US 12,348,521 B2
Virtual scopes for resource management
Weijie Li, Bellevue, WA (US); and Bhavesh Chandrakant Doshi, Seattle, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on May 13, 2022, as Appl. No. 17/743,702.
Prior Publication US 2023/0370466 A1, Nov. 16, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/101 (2013.01) 20 Claims
OG exemplary drawing
 
1. A method of controlling access to resource objects in a cloud-based storage system, the method comprising:
receiving an access request from a client device at an application server, the access request including information identifying a user associated with the access request, a role of the user, a requested resource for which access is requested, and a requested operation to be performed with the requested resource;
determining a virtual scope for the user by accessing a virtual scope list for the requested resource, the virtual scope list including one or more virtual scope entries, each of the one or more virtual scope entries identifying at least one user and defining a virtual scope of access for the at least one user, the virtual scope defining a scope of operations permitted for the user and the virtual scope being independent of any operations permitted to users based on roles of the users as defined by a role-based access control system;
determining an access scope for the role of the user according to the role-based access control system by accessing an access control list for the requested resource, the access control list including one or more access control entries, each of the one or more access control entries identifying at least one role and defining an access scope for the at least one role, the access scope defining a scope of operations permitted for the role of the user;
determining whether the requested operation is in the virtual scope of operations permitted for the user and the access scope of operations permitted for the role of the user;
when the requested operation is in the virtual scope of operations for the user and in the access scope of operations for the role of the user, granting the user access to the requested resource to perform the requested operation; and
when the requested operation either is not in the virtual scope of the user or is not in the access scope of the role of the user, denying the user access to the requested resource to perform the requested operation.