Granted Patent B1

US 11,765,159 · App. 17/954,697 · Granted Sep 19, 2023

Inventors: Britt Vandermast Crawford (Bend, OR); Philip D. Hassey (Rye, CO); Alexander Chidi Okafor (Kennesaw, GA)

Assignee: strongDM, Inc.

H04L63/0853

Abstract

Claims (150)

1. A method for managing access to network resources in a network using one or more processors that are configured to execute instructions that are configured to cause actions, wherein the execution of the instructions, by the one or more processors, enables performance of actions, comprising:

employing an overlay network for one or more network connections to provide one or more secure tunnels between one or more clients and one or more resources; and

in response to a privilege evaluation event, performing further actions, including:

determining one or more sessions associated with the one or more secure tunnels;

determining one or more users and a portion of the one or more resources based on the one or more sessions, wherein each determined user and each determined resource are associated with a same session;

comparing privilege information associated with each determined user with one or more privilege requirements associated with each determined resource; and

in response to determining one or more mismatches of the privilege information and the one or more privilege requirements based on the comparison, performing further actions, including:

determining one or more revocable sessions based on the one or more mismatches; and

providing one or more revoke messages to one or more agents, wherein the one or more agents close one or more portions of the network connections associated with the one or more revocable sessions by sending one or more communication protocol messages to infrastructure for a communication protocol layer to terminate the one or more portions of the network connections.

2. The method of claim 1 , wherein comparing privilege information associated with each determined user with the one or more privilege requirements associated with each determined resource further comprises:

determining a role that is associated with each determined user, wherein the privilege information is associated with the role;

determining one or more user privilege attributes for each determined user from the privilege information associated with the role associated with each user;

determining a resource type that is associated with each determined resource, wherein the one or more privilege requirements are associated with the resource type;

determining one or more resource privilege attributes for each determined resource from the one or more privilege requirements associated with the resource requirements associated with each resource; and

determining the one or more mismatches based on one or more of one or more resource privilege attributes being absent from the one or more user privilege attributes.

3. The method of claim 1 , further comprises:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

determining one or more session identifiers that are included in the one or more revoke messages;

determining the one or more portions of the network connections associated with the one or more session identifiers; and

employing the one or more communication protocol messages to terminate the one or more portions of the network connections.

4. The method of claim 1 , further comprises:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

terminating the one or more portions of the network connections associated with the one or more revoke messages;

determining one or more other agents in the overlay network based on a proximity of the one or more agents to the one or more other agents; and

forwarding the one or more revoke messages from the one or more agents to the one or more other agents.

5. The method of claim 1 , further comprising:

in response to an expiry of a timeout associated with a session, an agent performs further actions, including:

determining a session identifier associated with the expired timeout;

communicating a re-authorization request to an infrastructure security computer (ISC), wherein the re-authorization request includes the session identifier; and

in response to non-authorization by the ISC for the re-authorization request, terminating the session.

6. The method of claim 1 , further comprising:

in response to one or more of privilege information associated with a user being modified or one or more privilege requirements associated with the one or more resources being modified, initiating the privilege evaluation event.

7. The method of claim 1 , further comprising:

in response to an expiry of a scheduled time duration, initiating the privilege evaluation event.

8. The method of claim 1 , further comprising:

in response to a lifetime of a session exceeding a threshold value, initiating the privilege evaluation event.

9. A system for method for managing access to network resources, comprising:

a network computer, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that are configured to cause performance of actions, including:

employing an overlay network for one or more network connections to provide one or more secure tunnels between one or more clients and one or more resources; and

in response to a privilege evaluation event, performing further actions, including:

determining one or more sessions associated with the one or more secure tunnels;

determining one or more users and a portion of the one or more resources based on the one or more sessions, wherein each determined user and each determined resource are associated with a same session;

comparing privilege information associated with each determined user with one or more privilege requirements associated with each determined resource; and

in response to determining one or more mismatches of the privilege information and the one or more privilege requirements based on the comparison, performing further actions, including:

 determining one or more revocable sessions based on the one or more mismatches; and

 providing one or more revoke messages to one or more agents,

wherein the one or more agents close one or more portions of the network connections associated with the one or more revocable sessions by sending one or more communication protocol messages to infrastructure for a communication protocol layer to terminate the one or more portions of the network connections; and

a client computer, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

initiating the privilege evaluation event.

10. The system of claim 9 , wherein comparing privilege information associated with each determined user with the one or more privilege requirements associated with each determined resource further comprises:

determining a role that is associated with each determined user, wherein the privilege information is associated with the role;

determining one or more user privilege attributes for each determined user from the privilege information associated with the role associated with each user;

determining a resource type that is associated with each determined resource, wherein the one or more privilege requirements are associated with the resource type;

determining one or more resource privilege attributes for each determined resource from the one or more privilege requirements associated with the resource requirements associated with each resource; and

determining the one or more mismatches based on one or more of one or more resource privilege attributes being absent from the one or more user privilege attributes.

11. The system of claim 9 , wherein the one or more network computer processors execute instructions that perform further actions comprising:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

determining one or more session identifiers that are included in the one or more revoke messages;

determining the one or more portions of the network connections associated with the one or more session identifiers; and

employing the one or more communication protocol messages to terminate the one or more portions of the network connections.

12. The system of claim 9 , wherein the one or more network computer processors execute instructions that perform further actions comprising:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

terminating the one or more portions of the network connections associated with the one or more revoke messages;

determining one or more other agents in the overlay network based on a proximity of the one or more agents to the one or more other agents; and

forwarding the one or more revoke messages from the one or more agents to the one or more other agents.

13. The system of claim 9 , wherein the one or more network computer processors execute instructions that perform further actions comprising:

in response to an expiry of a timeout associated with a session, an agent performs further actions, including:

determining a session identifier associated with the expired timeout;

communicating a re-authorization request to an infrastructure security computer (ISC), wherein the re-authorization request includes the session identifier; and

in response to non-authorization by the ISC for the re-authorization request, terminating the session.

14. The system of claim 9 , wherein the one or more network computer processors execute instructions that perform further actions comprising:

in response to one or more of privilege information associated with a user being modified or one or more privilege requirements associated with the one or more resources being modified, initiating the privilege evaluation event.

15. The system of claim 9 , wherein the one or more network computer processors execute instructions that perform further actions comprising:

in response to an expiry of a scheduled time duration, initiating the privilege evaluation event.

16. The system of claim 9 , wherein the one or more network computer processors execute instructions that perform further actions comprising:

in response to a lifetime of a session exceeding a threshold value, initiating the privilege evaluation event.

17. A processor readable non-transitory storage media that includes instructions that are configured to cause actions for managing access to network resources over a network, wherein execution of the instructions by one or more processors on one or more network computers causes performance of actions, comprising:

employing an overlay network for one or more network connections to provide one or more secure tunnels between one or more clients and one or more resources; and

in response to a privilege evaluation event, performing further actions, including:

determining one or more sessions associated with the one or more secure tunnels;

determining one or more users and a portion of the one or more resources based on the one or more sessions, wherein each determined user and each determined resource are associated with a same session;

comparing privilege information associated with each determined user with one or more privilege requirements associated with each determined resource; and

in response to determining one or more mismatches of the privilege information and the one or more privilege requirements based on the comparison, performing further actions, including:

determining one or more revocable sessions based on the one or more mismatches; and

providing one or more revoke messages to one or more agents, wherein the one or more agents close one or more portions of the network connections associated with the one or more revocable sessions by sending one or more communication protocol messages to infrastructure for a communication protocol layer to terminate the one or more portions of the network connections.

18. The media of claim 17 , wherein comparing privilege information associated with each determined user with the one or more privilege requirements associated with each determined resource further comprises:

determining a role that is associated with each determined user, wherein the privilege information is associated with the role;

determining one or more user privilege attributes for each determined user from the privilege information associated with the role associated with each user;

determining a resource type that is associated with each determined resource, wherein the one or more privilege requirements are associated with the resource type;

determining one or more resource privilege attributes for each determined resource from the one or more privilege requirements associated with the resource requirements associated with each resource; and

determining the one or more mismatches based on one or more of one or more resource privilege attributes being absent from the one or more user privilege attributes.

19. The media of claim 17 , further comprises:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

determining one or more session identifiers that are included in the one or more revoke messages;

determining the one or more portions of the network connections associated with the one or more session identifiers; and

employing the one or more communication protocol messages to terminate the one or more portions of the network connections.

20. The media of claim 17 , further comprises:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

terminating the one or more portions of the network connections associated with the one or more revoke messages;

determining one or more other agents in the overlay network based on a proximity of the one or more agents to the one or more other agents; and

forwarding the one or more revoke messages from the one or more agents to the one or more other agents.

21. The media of claim 17 , further comprising:

in response to an expiry of a timeout associated with a session, an agent performs further actions, including:

determining a session identifier associated with the expired timeout;

communicating a re-authorization request to an infrastructure security computer (ISC), wherein the re-authorization request includes the session identifier; and

in response to non-authorization by the ISC for the re-authorization request, terminating the session.

22. The media of claim 17 , further comprising:

in response to one or more of privilege information associated with a user being modified or one or more privilege requirements associated with the one or more resources being modified, initiating the privilege evaluation event.

23. The media of claim 17 , further comprising:

in response to a lifetime of a session exceeding a threshold value, initiating the privilege evaluation event.

24. A network computer for managing access to network resources, comprising:

a memory that stores at least instructions that are configured to cause actions; and

one or more processors that execute the instructions to cause that performance of actions, including:

employing an overlay network for one or more network connections to provide one or more secure tunnels between one or more clients and one or more resources; and

in response to a privilege evaluation event, performing further actions, including:

determining one or more sessions associated with the one or more secure tunnels;

determining one or more users and a portion of the one or more resources based on the one or more sessions, wherein each determined user and each determined resource are associated with a same session;

comparing privilege information associated with each determined user with one or more privilege requirements associated with each determined resource; and

in response to determining one or more mismatches of the privilege information and the one or more privilege requirements based on the comparison, performing further actions, including:

determining one or more revocable sessions based on the one or more mismatches; and

providing one or more revoke messages to one or more agents, wherein the one or more agents close one or more portions of the network connections associated with the one or more revocable sessions by sending one or more communication protocol messages to infrastructure for a communication protocol layer to terminate the one or more portions of the network connections.

25. The network computer of claim 24 , wherein comparing privilege information associated with each determined user with the one or more privilege requirements associated with each determined resource further comprises:

determining a role that is associated with each determined user, wherein the privilege information is associated with the role;

determining one or more user privilege attributes for each determined user from the privilege information associated with the role associated with each user;

determining a resource type that is associated with each determined resource, wherein the one or more privilege requirements are associated with the resource type;

determining one or more resource privilege attributes for each determined resource from the one or more privilege requirements associated with the resource requirements associated with each resource; and

determining the one or more mismatches based on one or more of one or more resource privilege attributes being absent from the one or more user privilege attributes.

26. The network computer of claim 24 , wherein the one or more processors execute instructions that perform actions, further comprising:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

determining one or more session identifiers that are included in the one or more revoke messages;

determining the one or more portions of the network connections associated with the one or more session identifiers; and

employing the one or more communication protocol messages to terminate the one or more portions of the network connections.

27. The network computer of claim 24 , wherein the one or more processors execute instructions that perform actions, further comprising:

in response to being provided the one or more revoke messages, the one or more agents perform further actions, including:

terminating the one or more portions of the network connections associated with the one or more revoke messages;

determining one or more other agents in the overlay network based on a proximity of the one or more agents to the one or more other agents; and

forwarding the one or more revoke messages from the one or more agents to the one or more other agents.

28. The network computer of claim 24 , wherein the one or more processors execute instructions that perform actions, further comprising:

in response to an expiry of a timeout associated with a session, an agent performs further actions, including:

determining a session identifier associated with the expired timeout;

communicating a re-authorization request to an infrastructure security computer (ISC), wherein the re-authorization request includes the session identifier; and

in response to non-authorization by the ISC for the re-authorization request, terminating the session.

29. The network computer of claim 24 , wherein the one or more processors execute instructions that perform actions, further comprising:

in response to one or more of privilege information associated with a user being modified or one or more privilege requirements associated with the one or more resources being modified, initiating the privilege evaluation event.

30. The network computer of claim 24 , wherein the one or more processors execute instructions that perform actions, further comprising:

in response to an expiry of a scheduled time duration, initiating the privilege evaluation event.

Assignments (2)

Cited By (9)

US 12,242,599 US 12,284,224 US 12,348,519 US 12,355,770 US 12,423,418 US 12,432,242 US 12,603,921 US 12,670,246 US 12,695,793