Privilege graph-based representation of data access authorizations
The technology disclosed herein enables representation of data access authorizations using a privilege graph. In a particular embodiment, a method includes identifying first attributes of a first user. The method further includes traversing nodes of a privilege graph using the first attributes to determine subsequent nodes until one or more nodes representing a first subset of environments of a plurality of data environments is reached. The method also includes authorizing the first user to access the first subset.
1. A method for privilege graph-based representation of data access authorizations, the method comprising:
identifying first attributes of a first user;
performing a traversal of nodes of a privilege graph using the first attributes to determine subsequent nodes until one or more first nodes representing a first subset of environments of a plurality of data environments is reached, wherein the traversal passes through at least one parent node of the one or more first nodes, wherein the at least one parent node represents one or more privileges, and wherein the first user has the one or more privileges with respect to the first subset of environments as indicated by the traversal passing through the at least one parent node before reaching the first subset of environments; and
authorizing the first user to access the first subset.
2. The method of claim 1 , comprising:
identifying second attributes of a second user;
performing a second traversal of the nodes of the privilege graph using the second attributes to determine subsequent nodes until one or more second nodes representing a second subset of environments of the plurality of data environments is reached, wherein the second subset is different than the first subset; and
authorizing the second user to access the second subset.
3. The method of claim 1 , comprising:
displaying the privilege graph to an administrator authorized to view the privilege graph.
4. The method of claim 3 , comprising:
receiving a Boolean search query from the administrator; and
displaying a portion of the privilege graph that satisfies the Boolean search query.
5. The method of claim 1 , comprising:
determining that the first user should have access to a first data environment that is not included in the first subset;
identifying an attribute change to the first attributes that would allow the first user to access the first data environment; and
applying the attribute change to the first attributes.
6. The method of claim 5 , comprising:
presenting the attribute change to an administrator; and
receiving confirmation that the attribute change should be applied, wherein applying the attribute change occurs in response to the confirmation.
7. The method of claim 5 , comprising:
displaying the privilege graph to an administrator after the privilege graph is updated to reflect that the attribute change has been applied to the first attributes.
8. The method of claim 1 , comprising:
receiving one or more alert parameters from an administrator, wherein the alert parameters, when satisfied, trigger an alert to the administrator; and
presenting the alert to the administrator in response to determining that the privilege graph satisfies the alert parameters.
9. The method of claim 1 , comprising:
determining that an anomaly exists in the first subset relative to other users having similar attributes to the first attributes; and
notifying an administrator about the anomaly.
10. The method of claim 1 , wherein the first user is a human, an application, or a computing system.
11. An apparatus comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
identify first attributes of a first user;
perform a traversal of nodes of a privilege graph using the first attributes to determine subsequent nodes until one or more first nodes representing a first subset of environments of a plurality of data environments is reached, wherein the traversal passes through at least one parent node of the one or more first nodes, wherein the at least one parent node represents one or more privileges, and wherein the first user has the one or more privileges with respect to the first subset of environments as indicated by the traversal passing through the at least one parent node before reaching the first subset of environments; and
authorize the first user to access the first subset.
12. The apparatus of claim 11 , wherein the program instructions direct the processing system to:
identify second attributes of a second user;
perform a second traversal of nodes of the privilege graph using the second attributes to determine subsequent nodes until one or more second nodes representing a second subset of environments of the plurality of data environments is reached, wherein the second subset is different than the first subset; and
authorize the second user to access the second subset.
13. The apparatus of claim 11 , wherein the program instructions direct the processing system to:
display the privilege graph to an administrator authorized to view the privilege graph.
14. The apparatus of claim 13 , wherein the program instructions direct the processing system to:
receive a Boolean search query from the administrator; and
display a portion of the privilege graph that satisfies the Boolean search query.
15. The apparatus of claim 11 , wherein the program instructions direct the processing system to:
determine that the first user should have access to a first data environment that is not included in the first subset;
identify an attribute change to the first attributes that would allow the first user to access the first data environment; and
apply the attribute change to the first attributes.
16. The apparatus of claim 15 , wherein the program instructions direct the processing system to:
present the attribute change to an administrator; and
receive confirmation that the attribute change should be applied, wherein applying the attribute change occurs in response to the confirmation.
17. The apparatus of claim 15 , wherein the program instructions direct the processing system to:
display the privilege graph to an administrator after the privilege graph is updated to reflect that the attribute change has been applied to the first attributes.
18. The apparatus of claim 11 , wherein the program instructions direct the processing system to:
receive one or more alert parameters from an administrator, wherein the alert parameters, when satisfied, trigger an alert to the administrator; and
present the alert to the administrator in response to determining that the privilege graph satisfies the alert parameters.
19. The apparatus of claim 11 , wherein the program instructions direct the processing system to:
determine that an anomaly exists in the first subset relative to other users having similar attributes to the first attributes; and
notify an administrator about the anomaly.
20. One or more non-transitory computer readable storage media having program instructions stored thereon that, when read and executed by a processing system, direct the processing system to:
identify first attributes of a first user;
perform a traversal of nodes of a privilege graph using the first attributes to determine subsequent nodes until one or more first nodes representing a first subset of environments of a plurality of data environments is reached, wherein the traversal passes through at least one parent node of the one or more first nodes, wherein the at least one parent node represents one or more privileges, and wherein the first user has the one or more privileges with respect to the first subset of environments as indicated by the traversal passing through the at least one parent node before reaching the first subset of environments; and
authorize the first user to access the first subset.