications

• G06Q10/06

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title