US 2019/0199782 A1 · ACCESS MANAGEMENT IN A DATA STORAGE SYSTEM

Abstract

A method and system for managing access to information stored in a data storage system of an organization is provided. In an embodiment, the data storage system may be configured to receive a request from a requester on a client device to access information stored in the data storage system. In some aspects, upon receiving the request, the first system may determine that an access token identifying the requester is stored in a cache in the data storage system. In some aspects, the data storage system may then retrieve one or more roles from the cache. In some examples, the roles may be associated with the access token. In certain embodiments, the data storage system may then be configured to determine that the requester is authorized to access the information based on the roles and provide the information to the requester on the client device.

Claims20

Dependent claims

A computer-implemented method comprising:

receiving, by a data storage system and from a client device, a request by a requester to access first information of a set of information managed by the data storage system;
retrieving, from a cache in the data storage system, an access token for the requester, the access token being associated with a plurality of roles that specify at least one of one or more privileges or one or more access rights related to accessing of the set of information managed by the data storage system, the access token indicating that the requester is authenticated by an identity management (IDM) system;
determining, by the data storage system and without communicating with the IDM system, and based on the at least one of one or more privileges or one or more access rights specified by the plurality of roles associated with the access token, whether the requester is authorized to access the first information;
and
based on determining that the requester is authorized to access the first information, sending, by the data storage system, the first information to the client device.

2 more elements

A system comprising:

a memory configured to store computer-executable instructions;
and
at least one processor configured to access the memory and execute the computer-executable instructions to perform operations to:
receive, from a client device, a request by a requester to access first information of a set of information managed by system;
retrieve, from a cache of the system, an access token for the requester, the access token being associated with a plurality of roles that specify at least one of one or more privileges or one or more access rights related to accessing of the set of information managed by the system, the access token indicating that the requester is authenticated by an identity management (IDM) system;
determine, without communicating with the IDM system, and based on the at least one of one or more privileges or one or more access rights specified by the plurality of roles associated with the access token, whether the requester is authorized to access the first information;
and
based on determining that the requester is authorized to access the first information, send the first information to the client device.

5 more elements

One or more non-transitory computer-readable media storing computer-executable instructions executable by one or more processors of a system, the computer-executable instructions comprising instructions that cause the one or more processors to:

receive, from a client device, a request by a requester to access first information of a set of information managed by the system;
retrieve, from a cache of the system, an access token for the requester, the access token being associated with a plurality of roles that specify at least one of one or more privileges or one or more access rights related to accessing of the set of information managed by the system, the access token indicating that the requester is authenticated by an identity management (IDM) system;
determine, without communicating with the IDM system, and based on the at least one of one or more privileges or one or more access rights specified by the plurality of roles associated with the access token, whether the requester is authorized to access the first information;
and
based on determining that the requester is authorized to access the first information, send the first information to the client device.

2 more elements

Dependencies are inferred from the claim text.

Access management in a data storage system

Life of this patent

Access management in a data storage system

Life of this patent

Abstract

Claims20