TENANT LOCKBOX

摘要

Tenant approval for operator access to tenant data is provided. In order to grant service personnel operators access to a tenant's data for performing a requested action, a lockbox determines a security group role to which an operator needs to be elevated to perform a requested action, computes a set of internal administrators and tenant administrators authorized to grant a temporary role elevation, and sends an access control request to the administrators. Upon receiving approval of the access control request from an internal administrator and a tenant administrator, the lockbox elevates the operator to the security group role, granting the operator a set of permissions needed in order to allow the operator to perform the requested action. Accordingly, tenants are enabled to control access to their data and scrutinize access requests per their company procedures and compliance needs.

主权项

1. A computer-implemented method for providing tenant approval for operator access to a tenant's data, comprising:
receiving an indication to create an access control request for temporarily elevating a role of an operator to a security group giving the operator a set of permissions for allowing the operator to perform an action on behalf of the tenant and to enable operator access to the tenant's data; creating the access control request for temporarily elevating the role of the operator; computing a set of one or more internal administrators authorized to grant a first set of permissions to temporarily elevate the role of the operator; sending the access control request to the one or more internal administrators; receiving an access control response from one of the one or more internal administrators; determining whether the access control response from the internal administrator is an approval or a rejection of the access control request; upon determining that the access control response from the internal administrator is an approval of the access control request, granting the first set of permissions to temporarily elevate the role of the operator; computing a set of one or more tenant administrators authorized to grant a second set of permissions to temporarily elevate the role of the operator; sending the access control request to the one or more tenant administrators; receiving an access control response from one of the one or more tenant administrators; determining whether the access control response from the tenant administrator is an approval or a rejection of the access control request; upon determining that the access control response from the tenant administrator is an approval of the access control request, granting the second set of permissions to temporarily elevate the role of the operator; and temporarily elevating the role of the operator to the security group giving the operator the set of permissions for allowing the operator to perform the action on behalf of the tenant and to enable operator access to the tenant's data.