US 11,539,707 B2 · Dynamic security policy consolidation

Abstract

Various embodiments provide for the consolidation of policies across multiple identities that are respectively associated with multiple active directory (AD) groups to which a user belongs. Present embodiments provide for dynamically generating a new identity in the resource provider environment that includes permissions to all of the resources that may otherwise be distributed across multiple identities. Specifically, in accordance with various embodiments, when a user login is detected, the active directory is queried to determine the AD groups to which the user belongs. As mentioned, the user's AD groups are mapped to respective identities in the resource provider environment, in which each identity includes policy defining access to one or more resources. The policies of all the respective identities are consolidated and assigned to a new identity. The user may assume the new identity and access all the resources in tandem.

Claims19

Dependent claims

A computer-implemented method, comprising:

receiving login credentials used to access an on-premise system, the login credentials associated with a particular user;
permitting single sign-on across the on-premise system and a cloud-based system, the cloud-based system having a synchronized directory integrated with an on-premise directory;
determining one or more groups in the on-premise directory to which the user belongs;
determining one or more groups in the cloud-based environment corresponding to the one or more groups in the on-premise directory, wherein the one or more groups in the cloud-based environment are mapped to the one or more groups in the on-premise directory on a one-to-one basis, the one or more groups in the cloud-based environment providing respective access to one or more resources in the cloud-based environment;
generating a dynamic group in the cloud-based environment, the dynamic group having access to all of the resources associated with the one or more groups in the cloud-based environment;
assigning the user to the dynamic group;
and
allowing the user to access all of the one or more resources.

5 more elements

A system, comprising:

at least one computing device processor;
and
a memory device including instructions that, when executed by the at least one computing device processor, cause the system to:
receive login credentials used to access an on-premise system, the login credentials associated with a particular user;
permit single sign-on across the on-premise system and a cloud-based system, the cloud-based system having a synchronized directory integrated with an on-premise directory;
determine one or more groups in the on-premise directory to which the user belongs;
determine one or more groups in the cloud-based environment corresponding to the one or more groups in the on-premise directory, wherein the one or more groups in the cloud-based environment are mapped to the one or more groups in the on-premise directory on a one-to-one basis, the one or more groups in the cloud-based environment providing respective access to one or more resources in the cloud-based environment;
generate a dynamic group in the cloud-based environment, the dynamic group having access to all of the resources associated with the one or more groups in the cloud-based environment;
assign the user to the dynamic group;
and
allow the user to access all of the one or more resources.

8 more elements

A non-transitory computer-readable storage medium storing instructions, the instructions when executed by a processor causing the processor to:

receive login credentials used to access an on-premise system, the login credentials associated with a particular user;
permit single sign-on across the on-premise system and a cloud-based system, the cloud-based system having a synchronized directory integrated with an on-premise directory;
determine one or more groups in the on-premise directory to which the user belongs;
determine one or more groups in the cloud-based environment corresponding to the one or more groups in the on-premise directory, wherein the one or more groups in the cloud-based environment are mapped to the one or more groups in the on-premise directory on a one-to-one basis, the one or more groups in the cloud-based environment providing respective access to one or more resources in the cloud-based environment;
generate a dynamic group in the cloud-based environment, the dynamic group having access to all of the resources associated with the one or more groups in the cloud-based environment;
assign the user to the dynamic group;
and
allow the user to access all of the one or more resources.

5 more elements

Dependencies are inferred from the claim text.

Dynamic security policy consolidation

Life of this patent

Dynamic security policy consolidation

Life of this patent

Abstract

Claims19