Systems and methods for data driven infrastructure access control
In one embodiment, in access gateway comprising at least one computer processor, a method for real-time data protection may include: (1) receiving a user login comprising a user identifier; (2) retrieving, using an in-memory entitlements graph, a role definition for the user identifier, wherein the role definition comprises allowed actions, entitled assets, and a system account; (3) receiving a selection of a requested asset from the entitled assets and a requested action from the allowed actions; (4) verifying the user's entitlement to access the requested asset and perform the requested action with the system account using the in-memory entitlement graph based on the user identifier, the system account, the requested asset, and the requested action; and (5) authorizing the user's entitlement to access the requested asset and perform the requested action with the system account substantially at a time of requested access.
1. A method for real-time data protection, comprising:
in an access gateway comprising at least one computer processor:
receiving a user login comprising a user identifier;
retrieving, using an in-memory entitlements graph, a role definition for the user identifier, wherein the role definition comprises allowed actions, entitled assets, and a system account;
receiving a selection of a requested asset from the entitled assets and a requested action from the allowed actions;
verifying the user's entitlement to access the requested asset and perform the requested action with the system account using the in-memory entitlement graph based on the user identifier, the system account, the requested asset, and the requested action, wherein the in-memory entitlement graph validates organizational changes and incident management controls; and
authorizing the user's entitlement to access the requested asset and perform the requested action with the system account substantially at a time of requested access.
2. The method of claim 1 , further comprising:
performing a step-up validation against a regulation, policy, or law.
3. The method of claim 1 , wherein the in-memory entitlements graph is based on linking common information from human resources data, entitlement data, and policy data.
4. The method of claim 1 , further comprising:
establishing a session with the requested resource; and
logging user actions during the session.
5. The method of claim 1 , wherein the user identifier comprises a UserId.
6. The method of claim 1 , wherein the access gateway authenticates the user.
7. The method of claim 1 , wherein the asset comprises a database instance or an application instance.
8. The method of claim 1 , wherein the asset comprises a business flow or a data object.
9. The method of claim 1 , wherein the user's entitlement to access the requested asset and perform the requested action with the system account substantially at the time of requested access is authorized with the in-memory entitlement graph.
10. The method of claim 1 , further comprising:
updating the in-memory entitlement graph.
11. A system for real-time data protection, comprising:
an access gateway comprising at least one computer processor and executing a gateway computer program;
a user access device;
a plurality of assets; and
an in-memory entitlement graph;
wherein:
the gateway computer program receives a user login comprising a user identifier from the user access device;
the gateway computer program retrieves a role definition for the user identifier from the in-memory entitlement graph, wherein the role definition comprises allowed actions, entitled assets, and a system account;
the gateway computer program receives a selection of a requested asset from the entitled assets and a requested action from the allowed actions from the user access device;
the gateway computer program verifies the user's entitlement with the in-memory entitlement graph based on the user identifier, the system account, the requested asset, and the requested action, wherein the in-memory entitlement graph validates organizational changes and incident management controls; and
the gateway computer program authorizes the user's entitlement to access the requested asset and perform the requested action with the system account substantially at a time of requested access.
12. The system of claim 11 , wherein the gateway computer program performs a step-up validation against a regulation, policy, or law.
13. The system of claim 11 , wherein the in-memory entitlements graph is based on linking common information from human resources data, entitlement data, and policy data.
14. The system of claim 11 , wherein the access gateway establishes a session with the requested resource and logs user actions during the session.
15. The system of claim 11 , wherein the user identifier comprises a UserId.
16. The system of claim 11 , wherein the access gateway authenticates the user.
17. The system of claim 11 , wherein the asset comprises a database instance or an application instance.
18. The system of claim 11 , wherein the asset comprises a business flow or a data object.
19. The system of claim 11 , wherein the user's entitlement to access the requested asset and perform the requested action with the system account substantially at the time of requested access is authorized with the in-memory entitlement graph.
20. The system of claim 11 , wherein the in-memory entitlement graph is updated.