RU2739870C1 - System and method of changing user role - Google Patents

Abstract

FIELD: information security.SUBSTANCE: invention relates to systems and methods of managing user roles. Technical result is achieved by revealing user role; detecting task performed by user with identified role; checking the relevance of the detected user role by at least: detecting a new task performed by the user, having the detected role, detecting a task performed by a user, having a detected role, which requires execution of another task, detection of a task performed by the user, having a detected role, with violation of the task execution time; if observing an irrelevant role using rules, changing the role of making a change to the detected role of the user.EFFECT: technical result is to protect information security by maintaining the relevance of the user role by identifying an irrelevant role and changing it.4 cl, 3 dwg, 2 tbl

Description

Technology area

The invention relates to the field of information security, and more specifically to systems and methods for managing user roles.

State of the art

The number of companies and the variety of their activities continues to grow continuously. The frequency of changes in the goals and objectives that companies set for their employees is gradually increasing. The process of creating and approving job descriptions for employees does not always provide for the possibility of changing them in accordance with the company's updated goals.

In the general case, the role of the employee is determined based on his job duties and labor functions, labor actions. To use the Role Based Access Control (RBAC) system, the employee's role is adapted to the user's role. A user role is a set of access rights to applications and information resources of a company, with the help of which an employee performs labor actions and solves tasks in accordance with the position held.

Failure to timely modify user roles, if necessary, may pose a threat to the company's information security. Situations arise when a user needs access to an application, service, or information resource to complete a task that is not initially provided for by the user's role. At the same time, situations arise when the user, for personal or selfish purposes, and possibly by mistake, requires access to an application or information resource that is not provided for by the role. On the one hand, there is a problem of determining the legality of the access provided, on the other hand, untimely changes to the role can critically slow down the solution of an important task.

Currently, there are solutions designed to change the user's role. Publication US 9621585 B1 describes a system in which the need to change the user's role is dynamically detected, for example, when the user's access to confidential data changes. In accordance with the changes, the creation of new security policies and roles is envisaged.

While the above method of operation does a good job of changing a role, it often fails to identify the conditions under which a role change needs to be made. The present invention can effectively solve this problem.

Disclosure of invention

The invention relates to the field of information security, and more specifically to systems and methods for managing user roles. The invention is intended to change the role of the user. The technical result of the present invention is to ensure the protection of information security by maintaining the relevance of the user's role by identifying the irrelevant role and changing it.

In one embodiment, a system for changing the user's role is provided, wherein said system comprises: a detection tool designed to: identify the user's role, identify the task that the user performed with the identified role, transfer data about the identified user role and the task that the user performed , having a revealed role, a means of review; revision tool designed to check the relevance of the identified user role by at least identifying a new task performed by the user with the identified role, to identify the task performed by the user with the identified role that requires another task to be performed, to identify the task that performed by the user, having the identified role, in violation of the deadline for completing the task, transferring the scan results to the change tool; a change tool for making changes to the identified user role using role change rules when an irrelevant role is detected; a rules database for storing rules for changing a role.

In another implementation, the role change rules are understood as a set of conditions, upon fulfillment of which, changes are made to the user's role.

In yet another implementation, a database of tasks and user roles is used to store at least data about the name of the employee, the task and the level of its classification, the time period for the task, access rights corresponding to the task, the type of reporting and the user's role.

In another implementation, changes to the role are performed by changing the task, the time period for the task, the access rights associated with the task.

In one embodiment, a method for changing the role of a user is provided, comprising the steps that are implemented using means from said system and in which the role of the user is identified; identify the task performed by the user with the identified role; check the relevance of the identified user role by at least identifying a new task that the user performed with the identified role, identifying the task that the user performed while having the identified role that requires another task to be performed, identifying the task that the user performed while having the identified role, in violation of the deadline for the task; when an irrelevant role is identified using the rules, role changes make a change to the identified user role.

In another embodiment of the method, the role change rules are understood as a set of conditions, upon fulfillment of which, changes are made to the user's role.

In another embodiment of the method, at least data about the name of the employee, the task and the level of its classification, the time period for the task execution, the access rights corresponding to the task, the type of reporting and the user's role are stored.

In another embodiment of the method, changes to the role are performed by changing the task, the time period for the task execution, and access rights corresponding to the task.

Brief Description of Drawings

FIG. 1 illustrates the structure of a role change system.

FIG. 2 illustrates the algorithm of the role change system.

FIG. 3 is an example of a general purpose computer system, personal computer or server.

Although the invention may take various modifications and alternative forms, the characteristic features shown by way of example in the drawings will be described in detail. It should be understood, however, that the purpose of the description is not to limit the invention to a specific embodiment. On the contrary, the purpose of the description is to cover all changes, modifications falling within the scope of this invention, as defined by the appended claims.

Description of embodiments of the invention

Objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The essence recited in the description is nothing more than the specific details necessary to assist a person skilled in the art in a comprehensive understanding of the invention, and the present invention is defined within the scope of the appended claims.

Information resource - a set of individual documents, arrays of documents, usually structured in databases and used by a specific information system (Decree of the Moscow Government dated June 14, 2005 N 439-PP). For example, an information resource can be a website or web application.

Information system is a set of information contained in databases and information technologies and technical means that ensure its processing (Federal Law of July 27, 2006 N 149-FZ (as amended on July 19, 2018) "On information, information technology and information protection").

An information system that requires an account to be used is an information system that allows you to use the functions of the information system only after registration and authorization using an account.

Account - a collection of data about a user, necessary for his authentication and providing access to his personal data and settings (GOST R 57429-2017).

Labor function - work according to the position in accordance with the staffing table, profession, specialty, indicating qualifications; the specific type of work assigned to the employee. The labor function is expressed through work, that is, certain actions that the employee must carry out (interaction with equipment, tools, mental operations, creative actions, etc.) and is determined by the name of the position, profession, specialty (welder, legal adviser, marketing analyst, greener), the qualitative characteristic of the labor function is the ability of the employee to perform duties of a certain level of complexity, with a certain speed and quality of the result (Labor Code of the Russian Federation "of 12/30/2001 N 197-FZ (as amended on 04/01/2019).

Labor actions are the process of interaction between the employee and the subject of labor, in which a certain task is achieved (Guidelines for the development of a professional standard, approved by Order of the Ministry of Labor of Russia dated 04.29.2013 N 170n).

Qualification level - requirements for skills, knowledge, qualification level, depending on the authority and responsibility of the employee. They are used in the development of professional standards to describe labor functions, education and training requirements for employees. The uniform requirements for the qualifications of employees, established by the Qualification Levels, can be expanded and clarified taking into account the specifics of the types of professional activities (Order of the Ministry of Labor of Russia of 12.04.2013 N 148n "On the approval of qualification levels in order to develop draft professional standards"). Achieving a skill level of 1 to 4 usually involves a series of hands-on activities and internal training. Skill levels 4 and above may require additional education, development of more complex skills, fundamental knowledge and experience.

Labor is a socially necessary human activity that requires efforts to achieve certain goals and results.

A task is a unit of labor that involves the performance of labor actions. (Noskova OG Labor Psychology: Textbook for students of higher educational institutions / Edited by EA Klimov. - M .: Publishing Center "Academy", 2004. - 384 p.)

The right of access (English access right, access permission) - the right granted to the user for the authorized use of certain programs and data stored in the computer system. The rules that determine which users or processes and how can get access to the object (directory, file, printer, etc.) (Dorot V.L., Novikov F.A.Explanatory dictionary of modern computer lexicon. - 3rd ed., revised and supplemented - SPb .: BHV-Petersburg, 2004 .-- 608 p.)

Role-based access control (RBAC) is the development of a policy of discretionary access control, where the access rights of system subjects to objects are grouped taking into account the specifics of their application, forming roles.

Role - a set of access rights to objects of a computer system. The rules of role-based access control determine the procedure for granting access rights to subjects (users) of a computer system, depending on the session of its work and on the roles it has or does not have at any given time. (Devyanin PN Security models of computer systems: Textbook for students of higher educational institutions - M .: Publishing center "Academy", 2005. - 144 p.)

Session is the time during which the computer system resources are allocated to the user (from the moment of logging in to the moment of logging out). The time during which a connection exists between applications, computers, or network nodes. (Dorot V.L., Novikov F.A.Explanatory Dictionary of Modern Computer Vocabulary. - 3rd ed., Revised and enlarged - SPb .: BHV-Petersburg, 2004. - 608 p.)

The task is to perform labor activities using applications or information resources that are provided with access in accordance with the role, in order to achieve the goals set by the employer.

The relevance of the user's role is such a state of the role in which the user, within the framework of the current access rights, can freely perform the assigned tasks.

Each employee in the company has a job description. The job description may contain a list of tasks that are available for the employee to perform. Based on the list of tasks that are available for the employee to perform, the administrator forms the access rights to information resources and applications of the company - forms the user's role. Thus, the employee corresponds to the user's role. Situations arise when the user, due to a change or addition to his labor functions, for various reasons, cannot perform labor actions and tasks within the framework of the access rights provided by his role. In one case, the reason for this may be an irrelevant state of the role. In this case, the role should be brought up to date without compromising the information security of the company. For this, a system for changing the user's role is used.

Fig. 1 illustrates the structure of a system for changing a user's role, which includes a database of tasks and user roles 110, an identifier 120, a reviewer 130, a modification tool 140, a rule database 150.

The database of tasks and user roles 110 is designed to store a list of tasks for each user. Table 1 shows the structure of the database tasks and user roles 110 with examples.

The identifier 120 is for identifying a user's role. The user's role can be identified by determining the successful authorization of the user and analyzing the data on the user's existing role in the company's information system. User role data can be fetched from a database of tasks and user roles 110, for example implemented using a directory service (Active Directory).

In addition, the identifier 120 is designed to identify the task performed by the user with the identified role, and communicate the identified user role and the task performed by the user with the identified role to the reviewer 130.

The identification of the task that the user performed can be performed by identifying and analyzing events (for example, from the event log of the operating system or application) and parameters of the user's session with the application or information resource. For example, for Microsoft Windows, identifying and analyzing the data with which the user worked and EventID 4688 events (https://docs.microsoft.com/ru-ru/windows/security/threat-protection/auditing/event-4688) and 4689 (https://docs.microsoft.com/ru-ru/windows/security/threat-protection/auditing/event-4689) allows you to determine the start and end time of an application session. The main parameters of the session are the start time of work with the application or information resource, the time of the end of work with the application or information resource, the functions of the application or information resource that were used during the execution of the task, files that were created or modified during the execution of the task, requests to network resources, data from input devices. One application or information resource can correspond to several tasks that a user can perform. At the same time, one task may require access to multiple applications or information resources.

Table 2, as an example, describes a selection of the event log that were recorded in the course of the user's daily work while performing one of the tasks.

Analysis of the data from Table 1 and the data from Table 2 allows us to identify the task that the user performed, namely: the user Peter Petrov, having the role of “Junior Human Resources Officer,” completed the task “Generation of a monthly report on employee visits”.

In a private implementation, one user can have multiple roles. In accordance with each role, a separate list of tasks can be formed that can be performed by a user with this role. In addition, the administrator for individual users can manually grant access rights outside the possessed role. For example, in Table 1, any user with the Analyst role has been added access rights to use the project management application. By analogy, the administrator can add access rights to the user personally, regardless of his role.

The reviser 130 is designed to perform a validation check on the relevance of the identified user role and communicate the results of the check to the change tool 140.

In one implementation, checking the relevance of a user's role may be performed by searching for and identifying a new task that the user is trying to perform. A new task can be defined in the case when the user cannot access an information resource, application, or its separate function. For example, the time of the attempt to gain access and the subsequent denial of access are recorded. For example, a user with the role of an assistant accountant who has passed the probationary period, completing the task of preparing a report on archived data, attempts to gain access to the company's information resource designed to view archived accounting data. In this case, a situation occurs when a new task is identified that the user has begun to perform, having the current role, is unable to perform, and his role is irrelevant. Role changes required.

Alternatively, checking the relevance of the user's role can be performed by considering the user's experience. If job functions provide for expansion depending on the experience accumulated by the employee, then the stages of accumulation of experience can be determined. Determination of stages can be performed by taking into account the number of completed tasks of the same type, a set of diverse tasks, sequence of tasks. For example, an employee in the position of a specialist in personnel management according to the professional standard can perform the tasks "Maintaining organizational and administrative documentation for personnel" of the 5th qualification level and "Organization and conduct of personnel assessment" of the 6th qualification level (Ministry of Labor and Social Protection of the Russian Federation, ORDER of October 6, 2015 N 691n ON APPROVAL OF THE PROFESSIONAL STANDARD "SPECIALIST IN PERSONNEL MANAGEMENT." Level 5. Otherwise, it should be impossible to perform the task "Organizing and conducting personnel assessment" level 6. Thus, the role may contain access rights to the application or information resource to perform only the task of skill level 5 only. how the user will complete 10 tasks of the 5th level can There is no situation where the user, having the current role, cannot complete the task of the 6th skill level. In this case, a situation arises when a task has been identified that was performed by a user with a current role that requires another task to be performed, and the user's role is irrelevant. Role changes required.

In yet another implementation, checking the relevance of the user's role can be performed by detecting violations of the company's time management plan, drawn up, for example, based on the balance of working hours or time management rules. During the analysis of the task that the user performed, it is possible that a task that the user should not perform for a certain period of time may be detected. For example, due to a pre-approved standard or abuse of irregular working hours. In this case, a situation arises when a task is identified that was performed by a user, having the identified role, with a violation of the task deadline, and the user's role is irrelevant. Role changes required.

The change tool 140 is designed to make changes to the user's current role using the role change rules from the rule database 150 when an outdated role is detected.

Role change rules are a set of conditions upon which the change tool 150 modifies a user's role.

One example of a rule for changing a role can be the following set of conditions: an unsuccessful attempt to perform a session with an application or information resource is detected, there is a task for which you must have access rights to the application or information resource, to which an unsuccessful attempt to start a session is detected, the skill level of the user who can perform the task is lower than the maximum skill level of the user who unsuccessfully attempted a session with the application or information resource. When such a set of conditions is met, the modifier 140 modifies the role by adding the detected task to the list of tasks that the user can perform and changing the access rights for the application with which the user can perform the detected task. For example, user 1 has the role of “Chemical technologist in the automotive industry” and, according to his job responsibilities, can perform the task “Formation of policy in the field of quality management system” of the 6th qualification level. In the course of the task, user 1 realizes that the process of preparing part 1 requires a more detailed internal audit. User 1 decides to independently perform this task and launches the "Audit-Standard" application. The launch was unsuccessful because there are no such tasks among the tasks that can be performed by a user with the role of "Chemical Technologist in Automotive". There is a task "Performing individual audit procedures", for which the use of the "Audit-Standard" application is allowed. This task can be performed by a user with the role "Auditor" of the 4th skill level. The rule for changing the role is triggered and changes are made to the role of “Chemist-technologist in the automotive industry” by adding the task “Performing individual audit procedures” and access rights to the “Audit-Standard” application.

Another example of a role change rule might be the following set of conditions: the task is successfully completed by the user 10 times, the role provides for a level transition based on experience. When such a set of conditions is met, the role is changed by changing the access rights to information resources or applications that an experienced user may need to solve the assigned tasks. For example, User 3, having the role of "Technical documentation specialist in the field of information technology", performs the task "Design and layout of technical documents" of the 4th qualification level. In this task, he uses the Text Editor application and the Technical Drafts Network resource. The task was completed 10 times. The rule for changing the role is triggered and changes are made to the role by adding the task "Creating a technical document standard" 5 skill level and access rights to the network resource "Standards of technical documents".

Another example of a role change rule might have the following set of conditions: the date and time of the end of the task execution time period has arrived. When such a set of conditions is met, the modifier 140 modifies the role by removing access rights to the application or information resource with which the task is performed. For example, user 5 has the role of "Accountant" and performs the task "Drawing up and submitting accounting (financial) statements of an economic entity" of the 6th level of qualification using an application for generating financial statements, a regulated period of time or deadline for completing the task is 8 hours a day. At the end of the task execution time period, the rule for changing the role is triggered and changes are made to the role of user 5 "Accountant" by deleting the task and the access rights to the application for generating financial statements. Subsequently, the access rights can be added again, for example after the expiration of a period of time or a mandatory rest period.

The rules database 150 is designed to store the rules for changing the role. As a database of rules 150, various types of databases can be used, namely: hierarchical (IMS, TDMS, System 2000), network (Cerebrum, Cronospro, DBVist), relational (DB2, Informix, Microsoft SQL Server), object-oriented (Jasmine, Versant, POET), object-relational (Oracle Database, PostgreSQL, FirstSQL / J, functional, etc. Rules can be created using machine learning algorithms and automated processing of large data sets.

FIG. 2 illustrates the algorithm of functioning of the system for changing the user's role. In step 211, the identifier 120 performs a role determination of the user. In step 212, the identifier 120 identifies the task that the user performed and transmits the identified user role and the task that the user performed to the reviewer 130. In step 213, the reviewer 130 checks if the user's role is current and reports the results checker 140. When an irrelevant role is identified at block 214, the change tool 140 makes changes to the user's role using role change rules. If there is no irrelevant role at block 215, the system shuts down.

FIG. 3 shows an example of a general-purpose computer system, a personal computer or server 20, comprising a central processing unit 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processing unit 21. The system bus 23 is implemented as any bus structure known from the prior art, containing in turn a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interfacing with any other bus architecture. System memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains basic procedures that transfer information between the elements of the personal computer 20, for example, at the time of loading the operating room systems using ROM 24.

The personal computer 20, in turn, contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31, such as CD-ROM, DVD -ROM and other optical media. The hard disk 27, the magnetic disk drive 28, and the optical drive 30 are connected to the system bus 23 via the hard disk interface 32, the magnetic disk interface 33, and the optical drive interface 34, respectively. Drives and corresponding computer storage media are non-volatile storage media for computer instructions, data structures, program modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29 and a removable optical disk 31, but it should be understood that other types of computer storage media 56 can be used that are capable of storing data in a computer readable form (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36, where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38 and program data 39. The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40, manipulator " mouse "42). Other input devices can be used (not shown): microphone, joystick, game console, scanner, etc. Such input devices are conventionally connected to the computer system 20 through a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, game port, or universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. ...

The personal computer 20 is capable of operating in a networked environment using a network connection with other or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the entity the personal computer 20 shown in FIG. 3. In a computer network, there may also be other devices, such as routers, network stations, peer-to-peer devices or other network nodes.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, personal computer 20 is connected to local network 50 through a network adapter or network interface 51. When using networks, personal computer 20 may use a modem 54 or other means of providing communication with a wide area network, such as the Internet. Modem 54, which is an internal or external device, is connected to the system bus 23 via a serial port 46. It should be noted that the network connections are only exemplary and are not required to reflect the exact configuration of the network, i.e. in fact, there are other ways of establishing a connection by technical means of communication of one computer with another.

In conclusion, it should be noted that the information given in the description are examples, which do not limit the scope of the present invention defined by the claims.

Claims (11)

1. A method for changing the set of user access rights to objects of a computer system, where the set of user access rights to objects of a computer system is the user's role, containing the stages at which: a) identify the user's role; b) identify the task that the user performed with the identified role; c) check the relevance of the identified user role by at least: identifying a new task that was performed by a user with the identified role, identifying the task that the user performed while having the identified role that requires the completion of another task, identifying the task performed by the user, having the identified role, in violation of the task deadline; d) when an irrelevant role is identified using the rules, role changes make a change to the identified user role. 2. The method according to claim 1, in which the rules for changing the role are understood as a set of conditions, under which, changes are made to the user's role. 3. The method according to claim 1, which stores at least data about the name of the employee, the task and the level of its classification, the time period for the task execution, access rights corresponding to the task, the type of reporting and the user's role. 4. The method according to claim 1, in which the changes in the role are performed by changing the task, the time period for the task execution, access rights corresponding to the task.

Images