Authorization audit for access to privileged user data
AssigneeHewlett-Packard Development Company, L.P.
InventorsPaul Michael Anderson, Christopher Myers
Life of this patent
Estimating the term…
Abstract
In an example implementation according to aspects of the present disclosure, a system, method, and storage medium comprising a processor, memory, and instructions to send a request for authorization to a user wherein the authorization is limited to a subset of privileged information associated with the user, receive a response for authorization from the user. The instructions, responsive to the receipt of the response, access the subset of privileged information from a user data repository. The instructions, responsive to the access, send an audit record to an audit system, wherein the audit record comprises the request, the response, and a summary of the access and send the audit record to the user.
Claims14
A system comprising:
- a processor;
- and
- a memory communicatively coupled to the processor and storing machine readable instructions that when executed cause the processor to:
- send a request for authorization to a user from a requestor, wherein the authorization is limited to a subset of privileged information corresponding to the user and wherein the request includes a digital signature that indicates that the requestor is genuine;
- responsive to sending the request to the user, receive a response for authorization from the user, the response indicating whether the request is accepted;
- responsive to the receipt of the response from the user and the response indicating that the request is accepted:
- send a notification to a user data repository, the notification indicating that the authorization is granted by the user, and
- permit the requestor to access the subset of privileged information from the user data repository;
- responsive to the requestor accessing the subset of privileged information from the user data repository, send an audit record to an audit system, wherein the audit record comprises the request, the response, and a summary of the access;
- close the session after a predefined amount of time;
- invalidate the authorization;
- and
- upon completion of a session between the requestor and the user, send the audit record to the user.
A method comprising:
- receiving a context from a user;
- sending a request for authorization from a requestor to a user wherein the authorization is limited to a subset of privileged information corresponding to the user within the context and wherein the request includes a digital signature that indicates that the requestor is genuine;
- responsive to sending the request to the user, receiving a response for authorization from the user, the response indicating whether the request is accepted;
- responsive to the receipt of the response from the user and the response indicating that the request is accepted:
- sending a notification to a user data repository, the notification indicating that the authorization is granted by the user, and
- permitting the requestor to access the subset of privileged information from the user data repository;
- responsive to the requestor accessing the subset of privileged information from the user data repository, sending an audit record to an audit system, wherein the audit record comprises the request, the response, and a summary of the access;
- closing the session after a predefined amount of time;
- invalidating the authorization;
- and
- upon completion of a session between the requestor and the user, sending the audit record to the user.
A non-transitory computer readable medium comprising machine readable instructions that when executed cause a processor to:
- receive a context from a user;
- create a session corresponding to the context;
- send a request for authorization from a requestor to the user wherein the authorization is limited to a subset of privileged information corresponding to the user within the session and wherein the request includes a digital signature that indicates that the requestor is genuine;
- responsive to sending the request to the user, receive a response for authorization from the user the response indicating whether the request is accepted;
- responsive to the receipt of the response from the user and the response indicating that the request is accepted:
- send a notification to a user data repository, the notification indicating that the authorization is granted by the user,
- permit the requestor to access the subset of privileged information from the user data repository;
- responsive to the requestor accessing the subset of privileged information from the user data repository, send an audit record to an audit system, wherein the audit record comprises the request, the response, and a summary of the access;
- detect a change in the context;
- responsive to detecting the change or after a predefined amount of time, close the session;
- invalidate the authorization;
- and
- upon completion of the session, send the audit record to the user.
Dependencies are inferred from the claim text.