Aggregate Index for Network Permission Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing user permissions in a network environment is challenging due to the large number of security identifiers (SIDs) and the distributed nature of computer networks, leading to inefficient scanning processes that consume resources and generate outdated results.
Innovation Solution
A system and method that utilize a collection server and computing devices to create and maintain an aggregate index of SIDs, associating them with resources and computing devices, allowing for efficient tracking and updating of permissions, reducing the need for comprehensive network scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the system scans the entire network to find all permissions for a user or group, then the completeness of permission information is improved, but the processing time and resource consumption increase significantly
Solution Approach 1:
The patent segments the network environment into multiple domains, each with its own index maintained by a domain controller. This allows the system to query only relevant domains rather than scanning the entire network, reducing search time while maintaining complete permission information through the distributed index structure.
Solution Approach 2:
The system performs preliminary action by pre-indexing permission information at domain controllers before queries are needed. This preliminary indexing of SID-to-computer mappings allows rapid retrieval of permission information without performing comprehensive scans at query time.
2Measurement precision
If the system performs comprehensive network scans to identify all permissions, then the accuracy of permission determination is improved, but the computational resources consumed increase
Solution Approach 1:
The patent divides the network into domains with distributed domain controllers, each maintaining a local index of SID-to-computer mappings. This segmentation allows accurate permission determination through localized queries rather than resource-intensive comprehensive scans across the entire network.
Solution Approach 2:
The system creates and maintains copies of permission index information at multiple domain controllers throughout the network. These distributed copies enable accurate permission queries without requiring access to or processing power for scanning the entire network, as each domain controller can independently answer queries from its local index.
3Reliability
If the system scans all computers to ensure no permissions are missed, then the reliability of permission tracking is improved, but the frequency of outdated results increases
Solution Approach 1:
The patent implements feedback mechanisms where domain controllers continuously update their local indices as permission changes occur. This feedback loop ensures that the index information remains current and reliable, eliminating the need for periodic comprehensive scans that would produce outdated results.
Solution Approach 2:
The system performs preliminary indexing actions at domain controllers that are continuously maintained as permissions change. This ongoing preliminary action ensures the index always reflects current permission states, providing reliable information without delay from comprehensive rescan cycles.
4Measurement precision
If the system uses customized applications to read security permissions across the network, then the thoroughness of permission identification is improved, but the disruption to other users increases
Solution Approach 1:
The patent segments the permission query operation into localized domain-level operations rather than network-wide scans. Each domain controller independently maintains and queries its own index, allowing thorough permission identification within each domain without disrupting other users across the network.
Solution Approach 2:
The system performs preliminary indexing of permission information at domain controllers, enabling thorough permission identification through quick local queries rather than disruptive comprehensive network scans. The pre-indexed data allows rapid retrieval without requiring active scanning during user operations.
Data Source
AI summary
Multi-tiered systems and methods for identifying and monitoring user permissions in a computer network are described. A data structure, such as an index, for each network device identifies all the security identifiers (SIDs) and their associated permissions for accessing the resources on the network device. Each data structure can be initially populated by scanning access control lists (ACLs) of the respective network device. A collection server in communication with the network devices stores an aggregate index that identifies the SIDs in the network and the network devices on which each SID is granted, denied or revoked one or more permissions. The individual data structures and/or aggregate index are updated based on permission changes detected through real-time or periodic monitoring. The aggregate index can also be replicated to multiple servers. In certain examples, the multi-tiered arrangement facilitates identifying the network resources for which a user has been granted, denied or revoked a permission.