US 11,689,534 B1Granted

Dynamic authorization of users for distributed systems

AssigneeAmazon Technologies, Inc.

InventorJustin W Smith

Life of this patent

Estimating the term…

Loading patent…

Abstract

Technologies are disclosed for dynamic authorization of users for distributed systems. A permission service allows authorized users to specify permissions for users of different systems, such as physical access security systems (PACS) and easier for users to interact with the authorized resources of the PACS. A manager may select a role for the user to specify the allowed permissions for the user. Changing the permissions/resources of a role automatically changes the permissions for users that are associated with the role. A scope may also be assigned to the user that specifies the locations of the physical resources that the user may access (e.g., a particular data center, a region, globally, . . . ). Instead of having to locate specific resources that the user is authorized to access, a graphical user interface (GUI) displays the authorized resources. When the resources change, the GUI is dynamically updated.

Claims20

Dependent claims

A system comprising:

one or more processors;
and
a non-transitory computer-readable storage medium having instructions stored thereupon which, when executed by the one or more processors, cause the system to:
identify first resources a first user is authorized to access within different physical access security systems (PACS) based on a first role of the first user;
generate first user interface (UI) elements to present on a first display associated with the first user based on the first resources, wherein the first UI elements include one or more role UI elements associated with specifying a second role of a second user, wherein the second role specifies second resources that the second user is authorized to access within the different PACS and permissions associated with the second role;
provide for display, a first graphical user interface (GUI) that includes the first UI elements;
receive, via a role UI element of the one or more role UI elements of the first GUI, first data identifying a selection of the second role;
associate the second role and the permissions with the second user;
receive a first request from a second computing device associated with the second user to view second data associated with the second resources;
identify, based on the second role and the permissions, the second resources that the second user is authorized to access;
generate second UI elements associated with the second resources that the second user is authorized to access;
cause a second GUI, that includes the second UI elements, to be displayed on a second display associated with the second computing device;
receive a second request, via the second GUI, to access a resource of the second resources;
determine that the second user is authorized to access the resource based on the second role and the permissions;
provide, for display within the second GUI, third data associated with the resource;
and
dynamically update the second UI elements displayed within the second GUI based on an updated second role of the second user, wherein the updated second role is based on determining that a first permission for the second user to physically access a new physical resource location has been added to the second role or that a second permission for the second user to physically access a physical resource location has been removed from the second role, and wherein dynamically updating the second UI elements is performed as the second user is viewing the second GUI and without receiving an additional request to access additional resources of the second resources from the second user via the second GUI.

14 more elements

A computer-implemented method comprising:

receiving, from a computing device associated with a user, a request to view data associated with resources of one or more physical access security systems (PACS);
identifying, based at least in part on a role associated with the user, one or more resources of the resources that the user is authorized to access within at least one of the one or more PACS, wherein the role identifies the one or more resources that the user and other users associated with the role are authorized to access;
generating one or more user interface (UI) elements associated with the one or more resources that the user is authorized to access;
causing a graphical user interface (GUI), that includes the one or more UI elements, to be displayed on a display associated with the computing device;
determining that the role associated with the user changed, wherein a change associated with the role comprises at least one of determining that a first permission for the user to physically access a new physical resource location has been added to the role or that a second permission for the user to physically access a physical resource location has been removed from the role;
and
updating the one or more UI elements displayed within the GUI based at least in part on determining that the role associated with the user changed, wherein updating the one or more UI elements is performed as the user is viewing the GUI and without receiving an additional request to access additional resources of the one or more resources from the user via the GUI.

4 more elements

A system comprising:

one or more processors;
and
a non-transitory computer-readable storage medium having instructions stored thereupon which, when executed by the one or more processors, cause the system to:
receive, from a computing device associated with a user, a request to view data associated with resources of one or more physical access security systems (PACS);
identify, based at least in part on a role associated with the user, one or more resources of the resources that the user is authorized to access within at least one of the one or more PACS, wherein the role identifies the one or more resources that the user and other users associated with the role are authorized to access;
generate one or more user interface (UI) elements associated with the one or more resources that the user is authorized to access;
cause a graphical user interface (GUI), that includes the one or more UI elements, to be displayed on a display associated with the computing device;
determine that the role associated with the user changed, wherein a change associated with the role comprises at least one of determining that a first permission for the user to physically access a new physical resource location has been added to the role or that a second permission for the user to physically access a physical resource location has been removed from the role;
and
update the one or more UI elements displayed within the GUI based at least in part on determining that the role associated with the user changed, wherein updating the one or more UI elements is performed as the user is viewing the GUI and without an additional request to access additional resources of the one or more resources from the user via the GUI.

7 more elements

Dependencies are inferred from the claim text.