Charter-based access controls for managing computer resources
A system and method can provide charter-based access to resources using an object model. Charters are defined by an administrator to have certain markings, each marking indicating a control (e.g., permission, credential, qualification, constraint, requirement, etc.) that regulates work under the charter. Users are also associated with markings. A user starts a session to access the system and is authenticated. The system determines charters having markings that the user has, and these charters are provided to the user to select from. Selecting a charter allows the user access to resources associated with the charter, under the controls indicated by the markings. Charters, controls, qualifications, resources, authorizations and links between them can be implemented using an object model. Markings can control session parameters (e.g., geographic location), resource access, user credentials, qualifications, and/or data processing permissions for a group of users, simplifying project definition and revisions to controlling access under the charter.
1 . A computer system comprising:
one or more computer-readable storage devices configured to store computer-readable instructions; and
one or more processors configured to execute the computer-readable instructions to cause the computer system to:
provide, to a first user, indications of one or more charters, wherein the one or more charters are linked to respective sets of computer resources, respective sets of controls, and respective qualifications;
in response to receiving a selection of a first charter of the one or more charters, determine that qualifications associated with the first user satisfy a first qualification linked to the first charter, wherein the first qualification is a credential the first user must satisfy before gaining access to a first set of computer resources linked to the first charter; and
in response to determining that the qualifications associated with the first user satisfy the first qualification, provide the first user access to the first set of computer resources to operate in accordance with a first set of controls linked to the first charter, wherein the first set of controls is a subset of all controls authorized for the first user.
2 . The computer system of claim 1 , wherein at least a portion of the first set of controls control access to the first set of computer resources under the first charter based on parameters of a session of the first user at a time the first user is trying to access the first set of computer resources.
3 . The computer system of claim 2 , wherein at least a portion of the first set of controls control access to the first set of computer resources under the first charter based on a geographic location of the session of the first user.
4 . The computer system of claim 2 , wherein at least a portion of the first set of controls control access to first set of computer resources under the first charter based on the time of the session of the first user.
5 . The computer system of claim 2 , wherein at least a portion of the first set of controls control access to the first set of computer resources under the first charter based on identification of a computer being used by the first user for the session.
6 . The computer system of claim 1 , wherein the first set of computer resources includes at least one of: a file, a folder, a dataset, a database, a memory, a processor, a drive, a storage device, a computer, a laptop, or a phone.
7 . The computer system of claim 1 , wherein the first qualification is training that the first user must complete before gaining access to the first set of computer resources.
8 . The computer system of claim 1 , wherein the one or more processors are configured to execute the computer-readable instructions to further cause the computer system to:
determine if authorizations of the first user satisfy a first agreement associated with the first charter; and
in response to determining that the authorizations of the first user do not include the first agreement, deny providing the first user access to the first set of computer resources, and transmit data to the first user indicating how to obtain the first agreement.
9 . The computer system of claim 1 , wherein the one or more processors are configured to execute the computer-readable instructions to further cause the computer system to:
receive, from the first user, authorization information;
determine, based at least in part on the authorization information, that authorizations of the first user satisfy a first authorization associated with the first charter; and
provide the first user access to the first set of computer resources based at least in part on the determination that the authorizations of the first user satisfy the first authorization.
10 . The computer system of claim 9 , wherein the first authorization is a condition that the first user must agree to before being granted access to the first set of computer resources during a session.
11 . The computer system of claim 1 , wherein operations of the first user when accessing the first set of computer resources during a session are constrained by a control object linked to the first charter to prohibit combining information from a first computer resource and a second computer resource into the first computer resource, the second computer resource, or a third computer resource.
12 . The computer system of claim 1 , wherein the first charter is associated with audit rules that are applied to resource objects linked to the first charter, the audit rules controlling data collecting and retention for work conducted by a user under the first charter.
13 . The computer system of claim 1 , at least one of the first set of controls indicate a purpose of the first charter.
14 . The computer system of claim 1 , wherein the first qualification is an agreement the first user needs to sign before gaining access to the set of computer resources associated with the first charter.
15 . The computer system of claim 1 , wherein the first qualification is an approval by a data owner that the first user needs to obtain before gaining access to the first set of computer resources associated with the first charter.
16 . A computer-implemented method comprising, by one or more processors executing program instructions:
providing, to a first user, indications of one or more charters, wherein the one or more charters are linked to respective sets of computer resources, respective sets of controls, and respective qualifications;
in response to receiving a selection of a first charter of the one or more charters, determining that qualifications associated with the first user satisfy a first qualification linked to the first charter, wherein the first qualification is a credential the first user must satisfy before gaining access to a first set of computer resources linked to the first charter; and
in response to determining that the qualifications associated with the first user satisfy the first qualification, providing the first user access to the first set of computer resources to operate in accordance with a first set of controls linked to the first charter, wherein the first set of controls is a subset of all controls authorized for the first user.
17 . The computer-implemented method of claim 16 , wherein at least a portion of the first set of controls control access to the first set of computer resources under the first charter based on parameters of a session of the first user at a time the first user is trying to access the first set of computer resources.
18 . The computer-implemented method of claim 16 , wherein the first qualification is training that the first user must complete before gaining access to the first set of computer resources.
19 . The computer-implemented method of claim 16 further comprising, by one or more processors executing program instructions:
determining if authorizations of the first user satisfy a first agreement associated with the first charter; and
in response to determining that the authorizations of the first user do not include the first agreement, denying providing the first user access to the first set of computer resources, and transmit data to the first user indicating how to obtain the first agreement.
20 . A computer program product comprising one or more computer-readable storage mediums having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to:
provide, to a first user, indications of one or more charters, wherein the one or more charters are linked to respective sets of computer resources, respective sets of controls, and respective qualifications;
in response to receiving a selection of a first charter of the one or more charters, determine that qualifications associated with the first user satisfy a first qualification linked to the first charter, wherein the first qualification is a credential the first user must satisfy before gaining access to a first set of computer resources linked to the first charter; and
in response to determining that the qualifications associated with the first user satisfy the first qualification, provide the first user access to the first set of computer resources to operate in accordance with a first set of controls linked to the first charter, wherein the first set of controls is a subset of all controls authorized for the first user.