Data protection with online account validation
Methods, systems, and computer programs are presented for validating accounts in an online service. One method includes an operation for determining if accounts in an online service are valid and compliant, which includes checking one or more compliance conditions defined for the account. Further, the method includes operations for storing, in a cache memory, information for the accounts that are determined to be valid and compliant, and for receiving a request for information for one or more of the accounts. The method further includes operations for accessing the cache memory to obtain information for the at least one account, the information comprising an indication if the account is valid and compliant. Access to the information is blocked for the accounts associated with the request that are not valid and compliant. The method includes returning, for the accounts that are valid and compliant, the obtained information in response to the request.
1 . A computer-implemented method comprising:
determining if a plurality of accounts in an online service are valid by verifying whether the plurality of accounts are active and whether users are enabled to access the accounts;
determining if the plurality of accounts are compliant by checking one or more compliance conditions defined for the account, a compliance condition being a rule that must be satisfied for access to be enabled in the account;
storing, during a periodic validation and in a valid-account cache memory, information for only the accounts that are determined to be valid and compliant;
receiving, via an application programming interface (API), a request for information for at least one account of the plurality of accounts from the valid-account cache memory;
accessing, based on the request, the valid-account cache memory to obtain the information for the at least one account, the information comprising an indication if the account is valid and compliant stored during the periodic validation;
blocking access to at least one resource for the accounts associated with the request that are not both valid and compliant; and
permitting access, for the accounts associated with the request that are valid and compliant, to the at least one resource in response to the request.
2 . The method as recited in claim 1 , wherein a first compliance condition includes that data for the account is stored in a predefined geographical area.
3 . The method as recited in claim 1 , wherein a second compliance condition includes checking that the account is in an appropriate subscription, for the online service, the subscription being a collection of resources in the online service.
4 . The method as recited in claim 1 , wherein a third compliance condition includes checking that resources available in the account are authorized for use by a user.
5 . The method as recited in claim 1 , wherein the account is compliant when all the compliance conditions are met and the account is not compliant when at least one compliance condition is not met.
6 . The method as recited in claim 1 , further comprising:
providing a user interface for adding, deleting, and changing compliance rules used for checking compliance.
7 . The method as recited in claim 1 , further comprising:
generating a notification for accounts that are not determined to be valid and compliant.
8 . The method as recited in claim 1 , wherein the determining if the plurality of accounts in an online service are valid and compliant is performed periodically.
9 . The method as recited in claim 1 , further comprising:
enabling a read operation for one account when the account is valid and compliant.
10 . The method as recited in claim 1 , wherein a user with an authorized login and password will not be enabled to access the account when the account is not valid and the user will not be enabled to access the account when the account is not compliant.
11 . The method as recited in claim 1 , wherein the API provides options for:
retrieving information for the plurality of accounts, retrieving information for one account of the plurality of accounts, and retrieving information for a subset of accounts from the plurality of accounts.
12 . The method as recited in claim 1 , further comprising:
performing statistical analysis of a state of the valid accounts; and
presenting results of the statistical analysis.
13 . A system comprising
a memory including instructions stored thereon;
processing circuitry coupled to the memory, the processing circuitry configured to execute the instructions, the instructions, when executed cause the processing circuitry to perform operations comprising:
determining if a plurality of accounts in an online service are valid by verifying whether the plurality of accounts are active and whether users are enabled to access the accounts;
determining if the plurality of accounts are compliant by checking one or more compliance conditions defined for the account, a compliance condition being a rule that must be satisfied for access to be enabled in the account;
storing, during a periodic validation and in a valid-account cache memory, information for only the accounts that are determined to be valid and compliant;
receiving, via an application programming interface (API), a request for information for at least one account of the plurality of accounts from the valid-account cache memory;
accessing, based on the request, the valid-account cache memory to obtain the information for the at least one account, the information comprising an indication if the account is valid and compliant stored during the periodic validation;
blocking access to information for the accounts associated with the request that are not both valid and compliant; and
returning, for the accounts associated with the request that are valid and compliant, the obtained information in response to the request.
14 . At least one non-transitory machine-readable media including instructions that, when executed by a machine, cause the machine to perform operations comprising:
determining if a plurality of accounts in an online service are valid by verifying whether the plurality of accounts are active and whether users are enabled to access the accounts;
determining if the plurality of accounts are compliant by checking one or more compliance conditions defined for the account, a compliance condition being a rule that must be satisfied for access to be enabled in the account;
storing, during a periodic validation and in a valid-account cache memory, information for only the accounts that are determined to be valid and compliant;
receiving, via an application programming interface (API), a request for information for at least one account of the plurality of accounts from the valid-account cache memory;
accessing, based on the request, the valid-account cache memory to obtain the information for the at least one account, the information comprising an indication if the account is valid and compliant stored during the periodic validation;
blocking access to information for the accounts associated with the request that are not both valid and compliant; and
returning, for the accounts associated with the request that are valid and compliant, the obtained information in response to the request.
15 . The at least one non-transitory machine-readable media as recited in claim 14 , wherein a first compliance condition includes that data for the account is stored in a predefined geographical area.
16 . The at least one non-transitory machine-readable media as recited in claim 14 , wherein a second compliance condition includes checking that the account is in an appropriate subscription, for the online service, the subscription being a collection of resources in the online service.
17 . The at least one non-transitory machine-readable media as recited in claim 14 , wherein a third compliance condition includes checking that resources available in the account are authorized for use by a user.
18 . The at least one non-transitory machine-readable media as recited in claim 14 , wherein the operations further comprise associating compliance conditions with the accounts based on a type of the account.
19 . The at least one non-transitory machine-readable media as recited in claim 14 , wherein determining if a plurality of accounts in an online service are valid includes performing at least one validation check on the plurality of accounts including trying to access an arbitrary resource of the account which fails if the account is invalid or non-compliant.