A typical corporate organization employs the Internet to communicate with customers and vendors, to conduct research, and to perform various other tasks. The organization also creates and maintains confidential and sensitive information, such as financial data, personal information, confidential documents, intellectual property, and customer lists, as part of the usual course of business. Theft of proprietary information is one of the most costly security problems facing organizations today. For example, theft of financial data, customer lists and intellectual property can impact revenues, increase legal costs, and erode long-term competitive advantages.
To minimize access to proprietary information associated with an organization's data storage system, organizations typically utilize authorization systems. Authorization systems utilize predefined policies to determine if a user is allowed to carry out a given operation on a particular resource associated with the data storage system. For example, during operation, when a conventional authorization system receives a resource request from the user, the authorization system compares a user identification or privilege level associated with the request with the preconfigured policy. Based upon the results of the comparison, the authorization system can either allow or deny the user's request to access the resource based upon the associated, preconfigured policy.
Conventional authorization systems suffer from a variety of deficiencies. For example, as indicated above, authorization systems utilize predefined policies to determine if a user is allowed to carry out a given operation on a particular resource associated with the data storage system. Typically, a system administrator is responsible for defining the policies for resources on the system based upon user identification or privilege level. As new resources are added to the system or as existing resources within the system are modified, the system administrators are required to add new policies or update existing policies associated with the system to ensure that the resources are adequately protected. For a large collection of resources, such updating can be time consuming and error-prone.
By contrast to conventional authorization systems, embodiments of the invention relate to system authorization based upon access characteristics associated with a system resource. An authorization device is configured to provide or deny a user's access to a resource on a data system based upon an access characteristic associated with the resource. When the authorization device receives an authorization request to authorize a user to perform an operation on a data system resource, the authorization device retrieves the access characteristic associated with the resource and compares the access characteristic with an access control policy associated with the request. Based upon the comparison, the authorization device carries out the requirements of the policy, such as to either allow or deny the request. The use of the access characteristic as the basis for authorization allows the authorization device to dynamically adapt to changes within the data system. For example, in response to a new resource being added to the system or to an existing resource within the system being modified, the data system can change the access characteristics for the resources to correspond to any change in an access status (e.g., secrecy level document classification) of the resource used in comparison against the policy. Such dynamic adaptation minimizes the time required by systems administrators to police changes in the resources and to write or revise policies associated with the resources. Additionally, the dynamic adaptation provides the data system with a level of scalability for managing the access control policies for a relatively large collection of resources.
The access characteristic associated with a resource can be based upon a variety of factors. In one arrangement, the access characteristic associated with a resource is based upon a content sensitivity classification of the resource. For example, certain resources, such as documents, can include personally identifiable information (PII), such as a social security number or a credit card number. Based upon the inclusion of PII within a document, the data system can assign the document a sensitivity code to allow certain users, and exclude certain users, from accessing the document. In another arrangement, the access characteristic associated with a resource is based upon a model of access patterns for a given resource. For example, the authorization device is configured with a model of normal or standard access behavior exhibited by a typical user when accessing a particular resource. In the case where the authorization device detects access behavior that falls outside of the model for normal of standard behavior, the authorization device can deny the requesting user from accessing the resource.
In one arrangement, an authorization device is configured to authorize access to a resource. The authorization device receives an authorization request to authorize a client device to perform an operation on the resource associated with a data system and compare an access characteristic associated with the resource with a policy associated with the resource. The authorization device generates a first message when a result of the comparison indicates that the client device is authorized to perform the operation on the resource and generates a second message when a result of the comparison indicates that the client device is unauthorized to perform the operation on the resource.
The foregoing and other objects, features and advantages will be apparent from the following description of particular embodiments of the invention, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of various embodiments of the invention.
Embodiments of the invention relate to system authorization based upon access characteristics associated with a system resource. An authorization device is configured to provide or deny a user's access to a resource on a data system based upon an access characteristic associated with the resource. When the authorization device receives an authorization request to authorize a user to perform an operation on a data system resource, the authorization device retrieves the access characteristic associated with the resource and compares the access characteristic with an access control policy associated with the request. Based upon the comparison, the authorization device carries out the requirements of the policy, such as to either allow or deny the request. The use of the access characteristic as the basis for authorization allows the authorization device to dynamically adapt to changes within the data system. For example, in response to a new resource being added to the system or to an existing resource within the system being modified, the data system can change the access characteristics for the resources to correspond to any change in an access status (e.g., secrecy level document classification) of the resource used in comparison against the policy. Such dynamic adaptation minimizes the time required by systems administrators to police changes in the resources and to write or revise policies associated with the resources. Additionally, the dynamic adaptation provides the data system with a level of scalability for managing the access control policies for a relatively large collection of resources.
In the data system 20, the portal device 22 is in electrical communication with the authorization device 26 and the storage device 24. For example, in the case where the data system 20 is configured as a LAN, the portal device is electrically coupled to the storage device 24 and the authorization device 26 via cables 30, 32. The portal device 22 is configured as a gateway for one or more client devices 28 to gain access to the resources contained by the data system 20, such as documents stored on storage device 24. For example, in response to a request from the client device 28, the portal device 22, operating in conjunction with the authorization device 26, can perform an operation, such as either allow or deny the client device 28 access to the storage device 24 or to other resources associated with the data system 20. While the portal device 22 can have a variety of configurations, in on arrangement, the portal device 22 is configured as a computerized device, such as a gateway or a hub.
The storage device 24, in one arrangement, is configured as a set of disk enclosures where each of the disk enclosures includes an array of magnetic memory units or disk drives. The storage device also includes one or more storage processors configured to perform load and store operations on the disk drives on behalf of the client device 28, for example. In one arrangement, the storage device 24 stores certain resources, such as documents.
The authorization device 26 is configured to provide or deny the client device 28 with access to a resource on the data system 20 based upon an access characteristic associated with the resource. The authorization device 26, such as a computerized device, includes a controller 34, such as a memory and a processor. In one arrangement, the controller 34 stores a system authorization application. The system authorization application installs on the authorization device 26 from a computer program product 35. In some arrangements, the computer program product 35 is available in a standard off-the-shelf form such as a shrink wrap package (e.g., CD-ROMs, diskettes, tapes, etc.). In other arrangements, the computer program product 35 is available in a different form, such downloadable online media. When performed on the controller 34 of the authorization device 26, the system authorization application causes the authorization device 26 to authorize access of the client device 28 to a data system resource.
As illustrated in
The access characteristic component 36 is configured to associate certain adaptive or dynamically changing factors with the resources of the data system 20. As the adaptive factors of a resource change during operation of the data system 20, the accessibility of the resource to a user or client device can change as well. By associating the adaptive factors to the resources, as the adaptive factors associated with the resources change, the access characteristic component 36 allows the authorization device 26, in turn, to adapt to any changes to the resources within the data system 20 and either allow or deny the client device 28 access to the resources based upon the changes.
While the access characteristic component 36 can be configured in a variety of ways, in one arrangement, the access characteristic component 36 includes a classification component 38 and a pattern analysis component 40.
The access classification component 38 is configured to provide the resources within the data system 20 with an associated classification characteristic that identifies a privacy grade of the resource. For example, assume the data system 20 stores a set of documents on the storage device 24. During an initial configuration stage, the classification component 38 scans each of the documents for PII and based upon the inclusion or exclusion of the PII, assigns each document its own privacy grade. In one arrangement, in the case where the classification component 38 detects the document as including an employee social security number and an employee address (i.e., PII), the classification component 38 assigns the document with a relatively high privacy grade, indicating the document is sensitive and not intended for open or widespread access within the system 20. Alternately, in the case where the classification component 38 detects the document as lacking PII, the classification component can assign the document with a relatively low privacy grade, indicating the document is intended for open access within the system 20.
After the initial configuration stage, the classification component 38 is also configured to dynamically update the classification characteristics of the resources, based upon some triggering event, to ensure that the sensitivity grade assigned to a particular resource is accurate. In one arrangement, the classification component 38 scans and reclassifies a resource on the data system 20 after a triggering event. For example, the classification component 38 can automatically scan all of the resources on the data system after the passage of a certain amount of time (i.e., the scans occur once a week) and assigns each resource its own privacy grade. In another example, the classification component 38 scans a resource when the resource, such as a document, is added to the data system 20 (e.g., new employee data containing PII content is added to the data system 20), when an resource is modified (e.g., PII information is added to an existing document), or when dynamic content is generated (e.g., when dynamic web pages are generated on-the-fly per incoming requests).
By providing access control based upon the sensitivity grade assigned to a particular resource, the authorization device 26 minimizes cases where unauthorized users can gain access to sensitive or classified information. Additionally, because the classification component 38 is configured to periodically adjust the privacy grade of a particular resource, a systems administrator is not required to modify the access control policies 44 for the resource to account for any changes in the classification of the resource.
As indicated above, the authorization device 26 also includes the pattern analysis component 40 which is configured to detect normal and abnormal access patterns of the data system resources based on a variety of identification factors. In one arrangement, during an initial configuration stage, the pattern analysis component 40 monitors the data system resources and builds access behavior profiles for the data system resources based on several identification factors. For example, as client devices 28 access resources in the data system, such access includes several factors relating to how the resource is being accessed. As a client device 28 transmits an access request to the data system 20, the access request includes factors relating to the identity of the requesting user (e.g., name), a location of the requesting user (e.g., source address), an identity of the requesting device, the type of resource being accessed, and a time at which the request was transmitted, for example. The pattern analysis component 40, configured with an initial behavior model, monitors the identification factors to build an access behavior profile based on the behavior model (i.e., a normal or typical behavior profile) related to a particular resource. For example, by monitoring the data system 20, the pattern analysis component can build an access behavior profile, based upon an initial model for financial documents in the data system 20 by detecting that client devices located in the human resources department typically access the financial documents between 8 AM and 5 PM. Once the pattern analysis component 40 has developed one or more access behavior profile, the pattern analysis component 40 continues to monitor the data system resources in order to dynamically refine and update the existing access behavior profiles.
As indicated above, the authorization device 26 is configured to utilize the access control policies 44 in conjunction with the access characteristic component 36 to either allow or deny the client device 28 access to the resources of the data system 20. The set of access control policies 44, in one arrangement, are preconfigured by a system administrator. In one arrangement, when setting the policies 40 for the data system 20, the system administrator defines a user population on the data system 20, the resources contained on the data system 20, and the relationships between them, as dictated by the access classification component 36. For example, the system administrator can define a policy that indicates only a human resource staff member can access documents having a high privacy grade.
In step 102, the authorization device 26 receives an authorization request to authorize a client device 28 to perform an operation on the resource associated with a data system 20. For example, with reference to
Returning to
After having retrieved the access control policy 60 and the classification characteristic 62 associated with the document, the authorization device 26 compares the classification characteristic 62 with the policy 60 associated with the document. In one arrangement, in the comparison, the authorization device 26 correlates the policy 60 with the classification characteristic 62 to allow the authorization request 54. In the present example, because the policy 60 indicates that for the financial document, only a user from the human resource group can access the document if the document has a relatively high privacy grade and because the classification characteristic 62 indicates the document has a relatively high privacy grade, correlation of the policy 60 and the classification characteristic 62 results in the authorization device 26 detecting the client device 28 as being authorized to access the financial document.
In such a case, and with reference to
In one case, when the comparison of the generated risk score 72 and the threshold risk score 74 indicates a first, lower risk level associated with the request, thereby indicating that the client device 28 is authorized to perform the operation on the resource, the authorization device 26 proceeds to step 106 and generates a first message 90, such as a message that instructs the portal device 22 to carry out a first action specified by the policy. For example, assume the case where the risk score 72 has a relatively low value relative to the threshold risk score 74. Based upon a comparison of the scores 72, 74, the authorization device 26 detects the client device 28 as being authorized to perform the operation on the resource and generates the first message 90. In response to receiving the first message 90 from the authorization device 26, the portal device 22 grants the client device access to the requested resource, such as the financial document.
In another case, when the comparison of the generated risk score 72 and the threshold risk score 74 indicates a second, higher risk level associated with the request, thereby indicating that the client device 28 is not authorized to perform the operation on the resource, the authorization device 26 proceeds to step 108 and generates a second message 92, such as a message that instructs the portal device 22 to carry out a second action specified by the policy. For example, assume the case where the risk score 72 has a relatively high value relative to the threshold risk score 74. Based upon a comparison of the scores 72, 74, even though the policy 60 allows the client device 28 to access the requested resource, because of the relatively abnormal pattern indicated by the identification factors 56, the authorization device 26 detects the client device 28 as being unauthorized to perform the operation on the resource generates the second message 92. In response to receiving the second message 92 from the authorization device 26, the portal device 22 can deny the client device 28 access to the requested resource, such as the financial document, trigger authentication of the client device 28, and/or log the client device request in a log file (i.e., as specified by the policy).
By basing authorization of a request to perform an operation on a resource on dynamically updated authorization characteristics, such as a classification characteristic 68 and an access behavior profile 70, the authorization device 26 minimizes the time required by systems administrators to police changes in the resources and to write or revise policies associated with the resources. Additionally, the combination of the classification component and the pattern analysis component provides the data system 20 with a level of scalability for managing the access control policies for a relatively large collection of resources.
While various embodiments of the invention have been particularly shown and described, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
For example, the authorization device 26 was described as using both the classification component 38 and the pattern analysis component 40 in order to either grant or deny a client device 28 access to a requested resource. Such description was by way of example only. In one arrangement, the authorization device 26 is configured to utilize either the classification component 38 or the pattern analysis component 40 to authorize a client device 28 to perform an operation on a requested resource.
In another example, as indicated above, the pattern analysis component 40 is configured to monitor resources in the data system 20 in order to dynamically refine and update its existing access behavior profiles 70. In one arrangement, the authorization device 26 works in conjunction with the pattern analysis component 40 to update the access behavior profiles 70. For example, when the authorization device 26 transmits the identification factors 56 to the pattern analysis component 40, such transmission dynamically update the risk profile 70 associated with the pattern analysis component 40.
In the above example, when the pattern analysis component 40 compares the access behavior profile 70 with the identification factors 56 (i.e., client device 28 originating the request belongs to a human resources group of an organization with the request being generated at 3 AM), the pattern analysis component 40 detected that the time of the request deviates from that of the access behavior profile 70. However, other identification factors 56 can trigger the pattern analysis component 40 to detect a deviation in behavior (i.e., abnormal behavior). In one arrangement, the pattern analysis component 40 can detect a user as exhibiting a pattern of behavior towards sensitive resources that is distinct from other users of the same category. For example, the pattern analysis component 40 can detect unusual behavior when a single engineer from a group of engineers in the same department attempts to access sensitive resources multiple times in a relatively short period of time. In another arrangement, the pattern analysis component 40 can detect abnormal behavior on certain resource when based upon unusual access patterns for certain document from a collection of resources with the same level of sensitivity. For example, the pattern analysis component 40 can detect unusual behavior when multiple users are accessing the same sensitive resource differently to other, related, resources.
Number | Name | Date | Kind |
---|---|---|---|
6289462 | McNabb et al. | Sep 2001 | B1 |
7194761 | Champagne | Mar 2007 | B1 |
7275260 | de Jong et al. | Sep 2007 | B2 |
7516492 | Nisbet et al. | Apr 2009 | B1 |
7774363 | Lim | Aug 2010 | B2 |
8141160 | Anderson et al. | Mar 2012 | B2 |
8407194 | Chaput et al. | Mar 2013 | B1 |
20050044409 | Betz et al. | Feb 2005 | A1 |
20050080720 | Betz et al. | Apr 2005 | A1 |
20060136985 | Ashley et al. | Jun 2006 | A1 |
20060253445 | Huang et al. | Nov 2006 | A1 |
20070006325 | Gargaro | Jan 2007 | A1 |
20070240230 | O'Connell et al. | Oct 2007 | A1 |
20090106815 | Brodie et al. | Apr 2009 | A1 |
20100146593 | Stahl et al. | Jun 2010 | A1 |
20100235877 | Hu et al. | Sep 2010 | A1 |