Privileged account plug-in framework—usage policies

Patent metadata

Field	Value
Publication number	US-9787657-B2
Application number	US-201414221217-A
Country	US
Kind code	B2
Filing date	Mar 20, 2014
Priority date	Sep 19, 2013
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

Techniques for managing privileged accounts via a privileged access management service are provided. In some examples, the service may be configured with a plug-in framework for accessing secure resources. In some aspects, a log-in request that includes authentication information and corresponds to the service may be received. Session access to at least one secure resource may be provided when a user is authenticated. In some examples, a request to perform an action associated with the secure resource may be received during the session. Additionally, in some examples, the plug-in framework may be implemented to determine whether the user is allowed to perform the action. Further, performance of the action may be allowed or denied during the session based on the determination.

First claim

What is claimed is:

1. A system, comprising:
a memory storing computer-executable instructions;
a privileged access management module that provides a privileged access management service configured with a plug-in framework for accessing secure network resources; and
a processor that accesses the memory and executes the computer-executable instructions to at least:
receive, from an entity associated with the secure network resources, plug-in code for implementing runtime privileges;
generate instructions for implementing the runtime privileges based at least in part on the received plug-in code;
receive, from a first user, a log-in request to start a session including at least first authentication information, the log-in request corresponding to the privileged access management service;
provide access to at least one secure network resource of the secure network resources through the session when the first user is authenticated with respect to the privileged access management service;
receive, from a computing device of the user, a request to perform an action associated with the at least one secure network resource within the session;
implement the plug-in framework to determine, based at least in part on the runtime privileges and a runtime factor, whether the first user is allowed to perform the action during the session; and
perform the action during the session for the first user if it is determined that the first user is allowed to perform the action and if a second user is authenticated and logged in with the privileged access management service during the session, the first user given access to the at least one secure network resource during the session only if the second user is authenticated and logged in with the privileged access management service during the session, the first user being different from the second user.

2. The system of claim 1 , wherein the runtime factor is associated with the first user or the at least one secure network resource.

3. The system of claim 2 , wherein the runtime factor comprises at least one of a time, a locality, a client, a number of requests, a privilege granted to the first user, or another factor.

4. The system of claim 1 , wherein the at least one secure network resource is a privileged account of the privileged access management service.

5. The system of claim 1 , wherein the privileged access management service is implemented by a first virtual machine and the plug-in framework is implemented by a second virtual machine, the first virtual machine and the second virtual machine being different virtual machines.

6. The system of claim 5 , wherein the second virtual machine is sandboxed and separated from the first virtual machine.

7. The system of claim 5 , wherein the plug-in framework is implemented to determine whether the first user is allowed to perform the action by executing instructions to at least:
transmit the request to perform the action to the second virtual machine;
configure the second virtual machine to execute the plug-in code;
receive, from the second virtual machine, a result of executing the plug-in code; and
process, utilizing the first virtual machine, the result to perform the action within the session if it is determined, by the plug-in code, that the first user is allowed to perform the action.

8. A non-transitory computer-readable storage memory storing a plurality of instructions executed by one or more processors to :
manage a privileged access management service configured with a plug-in framework for accessing secure network resources;
receive, from an entity associated with the secure network resources, plug-in code for implementing runtime privileges;
receive, from a first user, a log-in request to start a session including at least first authentication information, the log-in request corresponding to the privileged access management service;
provide access to at least one secure network resource of the secure network resources through the session when the first user is authenticated with respect to the privileged access management service;
receive, from a computing device of the first user, a request to perform an action associated with the at least one secure network resource within the session;
implement the plug-in framework to determine, based at least in part on the runtime privileges and a runtime factor, whether the first user is allowed to perform the action during the session; and
perform the action during the session for the first user if it is determined that the first user is allowed to perform the action and if a second user is authenticated and logged in with the privileged access management service during the session, the first user given access to the at least one secure network resource during the session only if the second user is authenticated and logged in with the privileged access management service during the session, the first user being different from the second user.

9. The non-transitory computer-readable storage memory of claim 8 , wherein the runtime factor includes at least one of a time, a locality, a client, a number of requests, or a privilege granted to the first user.

10. The non-transitory computer-readable storage memory of claim 8 , wherein the privileged access management service is implemented by a first virtual machine and the plug-in framework is implemented by a second virtual machine, the first virtual machine and the second virtual machine being different virtual machines.

11. The non-transitory computer-readable storage memory of claim 10 , wherein the second virtual machine is sandboxed and separated from the first virtual machine.

12. The non-transitory computer-readable storage memory of claim 10 , wherein the plug-in framework is implemented to determine whether the first user is allowed to perform the action by further implementing the plurality of instructions to:
transmit the request to perform the action to the second virtual machine;
instruct the second virtual machine to execute the plug-in code;
receive, from the second virtual machine, a result of executing the plug-in code; and
process the result to perform the action if it is determined, by the plug-in code, that the user is allowed to perform the action.

13. A computer-implemented method, comprising:
managing, by a computer system, a privileged access management service configured with a plug-in framework for accessing secure network resources;
receiving, from a first user, a log-in request to start a session including at least first authentication information, the log-in request corresponding to the privileged access management service;
providing session access corresponding to the session to at least one secure network resource of the secure network resources when the first user is authenticated with respect to the privileged access management service;
receiving while in the session, from a computing device of the first user, a request to perform an action associated with the at least one secure network resource;
implementing the plug-in framework to determine, based at least in part on the runtime privileges and a runtime factor, whether the first user is allowed to perform the action; and
denying performance of the action during the session if it is determined that the first user is not allowed to perform the action or if a second user that was authenticated and logged in with the privileged access management service during the session logs out of the privileged access management service, the first user given access to the at least one secure network resource only if the second user is authenticated and logged in with the privi

Assignees

• Oracle Int Corp

Inventors

• Kottahachchi Buddhika
• Sharma Himanshu
• Sathyanarayan Ramaprakash Hosalli
• Ho Fannie
• Theebaprakasam Arun
• Tirumalai Srikant Krishnapuram
• Stullich Olaf

Classifications

• H04L63/102

  Entity profiles · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/30

  Authentication, i.e. establishing the identity or authorisation of security principals · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title