Automated methods and systems for granting complex permissions
A permissions management system (PMS) defines the permissions associated with a user and thereby the activities the user can perform with any specific object and/or application or class of objects and/or applications. However, such a PMS requires an administrator to either authorise each permission individually or default permissions to a configuration previously established. The former is time consuming and the latter does not eliminate the former in establishing the roles initially or new roles or custom configurations. According, methods and systems for automating the establishment of permissions and their ongoing maintenance are presented based upon an initial discovery phase of actions performed by either the user or an administrator followed by an automated harmonization phase and a verification phase. This verification phase may employ human interactions or be automated exploiting an artificial intelligence engine.
1. A method comprising:
establishing upon a system comprising at least a microprocessor an impersonation role as a delegated user for an impersonator where the delegated user is associated with a user of the system;
executing by the impersonator a session as the delegated user;
simulating a plurality of actions within the session undertaken by the impersonator within the session where each action is an action to be performed by the user and is associated with an object forming part of the system, a permission for performing the action upon the object, and a context of the action upon the object;
harmonizing with the system the objects, permissions and contexts associated with the plurality of actions; and
establishing a subset of the harmonized objects, permissions, and contexts as a profile for the user.
2. The method according to claim 1 , wherein
at least one of:
the impersonator is at least one of an administrator of the system, another user of the system and an artificial intelligence engine; and
the session executed by the impersonator has an initial default set of permissions.
3. The method according to claim 1 , wherein
the subset of the harmonized objects, permissions, and contexts were established from the objects, permissions, and contexts with a first verification process; wherein
the first verification process is performed by at least one of an administrator of the system, the impersonator and another user of the system;
the first verification process comprises:
rendering the harmonized objects, permissions, and contexts to the impersonator; and
receiving one or more indications from the impersonator upon the system; wherein
each indication of the one or more indications relates to a portion of the harmonized objects, permissions, and contexts; and
the portions of the harmonized objects, permissions, and contexts represent the verified subset of the harmonized objects, permissions, and contexts.
4. The method according to claim 1 , further comprising
establishing verification of a subset of the harmonized objects, permissions, and contexts with a first verification process; wherein
the first verification process comprises:
providing the harmonized objects, permissions, and contexts to an artificial intelligence engine; and
receiving one or more indications from the artificial intelligence system; wherein
each indication of the one or more indications relates to a portion of the harmonized objects, permissions, and contexts; and
the portions of the harmonized objects, permissions, and contexts represent the verified subset of the harmonized objects, permissions, and contexts.
5. The method according to claim 4 , wherein
the artificial intelligence engine applies one or more rules established in dependence upon processing within a training phase a training set of user profiles, each user profile of the set of user profiles comprising a set of objects, permissions and contexts.
6. The method according to claim 1 , further comprising:
executing an automatic monitoring phase with respect to the profile of the user based upon actions of the user upon the system;
consolidating accumulated data on the objects, permissions and contexts employed by the user during the automatic monitoring phase; and
modifying the profile of the user by applying a process comprising:
removing unused objects, permissions and objects from the profile of the user in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user; and
adding new objects, permissions and objects established in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user and a second verification process; wherein
the second verification process comprises:
establishing modifications to the objects, permissions, and contexts which are either new objects, permissions, and contexts or amendments to objects, permissions, and contexts within the current profile of the user;
rendering the modifications to the objects, permissions, and contexts to the impersonator; and
receiving one or more indications from the impersonator upon the system; wherein
each indication of the one or more indications relates to a portion of the modifications to the objects, permissions, and contexts to accept; and
updating the profile of the user with those portions of the modifications to the objects, permissions, and contexts associated with each indication of the one or more indications.
7. The method according to claim 1 , further comprising:
executing an automatic monitoring phase with respect to the profile of the user based upon actions of the user upon the system; and
consolidating accumulated data on the objects, permissions and contexts employed by the user during the automatic monitoring phase; and
modifying the profile of the user by applying a process comprising:
removing unused objects, permissions and objects from the profile of the user in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user; and
adding new objects, permissions and objects established in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user and a second verification process; wherein
the second verification process comprises:
establishing modifications to the objects, permissions, and contexts which are either new objects, permissions, and contexts or amendments to objects, permissions, and contexts within the current profile of the user;
providing the modifications to the objects, permissions, and contexts to another artificial intelligence engine; and
receiving one or more indications from the other artificial intelligence system; wherein
each indication of the one or more indications relates to a portion of the modifications to the objects, permissions, and contexts to accept; and
updating the profile of the user with those portions of the modifications to the objects, permissions, and contexts associated with each indication of the one or more indications.
8. The method according to claim 1 , wherein
an object is an element of a remote access system;
the permission relates to use of a software application provided by a virtual machine in execution upon the remote access system; and
the context relates to the user when using the software application.
9. A method comprising:
establishing upon a system comprising at least a microprocessor a training session for a user of the system by an impersonator of the system;
executing the training session by the user;
monitoring a plurality of actions within the session undertaken by the user within the training session where each action is an action associated with an object forming part of the system, a permission for performing the action upon the object, and a context of the action upon the object;
harmonizing with the system the objects, permissions and contexts associated with the plurality of actions;
establishing verification of a subset of the harmonized objects, permissions, and contexts with a first verification process; and
establishing the subset of the harmonized objects, permissions, and contexts verified by the administrator as a profile for the user.
10. The method according to claim 9 , wherein
at least one of:
the impersonator is at least one of an administrator of the system, another user of the system and an artificial intelligence engine; and
the training session executed by the user has an initial default set of permissions.
11. The method according to claim 9 , further comprising
establishing verification of a subset of the harmonized objects, permissions, and contexts with a first verification process; wherein
the first verification process is performed by at least one of an administrator of the system and another user of the systems;
the first verification process comprises:
rendering the harmonized objects, permissions, and contexts to the impersonator; and
receiving one or more indications from the impersonator upon the system; wherein
each indication of the one or more indications relates to a portion of the harmonized objects, permissions, and contexts; and
the portions of the harmonized objects, permissions, and contexts represent the verified subset of the harmonized objects, permissions, and contexts.
12. The method according to claim 9 , further comprising
establishing verification of a subset of the harmonized objects, permissions, and contexts with a first verification process; wherein
the first verification process comprises:
providing the harmonized objects, permissions, and contexts to an artificial intelligence engine; and
receiving one or more indications from the artificial intelligence system; wherein
each indication of the one or more indications relates to a portion of the harmonized objects, permissions, and contexts; and
the portions of the harmonized objects, permissions, and contexts represent the verified subset of the harmonized objects, permissions, and contexts.
13. The method according to claim 12 , wherein
the artificial intelligence engine applies one or more rules established in dependence upon processing within a training phase a training set of user profiles, each user profile of the set of user profiles comprising a set of objects, permissions and contexts.
14. The method according to claim 9 , further comprising:
executing an automatic monitoring phase with respect to the profile of the user based upon actions of the user upon the system; and
consolidating accumulated data on the objects, permissions and contexts employed by the user during the automatic monitoring phase; and
modifying the profile of the user by applying a process comprising:
removing unused objects, permissions and objects from the profile of the user in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user; and
adding new objects, permissions and objects established in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user and a second verification process; wherein
the second verification process comprises:
establishing modifications to the objects, permissions, and contexts which are either new objects, permissions, and contexts or amendments to objects, permissions, and contexts within the current profile of the user;
rendering the modifications to the objects, permissions, and contexts to the impersonator; and
receiving one or more indications from the impersonator upon the system; wherein
each indication of the one or more indications relates to a portion of the modifications to the objects, permissions, and contexts to accept; and
updating the profile of the user with those portions of the modifications to the objects, permissions, and contexts associated with each indication of the one or more indications.
15. The method according to claim 9 , further comprising:
executing an automatic monitoring phase with respect to the profile of the user based upon actions of the user upon the system; and
consolidating accumulated data on the objects, permissions and contexts employed by the user during the automatic monitoring phase; and
modifying the profile of the user by applying a process comprising:
removing unused objects, permissions and objects from the profile of the user in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user; and
adding new objects, permissions and objects established in dependence upon the consolidated accumulated data on the objects, permissions and contexts employed by the user and a second verification process; wherein
the second verification process comprises:
establishing modifications to the objects, permissions, and contexts which are either new objects, permissions, and contexts or amendments to objects, permissions, and contexts within the current profile of the user;
providing the modifications to the objects, permissions, and contexts to another artificial intelligence engine; and
receiving one or more indications from the other artificial intelligence system; wherein
each indication of the one or more indications relates to a portion of the modifications to the objects, permissions, and contexts to accept; and
updating the profile of the user with those portions of the modifications to the objects, permissions, and contexts associated with each indication of the one or more indications.
16. The method according to claim 15 , wherein
an object is an element of a remote access system;
the permission relates to use of a software application provided by a virtual machine in execution upon the remote access system; and
the context relates to the user when using the software application.