GRANULAR AUTHORIZATION FLOW IN A DISTRIBUTED, MULTI-DOMAIN COMPUTING SYSTEM

Number: 20250247384
Published: 2025-07-31
Filed: 2024-01-25
Assignee: DISNEY ENTERPRISES, INC.
Inventors: BRABBLE; Kerry D. et al.
CPC: H04L63/083; H04L63/20
Verdict: Set aside IT authorization, cybersecurity
Source: Google Patents · FreePatentsOnline

Abstract

The present invention sets forth a technique for automatically managing access control authorization in a distributed computing system. This technique includes receiving an access request from a requesting entity and recording the access request in an audit log. The technique also includes retrieving access control policies associated with the access request and retrieving attribute data values from an entity data store. The technique further includes generating an access request evaluation based on the access request, the access control policies, and the attribute data values. The technique further includes transmitting the access request evaluation to the requesting entity.

Background

BACKGROUND Field of the Various Embodiments

Embodiments of the present disclosure relate generally to Information Technology (IT) automation and, more specifically, to techniques for automatically managing access control authorization in disparate computer systems and software applications. Description of the Related Art

Distributed, multi-domain computing systems experience significant risk of data breaches and other compromises. These compromises may be malicious or inadvertent, and the risk is exacerbated by the complexity of the computing systems, the large number of users in a distributed, multi-domain system, and the wide variety of disparate software applications resident in a computing system. Preventing excessive access in digital systems significantly mitigates the risk of data breaches and compromises for those systems and the sensitive data that they process. The concept of “least privilege,” that a person or system should only have the minimum access needed to perform their duties, is one strategy for preventing excessive access in a computing system.

Applying least privilege in a complex, multi-domain system that hosts thousands of unique use cases, each with different access requirements and granular conditions, is challenging. Each user's need for access may vary widely and be based on domain-specific concepts such as the details of a particular request, a location or time associated with a particular request, or other contextual factors.

Claims

1. A computer-implemented method for performing authorization flow, the computer-implemented method comprising: receiving an access request from a requesting entity in a distributed computing system; retrieving one or more access control policies associated with the access request; retrieving, from an entity data store, attribute values for one or more attributes included in the one or more access control policies; generating, based on the attribute values and the one or more access control policies, an access request evaluation; and transmitting the access request evaluation to the requesting entity. || 8. One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of: receiving an access request from a requesting entity in a distributed computing system; retrieving one or more access control policies associated with the access request; retrieving, from an entity data store, attribute values for one or more attributes included in the one or more access control policies; generating, based on the attribute values and the one or more access control policies, an access request evaluation; and transmitting the access request evaluation to the requesting entity. || 15. A system comprising: one or more memories storing instructions; and one or more processors for executing the instructions to: receive an access request from a requesting entity in a distributed computing system; retrieve one or more access control policies associated with the access request; retrieve, from an entity data store, attribute values for one or more attributes included in the one or more access control policies; generate, based on the attribute values and the one or more access control policies, an access request evaluation; and transmit the access request evaluation to the requesting entity.