System and method for controlling access to project data and to computing resources therefor
A server device, system, method, and for controlling access to project resources is disclosed. The disclosure includes a processor, and a communications module and a memory coupled to the processor. The memory, when executed by the processor, causes the processor to generate a plurality of zones for a project, each zone defining a set of access rights to: i) a database; and ii) at least one tool. The processor configures each set of access rights to allow a proxy service to access the zones, and receives, from a client device and via the proxy service, an access query to access at least one zone. The processor provides the client device access to, via the proxy service, the at least one dataset and at least one tool of the at least one zone.
1. A system for controlling access to project data, the system comprising at least one server device comprising:
a processor;
a communications module coupled to the processor; and
a memory coupled to the processor, the memory storing computer executable instructions that when executed by the processor cause the at least one server device to:
determine a plurality of zones that have been generated for a project, each zone defining a set of access rights to project data associated with that project;
configure each set of access rights associated with a zone to allow a proxy service to access the project data for that zone;
provide the proxy service with a configuration for each set of access rights, the configuration defining one or more criteria to determine whether client devices are permitted to access the corresponding zone;
receive, from the proxy service for a client device, a data access query to access at least one zone of the plurality of zones;
determine, via the proxy service, that the client device is permitted to access the at least one zone; and
provide the client device access to, via the proxy service, the project data for the at least one zone specified in the data access query.
2. The system of claim 1 , wherein the project data comprises at least one dataset in a database associated with the project.
3. The system of claim 2 , wherein the project data comprises at least one tool configured to operate on the at least one dataset.
4. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
in response to access to the project data being granted via the proxy service, dynamically mask at least one dataset based on a policy defined for the at least one zone according to which of the at least one dataset is accessed.
5. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
redirect data access queries to the plurality of zones from the client device to the proxy service.
6. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
update the unique set of access rights or a data masking policy associated with at least one dataset of the project data, based on a status of the project.
7. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
associate the client device, within the proxy service, with at least one further zone of another project.
8. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
associate the client device, within the proxy service, with more than one zone of the plurality of zones in the project simultaneously.
9. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
update the proxy service to disassociate the client device and a zone of the plurality of zones to remove access by the client device to the zone.
10. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
generate a further zone;
assign the further zone to the project, wherein the further zone has a subset of the access rights of the at least one zone; and
assign at least one client device to the further zone, preventing the at least one client device from having all access rights associated with the at least one zone.
11. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
modify the unique set of access rights for the at least one zone, changing access rights to either at least one dataset or at least one tool of the project data for all client devices associated with the at least one zone.
12. The system of claim 1 , wherein a dataset of the project data is hosted on a jump server, and the dataset is directly accessible by a desktop client tool to mitigate client device security characteristics.
13. The system of claim 1 , wherein the computer executable instructions further cause the processor to:
update the unique set of access rights to remove access, via the proxy service, to the at least one zone, removing the at least one zone from the project.
14. A method of controlling access to project data, the method executed by at least one server device and comprising:
determining a plurality of zones that have been generated for a project, each zone defining a set of access rights to project data associated with that project;
configuring each set of access rights associated with a zone to allow a proxy service to access the project data for that zone;
providing the proxy service with a configuration for each set of access rights, the configuration defining one or more criteria to determine whether client devices are permitted to access the corresponding zone;
receiving, from the proxy service for a client device, a data access query to access at least one zone of the plurality of zones;
determining, via the proxy service, that the client device is permitted to access the at least one zone; and
providing the client device access to, via the proxy service, the project data for the at least one zone specified in the data access query.
15. The method of claim 14 , wherein the project data comprises at least one dataset in a database associated with the project.
16. The method of claim 15 , wherein the project data comprises at least one tool configured to operate on the at least one dataset.
17. The method of claim 14 , further comprising:
in response to access to the project data being granted via the proxy service, dynamically masking at least one dataset based on a policy defined for the at least one zone according to which of the at least one dataset is accessed.
18. The method of claim 14 , further comprising:
redirecting data access queries to the plurality of zones from the client device to the proxy service.
19. The method of claim 14 , further comprising:
updating the unique set of access rights or a data masking policy associated with at least one dataset of the project data, based on a status of the project.
20. A non-transitory computer readable medium for controlling access to project data, the computer readable medium comprising computer executable instructions for:
determining a plurality of zones that have been generated for a project, each zone defining a set of access rights to project data associated with that project;
configuring each set of access rights associated with a zone to allow a proxy service to access the project data for that zone;
providing the proxy service with a configuration for each set of access rights, the configuration defining one or more criteria to determine whether client devices are permitted to access the corresponding zone;
receiving, from the proxy service for a client device, a data access query to access at least one zone of the plurality of zones;
determining, via the proxy service, that the client device is permitted to access the at least one zone; and
providing the client device access to, via the proxy service, the project data for the at least one zone specified in the data access query.