Security authorization for service level agreements

Patent metadata

Field	Value
Publication number	US-9882910-B2
Application number	US-201514862805-A
Country	US
Kind code	B2
Filing date	Sep 23, 2015
Priority date	Sep 23, 2015
Publication date	Jan 30, 2018
Grant date	Jan 30, 2018

Abstract

A computer device receives a command from a user to generate a view for display to a user in a graphical user interface (GUI). The view displays job execution data for a job, such as a print job for example, being handled by a job scheduler and one or more constituent sub-jobs that are performed in execution of the job. Prior to generating the view, however, the computer device determines whether the user is authorized to view details about the job based on the user's assigned permissions level. If the user is authorized for the job, the device ignores the permissions level and temporarily authorizes the user for limited access to any sub-job for which the user may not be authorized. For example, the temporary authorization may allow the user to see job execution details for a restricted sub-job on the view, but not alter or control, the sub-job.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving a command to generate a view for a job comprising a plurality of constituent sub-jobs, wherein each constituent sub-job is hierarchically related to the job, and comprises an application program that is executed in sequence by a job scheduler to perform the job, and wherein the plurality of constituent sub-jobs comprises a restricted sub-job that a user is not authorized to access;
responsive to receiving the command to generate the view:
determining whether the job is an authorized job that the user is authorized to access, or a restricted job that the user is not authorized to access, based on a job privilege level for the job assigned to the user;
responsive to determining that the job is an authorized job that the user is authorized to access:
ignoring the job privilege level for the user;
temporarily authorizing the user for limited access to the restricted sub-job; and
generating the view for display to the user, wherein the view comprises a graphical indicator representing job execution data for the restricted sub-job; and

outputting the view on a graphical user interface (GUI) on a display device to the user.

2. The computer-implemented method of claim 1 wherein determining whether the job is an authorized job or a restricted job comprises:
storing a list of job names for jobs that the user is authorized to access in a user profile;
comparing a name of the job to the list of job names stored in the user profile;
determining that the job is an authorized job if the name of the job matches a job name on the list; and
determining that the job is a restricted job if the name of the job does not match a job name on the list.

3. The computer-implemented method of claim 1 further comprising revoking the temporary authorization of the restricted sub-job responsive to receiving a command to close the view.

4. The computer-implemented method of claim 1 further comprising retrieving the job execution data for the restricted sub-job from the job scheduler.

5. The computer-implemented method of claim 1 wherein the job execution data comprises data identifying the job, each of the constituent sub-jobs, and a computing device executing the job.

6. The computer-implemented method of claim 5 wherein the job execution data further comprises execution details for the restricted sub-job.

7. The computer-implemented method of claim 1 wherein the view that is generated for display to the user comprises:
a first section configured to display the job execution data of the restricted sub-job in tabular form; and
a second section configured to graphically represent hierarchical interdependencies of each of the constituent sub-jobs to the job and to each other.

8. The computer-implemented method of claim 1 wherein generating the view for display to the user comprises:
retrieving information for the job from a service profile;
generating the view for display to the user based on the policy information.

9. The computer-implemented method of claim 8 wherein the information identifies one or more of:
a grouping of one or both of related jobs and sub-jobs for the job;
a hierarchy for the one or both of the related jobs and sub-jobs in the grouping; and
dependencies between the job and the sub-jobs.

10. A computing device comprising:
a communications interface circuit configured to communicate data with a job scheduler; and
a processing circuit operatively connected to the communications interface circuit and configured to:
receive a command to generate a view for a job comprising a plurality of constituent sub-jobs, wherein each constituent sub-job is hierarchically related to the iob, and comprises an application program that is executed in sequence by the job scheduler to perform the job, and wherein the plurality of constituent sub-jobs comprises a restricted sub-job that a user is not authorized to access;
responsive to receiving the command to generate the view:
determine whether the job is an authorized job that a user is authorized to access, or a restricted job that the user is not authorized to access, based on a job privilege level for the job assigned to the user;
responsive to determining that the job is a restricted job:
ignore the job privilege level for the user;
temporarily authorize the user for limited access to the restricted sub-job; and
generate the view for display to the user, wherein the view comprises a graphical indicator representing job execution data for the restricted job; and

output the view to a graphical user interface (GUI) on a display device.

11. The computing device of claim 10 wherein the processing circuit is further configured to:
store a list of job names for jobs that the user is authorized to access in a user profile;
compare a name of the job to the list of job names stored in the user profile;
determine that the job is an authorized job if the name of the job matches a job name on the list; and
determine that the job is a restricted job if the name of the job does not match a job name on the list.

12. The computing device of claim 11 wherein the processing circuit is further configured to revoke the temporary authorization of the restricted sub-job responsive to receiving a command to close the view.

13. The computing device of claim 10 wherein the processing circuit is further configured to retrieve the job execution data for the restricted sub-job from the job scheduler.

14. A non-transitory computer-readable storage medium comprising computer program code stored thereon that, when executed by a processing circuit of a computing device, configures the processing circuit to:
receive a command to generate a view for a job, wherein the job comprises a plurality of constituent sub-jobs, wherein each constituent sub-job is hierarchically related to the job, and comprises an application program that is executed in sequence by a job scheduler to perform the job, and wherein the plurality of constituent sub-jobs comprises a restricted sub-job that a user is not authorized to access;
responsive to receiving the command to generate the view:
determine whether the job is an authorized job that a user is authorized to access, or a restricted job that the user is not authorized to access, based on a job privilege level for the job assigned to the user;
responsive to determining that the job is an authorized job that the user is authorized to access:
ignore the job privilege level for the user;
temporarily authorize the user for limited access to the restricted sub-job; and
generate the view for display to the user, wherein the view comprises a graphical indicator representing job execution data for the restricted sub-job; and

output the view to a graphical user interface (GUI) on a display device.

15. The computer-readable storage medium of claim 14 wherein the computer program code further configures the processing circuit to
retrieve the job execution data for the restricted sub-job from the job scheduler.

Assignees

• Ca Inc

Inventors

• Dave Chirag
• Pallimakkal Ambili
• Williamson John
• Dave Parag

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title