Privilege level assignments to groups
AssigneeMicrosoft Technology Licensing, LLC
InventorsNaama KRAUS, Moshe ISRAEL, Tamer SALMAN, Moshe SHALALA, Rotem LURIE, Avihai DVIR
Life of this patent
Estimating the term…
Abstract
According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to determine, for each of a plurality of members in a group, a respective least privilege level for a resource and determine, based on the determined respective least privilege levels, a privilege level to be assigned to the group for the resource. The instructions may also cause the processor to assign the determined privilege level to the group for the resource and apply the assigned privilege level to the members of the group for the resource.
Claims20
An apparatus comprising:
- a processor;
- and
- a memory storing machine-readable instructions that, when executed by the processor, cause the processor to:
- identify a group of members assigned a privilege level for accessing a first resource;
- determine, for a member of the group of members, a respective least privilege level based on historical access to the first resource;
- determine whether a subset of the group of members has least privilege levels that exceed the assigned privilege level;
- in response to determining that at least one member of the group of members have least privilege levels that exceed the assigned privilege level, assign a higher privilege level to the at least one member without modifying the group privilege level;
- and
- apply the higher privilege level to the at least one member for accessing the first resource.
A method comprising:
- identifying, by a computing device, a group of members assigned a privilege level for accessing a first resource;
- determining, for a first member of the group, a first least privilege level based on historical access to the first resource by the first member of the group;
- determining that the first least privilege level of the first member exceeds the assigned privilege level of the group;
- in response to determining that the first least privilege level exceeds the assigned privilege level, assigning a higher privilege level to the first member without modifying the assigned privilege level of the group;
- and
- enabling access by the first member to the first resource using the higher privilege level.
A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
- store, in memory, data representing a group of members assigned a privilege level for accessing a first resource;
- analyze historical access to the first resource by a first member of the group to determine a first least privilege level for the first member;
- compare the first least privilege level of the first member to the assigned privilege level of the group;
- in response to determining that the first least privilege level of the first member exceeds the assigned privilege level of the group, assign a higher privilege level to the first member without modifying the assigned privilege level of the group;
- and
- enable access to the first resource by the first member using the higher privilege level.
Dependencies are inferred from the claim text.