Granted Patent B1

US 11,070,560 · App. 16/374,409 · Granted Jul 20, 2021

Inventors: Shailesh Dargude (Santa Clara, CA); Satish Grandhi (Santa Clara, CA); Srinivas Kavuri (Santa Clara, CA)

Assignee: Veritas Technologies LLC

H04L63/102H04L63/101H04L63/104

Abstract

Claims (69)

1. A computer-implemented method for managing user entitlements of objects from heterogeneous content sources, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

obtaining, by the computing device, a user identifier from a user profile associated with a user;

determining, by the computing device, an entitlement for the user in an access control list (ACL) for an object of a content source;

determining, by the computing device, another entitlement for the user in another ACL for another object of another content source, wherein the content source and the other content source are associated with different systems;

generating, by the computing device, an effective entitlement of the user by associating the user identifier, the entitlement for the user in the ACL for the object, and the other entitlement for the user in the other ACL for the other object, wherein the effective entitlement is derived from deconstructing user groups and resolving conflicting entitlements associated with the user according to a conflict resolution rule that at last one of prioritizes directly assigned entitlements over group entitlements or prioritizes group entitlements over individual entitlements;

storing, by the computing device, the effective entitlement of the user;

performing, by the computing device, a security action using the effective entitlement of the user by modifying the effective entitlement and propagating changes in the effective entitlement to the ACL and the other ACL; and

generating a report using the effective entitlement of the user.

2. The computer-implemented method of claim 1 , further comprising:

identifying a user group in the ACL;

determining that the user is a member of the user group in the ACL; and

determining a group entitlement for the object in the ACL.

3. The computer-implemented method of claim 2 , wherein generating the effective entitlement of the user further comprises:

associating the user identifier with the group entitlement for the object.

4. The computer-implemented method of claim 3 , wherein the conflict resolution rule prioritizes group entitlements over individual entitlements.

5. The computer-implemented method of claim 3 , further comprising:

detecting that the user has been removed from the user group; and

updating the effective entitlement of the user to remove the group entitlement.

6. The computer-implemented method of claim 3 , further comprising:

detecting a change in the group entitlement; and

updating the effective entitlement of the user to include the change in the group entitlement.

7. The computer-implemented method of claim 1 , further comprising:

detecting a change of the entitlement for the user in in the ACL for the object; and

updating the effective entitlement of the user to include the change of the entitlement.

8. The computer-implemented method of claim 1 , further comprising:

normalizing the entitlement for the user of the ACL for the object of the content source to configured entitlements; and

normalizing the other entitlement for the user in the other ACL for the other object of the other content source to the configured entitlements.

9. The computer-implemented method of claim 1 , further comprising:

performing a security action using the effective entitlement of the user.

10. A system for managing user entitlements of objects from heterogeneous content sources, the system comprising:

at last one physical processor;

physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

obtain a user identifier from a user profile associated with a user;

determine an entitlement for the user in an access control list (ACL) for an object of a content source;

determine another entitlement for the user in another ACL for another object of another content source, wherein the content source and the other content source are associated with different systems;

generate an effective entitlement of the user by associating the user identifier, the entitlement for the user in the ACL for the object, and the other entitlement for the user in the other ACL for the other object, wherein the effective entitlement is derived from deconstructing user groups and resolving conflicting entitlements associated with the user according to a conflict resolution rue that at last one of prioritizes directly assigned entitlements over group entitlements or prioritizes group entitlements over individual entitlements;

store the effective entitlement of the user;

perform a security action using the effective entitlement of the user by modifying the effective entitlement and propagating changes in the effective entitlement to the ACL and the other ACL; and

generate a report using the effective entitlement of the user.

11. The system of claim 10 , wherein the computer-executable instructions further cause the physical processor to:

identify a user group in the ACL;

determine that the user is a member of the user group in the ACL; and

determine a group entitlement for the object in the ACL.

12. The system of claim 11 , wherein, to generate the effective entitlement of the user, the computer-executable instructions further cause the physical processor to:

associate the user identifier with the group entitlement for the object.

13. The system of claim 12 , wherein the conflict resolution rule prioritizes directly assigned entitlements over group entitlements

conflict resolution rule that at least one of prioritizes directly assigned entitlements over group entitlements or prioritizes group entitlements over individual entitlements.

14. The system of claim 12 , wherein the computer-executable instructions further cause the physical processor to:

detect that the user has been removed from the user group; and

update the effective entitlement of the user to remove the group entitlement.

15. The system of claim 12 , wherein the computer-executable instructions further cause the physical processor to:

detect a change in the group entitlement; and

update the effective entitlement of the user to include the change in the group entitlement.

16. The system of claim 10 , wherein the computer-executable instructions further cause the physical processor to:

detect a change of the entitlement for the user in in the ACL for the object; and

update the effective entitlement of the user to include the change of the entitlement.

17. The system of claim 10 , wherein the computer-executable instructions further cause the physical processor to:

normalize the entitlement for the user of the ACL for the object of the content source to configured entitlements; and

normalize the other entitlement for the user in the other ACL for the other object of the other content source to the configured entitlements.

18. The system of claim 10 , wherein the computer-executable instructions further cause the physical processor to:

perform a security action using the effective entitlement of the user.

19. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at last one processor of a computing device, cause the computing device to:

obtain a user identifier from a user profile associated with a user;

determine an entitlement for the user in an access control list (ACL) for an object of a content source;

determine another entitlement for the user in another ACL for another object of another content source, wherein the content source and the other content source are associated with different systems;

generate an effective entitlement of the user by associating the user identifier, the entitlement for the user in the ACL for the object, and the other entitlement for the user in the other ACL for the other object, wherein the effective entitlement is derived from deconstructing user groups and resolving conflicting entitlements associated with the user according to a conflict resolution rue that at last one of prioritizes directly assigned entitlements over group entitlements or prioritizes group entitlements over individual entitlements;

store the effective entitlement of the user;

perform a security action using the effective entitlement of the user by modifying the effective entitlement and propagating changes in the effective entitlement to the ACL and the other ACL; and

generate a report using the effective entitlement of the user.

Assignments (12)

Continuity (1)