Method and apparatus for ascertaining data access permission of groups of users to groups of data elements

Patent metadata

Field	Value
Publication number	US-9641334-B2
Application number	US-49867509-A
Country	US
Kind code	B2
Filing date	Jul 7, 2009
Priority date	Jul 7, 2009
Publication date	May 2, 2017
Grant date	May 2, 2017

Abstract

A method for ascertaining access permissions of users to computer resources on a storage unit, the method including grouping users into a plurality of user groups wherein all members of at least one of the user groups have at least nearly identical user/resource access permissions to the computer resources, grouping resources into a plurality of resource groups wherein all members of at least one of the resource groups have at least nearly identical resource/user access permissions, ascertaining whether a given user is a member of a user group, if the given user is a member of a user group, ascribing to the given user the user/resource access permissions of the user group, ascertaining whether a given resource is a member of a resource group, and if the given resource is a member of a resource group, ascribing to the given resource the resource/user access permissions of the resource group.

First claim

The invention claimed is:

1. In an enterprise computer system including multiple servers and multiple storage units, a method for ascertaining access permissions of users to computer resources on at least one storage unit of said multiple storage units, the method comprising employing a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by at least one of said multiple servers, cause said at least one of said multiple servers to:
periodically, at regular intervals of time, cluster users having at least partially identical user/resource access permissions to said computer resources, into a multiplicity of user clusters;
periodically, at regular intervals of time, cluster said computer resources having at least partially identical resource/user access permissions thereto into a multiplicity of resource clusters which are independent of said user clusters;
in response to a query received via one of said multiple servers as to whether a multiplicity of users have access permissions to a multiplicity of resources:
ascertain whether a first user of said multiplicity of users has user/resource access permissions to a first resource of said multiplicity of resources;
ascertain whether said first user is a member of a first user cluster;
ascertain whether second users of said multiplicity of users are members of said first user cluster;
ascertain whether said first resource is a member of a first resource cluster;
ascertain whether second resources of said multiplicity of resources are members of said first resource cluster; and
if:
said first user has user/resource access permissions to said first resource of said multiplicity of resources; and
said first user is a member of said first user cluster; and
said second users are members of said first user cluster; and
said first resource is a member of said first resource cluster; and
said second resources are members of said first resource cluster,

then:
respond to said query by stating that said first and second users have said user/resource access permissions to said first and second resources:
without checking if said first user has user/resource access permissions to said second resources; and
without checking if said second users have user/resource access permissions to said second resources.

2. A method according to claim 1 and wherein said periodically cluster users comprises causing said at least one of said multiple servers to:
identify a set of user security groups, each of said user security groups having access permissions to at least one of said computer resources on said at least one storage unit of said multiple storage units;
identify, for each user of said multiplicity of users, a subset of said user security groups of which said user is a member; and
if a first subset of said user security groups, of which said user of said multiplicity of users is a member, is identical to a second subset of said user security groups, of which a different user of said multiplicity of users is a member, cluster said user and said different user in a first cluster with respect to said at least one storage unit of said multiple storage units.

3. A method according to claim 1 and wherein said periodically cluster users comprises causing said at least one of said multiple servers to divide said computer resources into at least two portions, and cluster said users, among said multiplicity of users, into a first cluster wherein all members of said first cluster have at least partially identical user/resource access permissions to computer resources included in one of said at least two portions.

4. A method according to claim 1 and wherein said computer resources are arranged in a computer resource hierarchy.

5. A method according to claim 4 and wherein said periodically cluster resources comprises causing said at least one of said multiple servers to:
retrieve, for each resource in said computer resource hierarchy, the resource/user access permissions of said resource and the resource/user access permissions of an immediate ancestor of said resource in said computer resource hierarchy; and
if said resource/user access permissions of said immediate ancestor are identical to said resource/user access permissions of said resource, cluster said resource and said immediate ancestor in a common resource cluster.

6. A method according to claim 5 and wherein said cluster said resource comprises causing said at least one of said multiple servers to:
provide a pointer from said resource to said immediate ancestor; and
extend pointers which point to said resource to point to said immediate ancestor.

7. A computer product for controlling data access by users of an enterprise computer system including multiple servers and multiple storage units, the computer product including a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by at least one of said multiple servers, cause said at least one of said multiple servers to ascertain access permissions of users to computer resources on at least one storage unit of said multiple storage units, the product comprising:
user clustering functionality for periodically, at regular intervals of time, clustering users having at least partially identical user/resource access permissions to said computer resources on said at least one storage unit of said multiple storage units, into a multiplicity of user clusters;
computer resource clustering functionality for periodically, at regular intervals of time, clustering said computer resources having at least partially identical resource/user access permissions thereto into a multiplicity of resource clusters which are independent of said user clusters;
user access permissions ascribing functionality, in response to a query as to whether a multiplicity of users have access permissions to a multiplicity of resources, operative to:
ascertain whether a first user of said multiplicity of users has user/resource access permissions to a first resource of said multiplicity of resources;
ascertain whether said first user is a member of a first user cluster;
ascertain whether second users of said multiplicity of users are members of said first user cluster;
ascertain whether said first resource is a member of a first resource cluster;
ascertain whether second resources of said multiplicity of resources are members of said first resource cluster; and
if:
said first user has user/resource access permissions to said first resource of said multiplicity of resources; and
said first user is a member of said first user cluster;
said second users are members of said first user cluster; and
said first resource is a member of said first resource cluster; and
said second resources are members of said first resource cluster,

then:
respond to said query by stating that said first and second users have said user/resource access permissions to said first and second resources:
without checking if said first user has user/resource access permissions to said second resources; and
without checking if said second users have user/resource access permissions to said second resources.

8. The computer product according to claim 7 and wherein said user clustering functionality comprises:
user security group identification functionality for identifying a plurality of user security groups, each of said user security groups having access permissions to at least one of said computer resources on said at least one storage unit;
user security group subset identification functionality for identifying, for each user of said multiplicity of users, a subset of said use

Assignees

• Faitelson Yakov
• Korkus Ohad
• Keysar Yzhar
• Varonis Systems Inc

Inventors

• Faitelson Yakov
• Korkus Ohad
• Keysar Yzhar

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• H04L9/32 Primary

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title