Enforcement of Balanced Users Access to Sensitive Information in Organizations
AssigneeDell Products L.P.
InventorsBoris Shpilyuck, Nisan Haimov, Igor Dubrovsky
Life of this patent
Estimating the term…
Abstract
A method for managing user access to information in a computer system comprises associating an Accessibility Weight (AW) with computer system resources, calculating an access amount for each user by aggregating AWs for each system resource available to the user, calculating a total accessibility weight in the system by aggregating the AWs for all system resources, calculating an access percentage for each user, identifying an access baseline for one or more access ranges in the computer system, and determining, by an identity and access management system, whether a user provisioning action would violate the defined access baseline. The resources may be accessed via an API.
Claims20
A method for managing user access to information in a computer system, comprising:
- associating an Accessibility Weight (AW) with computer system resources;
- calculating an access amount for each user by aggregating AWs for each system resource available to the user;
- calculating a total accessibility weight in the system by aggregating the AWs for all of the system resources;
- calculating an access percentage for each user;
- identifying an access baseline for one or more access ranges in the computer system;
- and
- determining, by an identity and access management system, automatically when a user provisioning action is requested, whether the user provisioning action would violate the defined access baseline.
A system for enforcing balanced user access to sensitive information, comprising:
- an identity and access management (IAM) system configured to manage access to a computer system;
- a user interface configured provision computer system users via the IAM system;
- and
- an accessibility enforcement system comprising a non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the accessibility enforcement system to perform the actions comprising:
- identifying a baseline access policy that specifies maximal allowed percentages of users against corresponding ranges of accessibility within the system;
- associating an accessibility weight with computer system resources, wherein the accessibility weight reflects the criticality or sensitivity of the information exposed through each resource;
- calculating an access amount for each user based on the accessibility weight metric by aggregating accessibility weights from the groups and roles assigned to the user;
- determining a total accessibility weight in the system by aggregating all the accessibility weights in the system;
- calculating a access percentage for each user;
- and
- provisioning new groups or roles to a user if the user percentages in each range are less than or equal to the values defined by the baseline access policy.
Dependencies are inferred from the claim text.