Method of and system for authorizing user to execute action in electronic service

A method and system for authorizing a subject user to perform an action within an electronic service, receiving, a request to access the electronic service, the request including an indication of the subject user, of an object, and of the action that the subject user is desirous of performing on the object within the electronic service, based on at least one of the indication of the subject user and the object, retrieving, by the server, a set of predetermined rules each predetermined rule having been coded and stored, by the server, as a respective bytecode portion, executing the set of predetermined rules, analyzing an outcome rendered by the execution of each rule of the set of predetermined rules, and responsive to the outcome being indicative of a positive result, authorizing the subject to perform the action on the object.

The present application claims priority to Russian Patent Application No. 2017146279, entitled “Method of and System for Authorizing User to Execute Action in Electronic Service,” filed Dec. 27, 2017, the entirety of which is incorporated herein by reference.

FIELD

The present technology relates to access control to electronic services in general and, more specifically, to a method of and a system for authorizing a subject user to execute an action in a electronic service.

BACKGROUND

A cloud platform delivers computing as a service to one or more clients. For example, a cloud platform may deliver an infrastructure (e.g., storage media), provide software, or make particular computing platforms available to clients. A cloud platform does not merely connect various components as in conventional networks, but provides instead computing services and infrastructures, which are independent of the devices used by the clients (or users). Therefore, by using cloud platforms it becomes possible to delegate setting up and maintenance of computing systems to an external provider and therewith to increase significantly the efficiency, capability, or flexibility of an information technology (IT) infrastructure.

Service providers, such as Google™, Yahoo™, and Yandex™, typically provision users with a variety of services: cloud, advertising, mapping, calendars, translation, e-mail, social network, and cloud storage space, among others. A user may operate in various contexts, wherein in each of them the user plays a different role and has different responsibilities. These different roles might relate to the professional or personal life of the user in the role of employee, contractor, customer, supplier, or family member, for example. Within these various contexts, a user may use different client devices (e.g., desktop computers, laptop computers, personal computers, mobile phones, tablets, etc.) or client devices that utilize remote processing capability (e.g., applications hosted on a web site or a virtual machine hosted in a data center). Different computing environments might be installed on client devices with local processing capabilities (e.g., different operating systems, virtual software environments, Web applications, native applications, containers, BIOS/APIs, etc.) to interact with a cloud platform.

Users associated with the cloud service may generally want to execute actions on files, processes, and other programs via their electronic devices. However, a user may not be allowed to execute a process on a forbidden resource of the cloud service, or modify or delete important files. The cloud service may thus be configured to control access via different methods.

U.S. Pat. No. 9,553,855 B2 titled “Storing a key to an encrypted file in kernel memory” and granted on Jan. 24, 2017 to Red Hat Inc. teaches storing a key to an encrypted file in a kernel memory. Authentication data may be received and authentication credentials of the authentication data may be stored in a file. The file may be encrypted and a key to the encrypted file may be generated. The encrypted file may be stored in a user space and the key may be stored in a kernel space. The key may be retrieved from the kernel space and applied to the encrypted file in the user space to decode the encrypted file and subsequently access the authentication credentials stored in the encrypted file.

U.S. Pat. No. 7,530,099 B2 titled “Method and system for a single-sign-on mechanism within application service provider (ASP) aggregation” and granted on May 5, 2005 to IBM teaches a methodology for providing a single-sign-on mechanism within an ASP aggregator service. An aggregator token is generated by an ASP aggregator service and sent to a client device after its user has been successfully authenticated during a single-sign-on operation that is provided by the ASP aggregator service. The aggregator token then accompanies any request from the client to aggregated applications within the ASP aggregator service's infrastructure. The aggregator token comprises an indication of an address or resource identifier within the ASP aggregator service to which a client/user can be redirected when the client/user needs to be authenticated by the ASP aggregator service. In other words, the address/identifier is associated with a logon resource; when a request from a client is sent to this address, the ASP aggregator service responds with an authentication challenge to force the user to complete a single-sign-on operation.

U.S. Pat. No. 8,225,385 B2 titled “Multiple security token transactions” and granted on Jul. 17, 2012 to Microsoft teaches embodiments of multiple security token transactions. One or more of the described techniques may be utilized to provide, in a single request and response, an authentication token and a plurality security tokens for proof of identity at respective service provider

SUMMARY

Developers of the present technology have appreciated at least one technical problem associated with the prior art approaches.

More specifically, developers of the present technology have appreciated that when access control is executed at a server, prior art solutions often use role-based access control mechanisms, which may be limiting when users do not fit a predetermined role defined by a system administrator.

An alternative to role-based access control is rule-based access control, which is more flexible, at it is a more granular approach that allows controlling access based on specific rules, which may vary from user to user. However, rule-based access control is often slower, as the server needs to compile a specific set of rules each time a user polls the server.

Thus, embodiments of the present technology are directed to a method and a system for controlling authorization at an electronic service.

According to a first broad aspect of the present technology, there is provided a method for authorizing a subject user to perform an action within an electronic service, the subject user being associated with at least one client device, the subject user being associated with the electronic service, the electronic service being executed at a server, the at least one client device being connected to the server via a communication network, the method comprising: receiving, by the server from the at least one client device, a request to access the electronic service, the request including an indication of the subject user, of an object, and of the action that the subject user is desirous of performing on the object within the electronic service, based on at least one of the indication of the subject user and the object, retrieving, by the server, a set of predetermined rules associated with the at least one of the subject user and the object from a plurality of predetermined rules, each predetermined rule having been coded and stored, by the server, as a respective bytecode portion, the predetermined rules having been precompiled into the bytecode portions executing, by the server, the set of predetermined rules, the set of predetermined rules comprises at least one of: a first rule for verifying the subject, a second rule for verifying the object, and a third rule for verifying the action that the subject user is desirous of performing on the object, analyzing an outcome rendered by the execution of each rule of the set of predetermined rules, and responsive to the outcome being indicative of a positive result, authorizing the subject to perform the action on the object.

In some implementations, the set of predetermined rules is retrieved from a rule mapping database, the rule mapping database mapping each of subject users and each of objects to an associated rule of the predetermined rules.

In some implementations, each rule of a subset of the set of predetermined rules corresponds to a respective action to be performed by the subject user on a respective object.

In some implementations, the predetermined rules have been further precompiled into a machine code, and the plurality of predetermined rules are stored as the machine code.

In some implementations, the predetermined rules are executable independently by the server.

In some implementations, the predetermined rules are executable in parallel by the server.

In some implementations, the predetermined rules are executed in parallel by plurality of processors of the server.

In some implementations, the subject user is one of: a user, a group of users and a process.

In some implementations, the object is one of: a file, a type of file, a directory, a process, and a program.

In some implementations, where in the action is one of: reading, writing, appending, executing, deleting, creating, and searching

In some implementations, the electronic service is a cloud service.

In some implementations, the method is executable at the kernel level of the server.

In some implementations, the method is executable in a virtual machine of the server.

In some implementations, the analyzing the outcome rendered by the execution of the set of predetermined rules comprises determining of a given outcome of a given pre-determined rule is one of a positive, negative and default negative.

In some implementations, the outcome is considered to be indicative of the positive result in response to a totality of given outcomes of the set of predetermined rules not rendering a negative outcome.

In some implementations, the outcome is considered to be indicative of the positive result in response to the totality of given outcomes of the set of predetermined rules rendering one of a positive and a default negative outcomes.

According to a second broad aspect of the present technology, there is provided a system for authorizing a subject user to perform an action within an electronic service, the subject user being associated with at least one client device, the subject user being associated with the electronic service, the at least one client device being connected to the system via a communication network, the system comprising: at least one processor, a non-transitory computer-readable medium comprising instructions, the at least one processor, upon executing the instructions, being configured to: receive, from the at least one client device, a request to access the electronic service, the request including an indication of the subject user, of an object, and of the action that the subject user is desirous of performing on the object within the electronic service, based on at least one of the indication of the subject user and the object, retrieve, a set of predetermined rules associated with the at least one of the subject user and the object from a plurality of predetermined rules, each predetermined rule having been coded and stored as a respective bytecode portion, the predetermined rules having been precompiled into the bytecode portions, execute, the set of predetermined rules, wherein the set of predetermined rules comprises at least one of: a first rule for verifying the subject, a second rule for verifying the object, and a third rule for verifying the action that the subject user is desirous of performing on the object, analyze an outcome rendered by the execution of each rule of the set of predetermined rules, and responsive to the outcome being indicative of a positive result, authorize the subject to perform the action on the object.

In some implementations, the set of predetermined rules is retrieved from a rule mapping database, the rule mapping database mapping each of subject users and each of objects to an associated rule of the predetermined rules.

In some implementations, each rule of a subset of the set of predetermined rules corresponds to a respective action to be performed by the subject user on a respective object.

In some implementations, the predetermined rules have been further precompiled into a machine code, and the plurality of predetermined rules are stored as the machine code.

In some implementations, the predetermined rules are executable independently by the at least one processor.

In some implementations, the predetermined rules are executable in parallel by the at least one processor.

In some implementations, wherein: the at least one processor is a plurality of processors, and the predetermined rules are executed in parallel by the plurality of processors.

In some implementations, the subject user is one of: a user, a group of users and a process.

In some implementations, the object is one of: a file, a type of file, a directory, a process, and a program.

In some implementations, where in the action is one of: reading, writing, appending, executing, deleting, creating, and searching

In some implementations, the electronic service is a cloud service.

In some implementations, the instructions are executable at the kernel level of the at least one processor.

In some implementations, the instructions are executable in a virtual machine executed by the at least one processor.

In some implementations, the analyzing the outcome rendered by the execution of the set of predetermined rules comprises determining of a given outcome of a given pre-determined rule is one of a positive, negative and default negative.

In some implementations, the outcome is considered to be indicative of the positive result in response to a totality of given outcomes of the set of predetermined rules not rendering a negative outcome.

In some implementations, the outcome is considered to be indicative of the positive result in response to the totality of given outcomes of the set of predetermined rules rendering one of a positive and a default negative outcomes.

While the present technology is contemplated to be employed in a cloud storage service, it is noted that the present technology may be employed in any other suitable environment requiring access control to authorize users, devices, and processes to execute specific actions.

In the context of the present specification, “electronic device” is any computer hardware that is capable of running software appropriate to the relevant task at hand. Thus, some (non-limiting) examples of electronic devices include personal computers (desktops, laptops, netbooks, etc.), smartphones, and tablets, as well as network equipment such as routers, switches, and gateways. It should be noted that a device acting as an electronic device in the present context is not precluded from acting as a server to other electronic devices. The use of the expression “a electronic device” does not preclude multiple electronic devices being used in receiving/sending, carrying out or causing to be carried out any task or request, or the consequences of any task or request, or steps of any method described herein.

In the context of the present specification, the expression “computer usable information storage medium” is intended to include media of any nature and kind whatsoever, including RAM, ROM, disks (CD-ROMs, DVDs, floppy disks, hard drivers, etc.), USB keys, solid state-drives, tape drives, etc.

DETAILED DESCRIPTION

The system100comprises a communication network102. The communication network102is typically associated with a plurality of client devices associated respectively with a plurality of users. A first client device104, a second client device108, a third client device106, and a fourth client device110associated with a first user103, a second user107, a third user105, and a fourth user109, respectively, are indicated in the figure for illustrative purposes.

The communication network102is also associated with a cloud server130, the cloud server having a processor140. The cloud server130may generally provide cloud computing services to a plurality of users (such as the first user103, the second user107, the third user105, and the fourth user109) which may include servers, storage, databases, networking, and software. Users may create applications and services, store, back up and recover data, host websites and blogs, stream audio and video, deliver software on demand and analyze data for patterns and make predictions.

In the present embodiment, the cloud server130hosts a cloud storage service (not depicted) and is typically associated with a file storage unit112. The implementation of the cloud server130is not particularly limited, but as an example, the cloud server130may be implemented as a single server. Alternatively, the cloud server130can be implemented as a plurality of servers. Within the latter embodiments, each of the plurality of servers implementing the cloud server130may be responsible for storing files from users in a particular region; or a particular type of users; or a particular type or size of files. Alternatively, each of the plurality of servers implementing the cloud server130may be configured to store files according to a load-balancing approach executed by a supervisory entity (which can be one of the plurality of servers). The file storage unit112is typically a unit capable of storing files and data. Like the cloud server130, the file storage unit112may be implemented as a single unit, or alternatively as a plurality of units.

Client devices104,106,108and110are coupled to communication network102via respective communication link132,134,136,138. In some non-limiting embodiments of the present technology, the communication network102can be implemented as the Internet. In other embodiments of the present technology, the communication network102can be implemented differently, such as any wide-area communications network, local-area communications network, a private communications network and the like.

How a communication link132,134,136,138is implemented is not particularly limited and will vary depending on how the communication network102and the respective client devices104,106,108and110are implemented. Merely as an example and not as a limitation, in those embodiments of the present technology where the first client device104is implemented as a wireless communication device (such as a smartphone), the communication link132can be implemented as a wireless data transmittal path (such as but not limited to, a 3G communications network link, a 4G communications network link, a Wireless Fidelity, or WiFi® for short, a Bluetooth®, and the like). In those examples, where the first client device104is implemented as a notebook computer, the communication link132can be either wireless (such as Wireless Fidelity, or WiFi® for short, Bluetooth® or the like) or wired (such as an Ethernet based connection). Different client devices and different data transmittal paths may be implemented independently of each other. It should be understood therefore that different client devices can be implemented differently and that data transmittal paths will vary accordingly.

It should be expressly understood that implementations for client devices104,106,108, and110, communication link132,134,136,138, and communication network102are provided for illustration purposes only. While only four client devices104,106,108, and110, are illustrated (all are shown inFIG. 1), it is contemplated that any number of client devices104,106,108, and110could be connected to the system100. It is further contemplated that in some implementations, the number of client devices104,106,108, and110included in the system100could number in the tens or hundreds of thousands. As such, those skilled in the art will easily appreciate other specific implementational details for these elements. As such, examples provided herein above are not meant to limit the scope of the present technology.

The cloud server130can be implemented as a conventional computer server. In an example of an embodiment of the present technology, the cloud server130is implemented as a Dell™ PowerEdge™ Server running the Linux® operating system (OS). It should be understood that the cloud server130can be implemented in any other suitable hardware and/or software and/or firmware or a combination thereof. In the depicted non-limiting embodiment of present technology, the cloud server130is a single server. In alternative non-limiting embodiments of the present technology, the functionality of the cloud server130may be distributed and may be implemented via multiple servers, e.g., the cloud server130may be implemented as a plurality of servers.

The processor140of the cloud server130has a user space145and a kernel space147, both of which will be described in more detail below. The processor140may be any processor capable of carrying out the method of the present technology. It is contemplated that this could include, but is not limited to: a single dedicated processor140, a single shared processor140, graphics processing unit (GPU)140and a central processing unit (CPU)140. It is also contemplated that the method be carried out multiple times in parallel on a plurality of individual processors140or on a multi-core processor140, as will be discussed below.

According to the non-limiting embodiments of present technology, the processor140and its corresponding memory is partitioned into user space145and kernel space147. In normal operation, the user space145governs execution of software applications (not depicted). User space145also generally contains any process that may not be stable or trusted enough to have access to system hardware or the operating system. The software applications access system drivers and memory through system calls, which pass user space requests to the kernel processes.

Kernel space147is tasked with running an operating system kernel (not depicted), device drivers (not depicted), a process manager (not depicted), and an input/output (I/O) device manager (not depicted). The operating system kernel is a computer program that manages input and output requests from software in the user space and translates them into data processing instructions for the processor140. The process manager allocates resources to processes and protects processes from interfering with each other. Device drivers and the I/O device manager operate, control or manage devices, such as a computer monitor (not depicted), and the computer keyboard (not depicted), that are connected to the cloud server130of the system100. For system security, kernel space147operates using a set of kernel space commands which are known, stable commands that will not generally endanger the normal operations of the system100.

The cloud server130may implement Harvard architecture or the von Neumann architecture, or a mix thereof. Briefly speaking, the Harvard architecture uses physically separate memory and data paths for program and memory, while the von Neumann architecture uses the same memory and data paths for program and data storage.

The cloud server130may execute a virtual machine, which runs as a normal application inside the OS and provides platform-independent programming environment allowing to abstract away details of the underlying hardware or OS, and allows a program to execute in the same way on any platform.

The cloud server130is communicatively coupled (or otherwise has access) to a file storage unit112. The general purpose of the file storage unit112is to store data, e.g., files and programs, accessible by users103,105,107, and109or other users (not depicted) of the cloud server130. The implementation of the file storage unit112is not particularly limited. It should be understood that any suitable hardware for storing data may be used. In some implementations, the file storage unit112may be physically contiguous with the cloud server130, i.e., they are not necessarily separate pieces of hardware, as depicted, although they may be.

The cloud server130is configured to execute access control mechanisms to control the flow of information between a subject (e.g. user, group of users, program, process, device) and an object (e.g. file, type of file, directory, program, process, database, device) in the file storage unit112to protect the information and prevent unauthorized access. The subject generally requests access to an object to take actions on the object. As such, access control mechanisms allow preventing, among others, computing threats (e.g. Denial of services (DoS) threats, unauthorized software, and software defect, etc.) and personnel threats (e.g. careless users, spies, etc.). The cloud server130may execute access control mechanisms based on the rule-mapping database114, which will be described in more detail in the following paragraphs.

Now turning toFIG. 2, an access control environment200is illustrated in accordance with a non-limiting embodiment of the present technology. The access control environment200includes the rule-mapping database114, the file storage unit112, and a plurality of predetermined rules240.

The cloud server130is configured to execute mandatory access control (MAC), where a security label is assigned to each subject and user by a system administrator. A security label is an assigned level of sensitivity, e.g. public, sensitive, confidential, secret, etc. More precisely, the cloud server130is configured to execute rule based access control (RBAC), where access is allowed or denied to objects based on an outcome of the execution of one or more rules242of plurality of predetermined rules240defined by one or more system administrator(s). The execution of at least a portion of the plurality predetermined rules240determines whether an access request from a subject to an object should be granted or denied. Generally, access control cannot be changed by subjects as all access permissions are controlled solely by the system administrator(s). In some embodiments, rule based access control may also be combined with role based access control, where permissions are assigned to particular roles, and users are assigned to particular roles (e.g. administrator, developer, user, etc.).

Each rule242of the set of predetermined rules240may indicate what can and cannot happen between a subject and an object. A rule242may indicate whether a subject may perform an action on the object (e.g. reading, writing, appending, executing, deleting, creating, and searching) or may indicate other conditions (e.g. location range, IP address, time of day, type of device etc.) for performing the action. Broadly speaking, a rule242of the set of predetermined rules240may use a “if x then y” logic, which allows an action y to be performed if a condition x is met.

For verifying permissions, the cloud server130is configured to use one or more access control lists (ACL) or access control matrices (ACM), which are data structures mapping subjects and objects to associated rules in the plurality of predetermined rules240. The manner in which the ACLs are implemented is not limited. In the present embodiment, the ACLs are implemented as a rule-mapping database114. The rule-mapping database114may be implemented in different ways.

For a given subject and/or object present in the rule-mapping database114, the cloud server130may retrieve an associated set of predetermined rules from the plurality of predetermined rules240. Based on the subject and/or object in a request received from one of the client devices104,106,108,110, the cloud server130may analyze the rule-mapping database114, and retrieve a set of predetermined rules240dynamically e.g. the cloud server130may execute a specific set of predetermined rules by retrieving, from the rule-mapping database114, a reference to the rules associated with the object and/or subject, input them in a function, which may in turn retrieve the specific rules of the plurality of predetermined rules240associated with the object and/or subject.

In the present embodiment, each rule242of the plurality of predetermined rules240may have been defined by one or more system administrator(s). Generally, the objective of the non-limiting embodiments of the present technology is to have each rule242of the plurality of predetermined rules240predefined and at least partially precompiled to allow faster processing by the processor140of the cloud server130, such that it can be executed independently and without any dependency to other rules or processes in the cloud server130. As such, each rule242of the plurality of predetermined rules240may be considered as an independent program to be executed by the processor140of the cloud server130. When receiving a request, the cloud server130may thus retrieve the associated set of predetermined rules from the plurality of predetermined rules240, and execute the predetermined rules without or by minimizing interpretation and compilation time by the processor140, by having the plurality of rules242mapped closely to processor instructions. In some embodiments, the plurality of predetermined rules240may be in the form of machine code, which may be stored in a ROM or RAM of the cloud server130. In other embodiments, the plurality of predetermined rules240may be the form of bytecode of a virtual machine, which may be stored in a volatile or non-volatile memory of the cloud server130. The bytecode may be executed by parsing and directly executing the instructions, by interpretation, by just-in-time (JIT) compiling, or any other technique chosen by the system administrator.

As such, the plurality of predetermined rules240may be defined in the user space145and executed in the kernel space147of the processor140. Generally, the kernel ensures that only forward jumps are permitted to prevent loops and instructions are valid and in range when the processor140of the cloud server130executes a predetermined rule240of the plurality of predetermined rules240.

The execution of a given rule242of the plurality of predetermined rules240may generally result in three possible outcomes: POSITIVE, NEGATIVE and DEFAULT NEGATIVE. The POSITIVE outcome of the execution of a rule may indicate that an element of the request matches the given rule (i.e. may be indicative of a positive outcome of the rule execution). The NEGATIVE outcome of the execution of a rule may indicate that an element of a request does not match the rule (i.e. may be indicative of a negative outcome of the rule execution). Generally, when the execution of a rule by the cloud server130results in a NEGATIVE outcome, the request from the subject may be automatically rejected, and other elements of the request may not be verified. The DEFAULT NEGATIVE outcome of the execution of a rule may indicate that the rule does not apply to an element of a request, and the cloud server130ignores the rule. As such, when a set of predetermined rules is executed by the processor140of the cloud server130, a request may be rejected automatically, and execution may be aborted when obtaining at least one NEGATIVE outcome. In some embodiments, more than three outcomes are possible.

Broadly speaking, the cloud server130may receive a request to execute an action on an object at an electronic service (not depicted) of the cloud server130from a subject user via a device associated with the cloud server130(such as one of the client devices104,106,108, and110). The action may include, among others, reading, writing, appending, executing, deleting, creating, and searching an object. The cloud server130may analyze the request, and based on the rule-mapping database114, retrieve a specific set of rules from the plurality of predetermined rules240, the specific set of rules being associated with at least one of the subject and the object.

The specific set of rules may generally include policy checks and other conditions to allow execution of the action on the object. The cloud server130may execute the specific set of rules sequentially, in parallel or at least partially in parallel, depending on how the processor140and/or the cloud server130are configured. Generally, as soon as the execution of a rule results in a NEGATIVE outcome, the cloud server130may automatically stop execution of other rules of the set of specific rules and refuse the execution of the action by the subject, and may notify the subject that the request has been refused. In some embodiments, the cloud server130may execute all rules of the specific set of rules before refusing the execution of the action by the subject.

In some embodiments, the cloud server130may use tokens when authorizing requests from subject users. As a non-limiting example, when authorizing a request for the first time, the cloud server130may generate a token comprising the specific set of rules associated with the subject user making the request. The cloud server130may forward the token with the specific set of rules to the client device (e.g. one of the client devices104,106,108, and110). Every new request from the subject user via the client device may be intercepted by the cloud server130(e.g. by intercepting network traffic via specific ports or intercepting specific request packets) and based on the token, the cloud server130may forward the request to the kernel space147, which may execute the specific set of rules.

Generally, the cloud server130may identify, authenticate and grant access to users103,105,107, and109on their client devices104,106,108, and110, via user credentials provided by each one of the users103,105,107, and109. The manner in which the user credentials are provided and identity is verified at the cloud server130is not limited. As a non-limiting example, the cloud server130may identify users103,105,107, and109via user identifiers (e.g. ID, username, account number) and authenticate the users103,105,107, and109with passwords submitted via an application or a web resource accessed on their respective client devices104,106,108, and110. In some embodiments, the cloud server130may use single-factor authentication, two-factor authentication, multi-factor authentication, strong authentication or continuous authentication methods.

The cloud server130may receive a first request202from the first client device104, a second request212from the second client device108, a third request222from the third client device108and fourth request232from the fourth client device110over the communication network102via respectively the communication links132,134,136,138. As an example, a user (e.g. one of the users103,105,107and109) may access a terminal application on a user device (e.g. one of the client devices104,106,108, and110), and input a command in the command line to execute a particular action (e.g. delete a file in a folder), which may be translated as a request (e.g. the first request202, the second request212, the third request222, the fourth request232) and sent to the cloud server130over the communication network102.

The manner in which the first request202, the second request212, the third request222and the fourth request232are implemented is not limited. As a non-limiting example, the requests202,212,222,232may be received as fixed-size headers and the predetermined rules may be matched against individual bytes of the headers.

In the illustrated embodiment, the first request202may be received by the cloud server130from the first client device104and be formulated as “SUBJECT=user1; OBJECT=file1224; ACTION=DELETE; TIME=2016-12-05T15:54:09+00:00; IP=192.169.222.123”.

The cloud server130may analyze the first request202, and based on the SUBJECT and/or OBJECT of the first request202, analyze the rule-mapping database114, which contains a reference to rules associated with the SUBJECT and/or OBJECT of the first request202. The cloud server130may then retrieve a first set of predetermined rules252from the plurality of predetermined rules240, the first set of predetermined rules252being associated with the subject and/or object of the first request202. The processor140of the cloud server130may then execute each rule of the first set of predetermined rules252. The rules may be executed at least partially in parallel, in parallel, or sequentially by the processor140of the cloud server130. As a non-limiting example, the first set of predetermined rules252may contain the following rules for the subject user1and/or the file1224: ACTION=(READ, WRITE, DELETE), TIME=(5 AM to 5 PM), IP RANGE=(192.168.0.0 to 192.168.255.255). The processor140of the cloud server130may execute each rule of the first set of predetermined rules252, which may have the following outcome: POSITIVE, POSITIVE, POSITIVE, POSITIVE. The cloud server130may thus authorize the action to be executed, as the execution of the first set of predetermined rules252has only POSITIVE outcomes, and no NEGATIVE outcomes.

The cloud server130may analyze the second request212, and based on the SUBJECT and/or OBJECT of the second request212, analyze the rule-mapping database114, which contains a reference to rules associated with the SUBJECT and/or OBJECT of the second request212. The cloud server130may then retrieve a second set of predetermined rules254from the plurality of predetermined rules240, the second set of predetermined rules254being associated with the subject and/or object of the second request212.

The processor140of the cloud server130may then execute each rule of the second set of predetermined rules254. The rules may be executed at least partially in parallel, in parallel, or sequentially by the processor140of the cloud server130. As a non-limiting example, the second set of predetermined rules254may contain the following rules for the subject user2and/or program412: ACTION=EXECUTE, DEVICE=ANY, DATE=(FROM 2017-01-01T00:00:00+00:00), TIME=(10 AM to 12 PM), IP RANGE=(192.168.0.0 to 192.168.255.255). The processor140of the cloud server130may execute each rule of the second set of predetermined rules254, which may have the following outcome: POSITIVE, DEFAULT NEGATIVE, NEGATIVE, NEGATIVE, POSITIVE.

The cloud server130may thus not authorize the execution of the action by the subject on the object, as the execution of the second set of predetermined rules254has at least one NEGATIVE outcome. In some embodiments, the processor140of the cloud server130may stop executing the rules of the second set of predetermined rules254as soon as the execution of a rule results in a NEGATIVE outcome.

The cloud server130may analyze the third request222, and based on the SUBJECT and/or OBJECT of the third request222, analyze the rule-mapping database114, which contains a reference to rules associated with the SUBJECT and/or OBJECT of the third request222.

The cloud server130may then retrieve a third set of predetermined rules256from the plurality of predetermined rules240, the third set of predetermined rules256being associated with the subject and/or object of the third request222. The processor140of the cloud server130may then execute each rule of the third set of predetermined rules256. The rules may be executed at least partially in parallel, in parallel, or sequentially by the processor140of the cloud server130.

As a non-limiting example, the third set of predetermined rules256may contain the following rules for the subject user3and/or the cloud service32: ACTION=(READ, MOVE, WRITE), DEVICE=LAPTOP, TIME=(5 AM to 5 PM), IP RANGE=(192.168.0.0 to 192.168.255.255). The processor140of the cloud server130may execute each rule of the third set of predetermined rules256, which may have the following outcome: POSITIVE, NEGATIVE, POSITIVE, POSITIVE. The cloud server130may thus not authorize the action to be executed, as the execution of the third set of predetermined rules256has at least one NEGATIVE outcome. In some embodiments, the processor140of the cloud server130may stop executing the rules of the third set of predetermined rules256as soon as the execution of a rule results in a NEGATIVE outcome.

The cloud server130may analyze the fourth request232, and based on the SUBJECT and/or OBJECT of the fourth request232, analyze the rule-mapping database114, and retrieve a reference to rules associated with the SUBJECT and/or OBJECT of the fourth request232. The cloud server130may then retrieve a fourth set of predetermined rules258from the plurality of predetermined rules240.

The cloud server130may then retrieve a fourth set of predetermined rules258from the plurality of predetermined rules240, the fourth set of predetermined rules258being associated with the subject and/or object of the first request202. The processor140of the cloud server130may then execute each rule of the fourth set of predetermined rules258. The rules may be executed at least partially in parallel, in parallel, or sequentially by the processor140of the cloud server130.

As a non-limiting example, the first set of predetermined rules252may contain the following rules for the subject user4and/or the file1224: DEVICE=ANY, ACTION=ANY, TIME=(5 AM to 5 PM), IP RANGE=(192.168.0.0 to 192.168.255.255). The processor140of the cloud server130may execute each rule of the fourth set of predetermined rules258, which may have the following outcome: DEFAULT NEGATIVE, DEFAULT NEGATIVE, POSITIVE, POSITIVE. The cloud server130may thus authorize the action to be executed, as the execution of the first set of predetermined rules252has only POSITIVE or DEFAULT NEGATIVE outcomes, and no NEGATIVE outcomes.

In some embodiments, the cloud server130may be configured to prioritize the execution of certain predetermined rules before others e.g. a rule relating to an action may be executed before a time rule.

Now turning toFIG. 3, a flowchart of a method300is executed by the cloud server130is illustrated in accordance with non-limiting embodiments of the present technology.

The method300starts at step302.

STEP302: receiving a request to access the electronic service, the request including an indication of the subject user, of an object, and of the action that the subject user is desirous of performing on the object within the electronic service.

At step302, the cloud server130may receive at least one of the first request202, the second request212, the third request222and the fourth request232from the client devices104,106,108, and110. Each of the first request202, the second request212, the third request222and the fourth request232may include an indication of a subject, an object and of the action that subject user is desirous of performing on the object within the cloud server130.

The method300then advances to step304.

STEP304: based on at least one of the indication of the subject user and the object, retrieving, by the server, a set of predetermined rules associated with the at least one of the subject user and the object from a plurality of predetermined rules, each predetermined rule having been coded and stored, by the server, as a respective bytecode portion, the predetermined rules having been precompiled into the bytecode portions.

At step304, based on at least one of the indication of the subject user and the object in the first request202, the second request212, the third request222and the fourth request232, the cloud server130may analyze the rule-mapping database116and retrieve respectively the first set of predetermined rules252, the second set of predetermined rules254, the third set of predetermined rules256and the fourth set of predetermined rules258associated respectively with the at least one of the subject user and the object from the plurality of predetermined rules240, each rule242having been coded and stored, by the cloud server130, as a respective bytecode portion, the predetermined rules240having been precompiled into the bytecode portions.

The method300then advances to step306.

STEP306: executing, by the server, the set of predetermined rules, wherein the set of predetermined rules comprises at least one of:a first rule for verifying the subject,a second rule for verifying the object, anda third rule for verifying the action that the subject user is desirous of performing on the object.

At step306, the cloud server130may execute at least one of the first set of predetermined rules252, the second set of predetermined rules254, the third set of predetermined rules256and the fourth set of predetermined rules258, where each set comprises at least one of: a first rule for verifying the subject, a second rule for verifying the object, and a third rule for verifying the action that the subject user is desirous of performing on the object.

The method300then advances to step308.

STEP308: analyzing an outcome rendered by the execution of each rule of the set of predetermined rules.

At step308, the cloud server130may analyze an outcome rendered by the execution of each rule of at least one of the first set of predetermined rules252, the second set of predetermined rules254, the third set of predetermined rules256and the fourth set of predetermined rules258. The outcome of the execution of a rule may be: POSITIVE, NEGATIVE, DEFAULT NEGATIVE.

The method300then advances to step310.

STEP310: responsive to the outcome being indicative of a positive result, authorizing the subject to perform the action on the object.

At step310, the cloud server130may analyze the outcome of each executed rule of the first set of predetermined rules252, the second set of predetermined rules254, the third set of predetermined rules256and the fourth set of predetermined rules258. If at least one rule of the first set of predetermined rules252, the second set of predetermined rules254, the third set of predetermined rules256and the fourth set of predetermined rules258renders a negative outcome, the cloud server130may refuse the request (e.g. the first request202, the second request212, the third request222and the fourth request232) and may not authorize the subject to perform the action on the object. Otherwise, the cloud server130may accept the request and authorize the subject to perform the action on the object.

The method300may then end.

While the present technology has been described in the context of a cloud storage server, the present technology may be implemented in any kind of environment requiring access control. As a non-limiting example, the present technology may be implemented for log in and authorization into a physical device, such as a server or a computer. As another non-limiting example, the present technology may be implemented in a local environment (e.g. LAN network) to authorize users such as employees of a company to execute different actions. Employees of the company may connect to different devices, such as scanners, printers, and other devices connected to the network, but have different permissions and conditions to execute actions, e.g. employee A may be allowed to use the scanner between 9 to 5 PM from Monday to Wednesday, while employee B may be allowed to use scanners and printers around all day but only during specific months of the year.

The present technology allows saving computational resources and time when authorizing a request to execute an action by a subject user on an object within an electronic service. Computational resources and execution time may be saved and/or optimized by precompiling rules that act as conditions to authorize the subject user to perform the action on the object within the electronic service. The rules are generally predefined by system administrator(s) and then precompiled, which allows minimizing resources used by the server(s).

Within the present description it should be understood that in any case where retrieving data from any client device and/or from any mail server is mentioned, retrieving an electronic or other signal from corresponding client device (a server, a mail server) can be used, and displaying on a screen of the device can be implemented as transmitting a signal to the screen, the signal includes specific information which further can be interpreted with specific images and at least partially displayed on the screen of the client device. Sending and receiving the signal is not mentioned in some cases within the present description to simplify the description and as an aid to understanding. Signals can be transmitted using optical methods (for example, using fiber-optic communication), electronic methods (wired or wireless communication), mechanic methods (transmitting pressure, temperature and/or other physical parameters by the means of which transmitting a signal is possible.