System and method for as needed connection escalation

Patent metadata

Field	Value
Publication number	US-9762626-B2
Application number	US-201615223924-A
Country	US
Kind code	B2
Filing date	Jul 29, 2016
Priority date	May 3, 2013
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

A method includes selecting a first connection between a connection manager and a managed system, the first connection being associated with a first privilege level, communicating by the connection manager a first command to the managed system via the first connection, determining that a second command is executable on the managed system using a connection that is associated with a second privilege level, the second privilege level being a lower privilege level than the first privilege level, selecting a second connection between the connection manager and the managed system, the second connection being associated with the second privilege level, and communicating, by the connection manager, the second command to the managed system via the second connection.

First claim

What is claimed is:

1. A method comprising:
receiving, by a connection manager, a first command for a managed system from a command source, the first command associated with a first privilege level on the managed system;
determining, by the connection manager, that the command source has a first privilege level authorization on the managed system in response to receiving the first command, the first privilege level authorization being associated with the first privilege level;
establishing a first connection between the connection manager and the managed system in response to determining that the command source has the first privilege level authorization on the managed system, the first connection being associated with the first privilege level;
communicating, by the connection manager, the first command to the managed system via the first connection;
receiving, by the connection manager, a second command for the managed system from the command source, the second command associated with a second privilege level on the managed system, the second privilege level being a lower privilege level than the first privilege level;
determining, by the connection manager, that the command source has a first privilege level authorization on the managed system in response to receiving the second command, the second privilege level authorization being associated with the second privilege level;
establishing a second connection between the connection manager and the managed system in response to determining that the command source has the second privilege level authorization on the managed system, the second connection being associated with the second privilege level; and
communicating, by the connection manager, the second command to the managed system via the second connection.

2. The method of claim 1 , further comprising:
closing the first connection in response to establishing the second connection.

3. The method of claim 2 , further comprising:
receiving, by the connection manager, a third command for the managed system from the command source, the third command associated with a third privilege level on the managed system, the third privilege level being a higher privilege level than the second privilege level;
determining, by the connection manager, that the command source has a third privilege level authorization on the managed system in response to receiving the third command, the third privilege level authorization being associated with the third privilege level;
establishing a third connection between the connection manager and the managed system in response to determining that the command source has the third privilege level authorization on the managed system, the third connection being associated with the third privilege level; and
communicating, by the connection manager, the third command to the managed system via the third connection.

4. The method of claim 3 , further comprising:
closing the second connection in response to establishing the third connection.

5. The method of claim 1 , wherein in determining that the command source has a first privilege level authorization on the managed system, the method further comprises:
providing the first command to a command evaluator; and
checking, by the command evaluator, a policy database to determine if the command source has the first privilege level authorization.

6. The method of claim 1 , wherein the command source comprises a command script.

7. The method of claim 1 , wherein the command source comprises an administrator.

8. A connection manager for a managed network, the connection manager comprising:
a memory including code; and
a processor to execute the code to:
receive a first command for a managed system from a command source, the first command associated with a first privilege level on the managed system;
determine that the command source has a first privilege level authorization on the managed system in response to receiving the first command, the first privilege level authorization being associated with the first privilege level;
establish a first connection between the connection manager and the managed system in response to determining that the command source has the first privilege level authorization on the managed system, the first connection being associated with the first privilege level;
communicate the first command to the managed system via the first connection;
receive a second command for the managed system from the command source, the second command associated with a second privilege level on the managed system, the second privilege level being a lower privilege level than the first privilege level;
determine that the command source has a first privilege level authorization on the managed system in response to receiving the second command, the second privilege level authorization being associated with the second privilege level;
establish a second connection between the connection manager and the managed system in response to determining that the command source has the second privilege level authorization on the managed system, the second connection being associated with the second privilege level; and
communicate the second command to the managed system via the second connection.

9. The connection manager of claim 8 , the processor further to execute the code to:
close the first connection in response to establishing the second connection.

10. The connection manager of claim 9 , the processor further to execute the code to:
receive a third command for the managed system from the command source, the third command associated with a third privilege level on the managed system, the third privilege level being a higher privilege level than the second privilege level;
determine that the command source has a third privilege level authorization on the managed system in response to receiving the third command, the third privilege level authorization being associated with the third privilege level;
establish a third connection between the connection manager and the managed system in response to determining that the command source has the third privilege level authorization on the managed system, the third connection being associated with the third privilege level; and
communicate the third command to the managed system via the third connection.

11. The connection manager of claim 10 , the processor further to execute the code to:
close the second connection in response to establishing the third connection.

12. The connection manager of claim 8 , wherein, in determining that the command source has a first privilege level authorization on the managed system, the processor further to execute the code to:
check a policy database to determine if the command source has the first privilege level authorization.

13. The connection manager of claim 8 , wherein the command source comprises a command script.

14. The connection manager of claim 8 , wherein the command source comprises an administrator.

15. A non-transitory computer-readable medium including code for performing a method, the method comprising:
receiving, by a connection manager, a first command for a managed system from a command source, the first command associated with a first privilege level on the managed system;
determining that the command source has a first privilege level authorization on the managed system in response to receiving the first command, the first privilege level authorization being associated with the first privilege level;
establishing a first connection between the connection manager and the managed system in response to determ

Assignees

• Secureworks Corp

Inventors

• Duby Carolyn
• King Mark B
• LeDell Arie
• Oren Elchanan
• Vincent Michael

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• H04L67/141 Primary

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L65/1069 Primary

  Session establishment or de-establishment · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title