Centralized authenticating abstraction layer with adaptive assembly line pathways

• US 10,645,087 B2
• Filed: 06/06/2017
• Issued: 05/05/2020
• Est. Priority Date: 06/06/2017
• Status: Active Grant

• Current Assignee: Amgen Inc.
• Original Assignee: Amgen Inc.
• Inventors: Mott, Spencer
• Primary Examiner(s): Murphy, J. Brant
• Application Number:
  US15/615,305
• Publication Number:
  US 20180351957A1
• Time in Patent Office: 1,064 Days
• CPC Class Codes: G06F 16/2452 Query translation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

Systems and methods for cloud based computing systems and, more particularly, techniques for providing centralized user access to network connected computing systems are disclosed. A method for handling access commands originating from at least one source application utilizing a first format, to at least one destination application utilizing a second format is disclosed. The method comprises receiving an access command from a user using at least one source application, and determining a type for the access command based on a data payload. Generating an action based on the type for the access command and the data payload, and translating the data payload into a common format, wherein the common format is determined using the first format and the second format. Lastly, responding to the access command using the translated data payload and action, wherein the response addresses the request for user access to the network connected computing systems.

Claims

1. A computer implemented method for handling access commands originating from at least one source application utilizing a first format, directed to at least one destination application utilizing a second format, the method comprising:

receiving, at a processor, an access command from a user using the at least one source application, wherein the access command includes a data payload structured according to the first format, and the at least one destination application for the data payload;

determining, at the processor, a type for the access command based on the data payload;

generating, at the processor, an action based on the type for the access command and the data payload;

translating, at the processor, the data payload into a common format, wherein the common format is determined using the first format and the second format, and comprises identifying information on the user, the at least one source application, and the at least one destination application;

responding, at the processor, to the access command using the action and the translated data payload;

accessing, at the processor, an application programming interface, wherein the application programming interface comprises a set of protocols; and

translating, at the processor, the data payload into the common format according to the set of protocols in the application programming interface.

2. The computer implemented method of claim 1, wherein the access command is a request to modify rights, privileges, resources, or combinations thereof, assigned to the user.

3. The computer implemented method of claim 2, wherein the request to modify is a request to on-board the user to the at least one destination application, or a request to off-board the user from the at least one destination application.

4. The computer implemented method of claim 1, wherein the access command is a request to perform a task for the user.

5. The computer implemented method of claim 1, wherein the action comprises modifying, at the processor, rights, privileges, resources, or combinations thereof, to the user.

6. The computer implemented method of claim 1, wherein generating the action further comprises:

generating, at the processor, a dynamic identity score for the user, wherein the dynamic identity score is based on a set of user characteristics; and

generating, at the processor, the action based on the dynamic identity score for the user.

7. The computer implemented method of claim 6, wherein the set of user characteristics comprises user identifiable information, user type, and user group membership, or combinations thereof.

8. The computer implemented method of claim 6, wherein if the dynamic identity score is above a threshold level the action is granted, and wherein if the dynamic identity score is below a threshold level the action is denied.

9. The computer implemented method of claim 1, wherein generating the action further comprises:

generating, at the processor, a dynamic identity score for the user, wherein the dynamic identity score is based on a set of system characteristics; and

generating, at the processor, the action based on the dynamic identity score for the user.

10. The computer implemented method of claim 9, wherein the set of system characteristics comprises current runtime statistics on a requested computer application, a current number of authorized users for the requested computer application, and a threshold level of users for the requested computer application.

11. The computer implemented method of claim 10, wherein if the dynamic identity score is above a threshold level the action is granted, and wherein if the dynamic identity score is below a threshold level the action is denied.

12. The computer implemented method of claim 1, wherein responding to the access command further comprises:

transmitting, at the processor, a notification to the user regarding the access command; and

transmitting, at the processor, the translated data payload and action to the at least one destination application.

13. The computer implemented method of claim 12, wherein transmitting the notification to the user occurs after receiving, at the processor, confirmation of the action being executed by the at least one destination application.

14. The computer implemented method of claim 1, wherein translating the data payload into a common format comprises:

accessing, at the processor, a tailored lookup table, wherein the tailored lookup table comprises a set of application entries and translation values corresponding to the at least one source application and the at least one destination application; and

translating, at the processor, the data payload according to the translation values for the at least one source application and the at least one destination application.

15. The computer implemented method of claim 1, wherein responding to the access command using the action comprises:

granting or denying, at the processor, the action based on a set of decisional control rules for the at least one destination application.

16. A non-transitory computer readable medium, which stores non-transitory computer executable instructions for handling access commands originating from at least one source application utilizing a first format, directed to at least one destination application utilizing a second format, the computer executable instructions comprising:

receiving an access command from a user using the at least one source application, wherein the access command includes a data payload structured according to the first format, and the at least one destination application for the data payload;

determining a type for the access command based on the data payload;

generating an action based on the type for the access command and the data payload;

translating the data payload into a common format, wherein the common format is determined using the first format and the second format;

responding to the access command using the action and the translated data payload;

accessing an application programming interface, wherein the application programming interface comprises a set of protocols; and

translating the data payload into the common format according to the set of protocols in the application programming interface.

17. The non-transitory computer readable medium of claim 16, wherein the access command is a request to modify rights, privileges, resources, or combinations thereof, assigned to the user.

18. The non-transitory computer readable medium of claim 17, wherein the request to modify is a request to on-board the user to the at least one destination application, or a request to off-board the user from the at least one destination application.

19. The non-transitory computer readable medium of claim 16, wherein the access command is a request to perform a task for the user.

20. The non-transitory computer readable medium of claim 16, wherein the action comprises modifying, at the processor, rights, privileges, resources, or combinations thereof, to the user.

21. The non-transitory computer readable medium of claim 16, wherein generating the action further comprises:

generating a dynamic identity score for the user, wherein the dynamic identity score is based on a set of user characteristics; and

generating the action based on the dynamic identity score for the user.

22. The non-transitory computer readable medium of claim 16, wherein responding to the access command further comprises:

transmitting a notification to the user via the at least one source application regarding the access command; and

transmitting the translated data payload and action to the at least one destination application.

23. A system for handling access commands originating from at least one source application utilizing a first format, directed to at least one destination application utilizing a second format, the system comprising:

a user interface configured to communicate with a user;

a memory configured to store non-transitory computer executable instructions; and

a processor configured to interface with the memory and the user interface, wherein the processor is configured to execute the non-transitory computer executable instructions to cause the processor to;

receive an access command from the user using the at least one source application, wherein the access command includes a data payload structured according to the first format, and the at least one destination application for the data payload;

determine a type for the access command based on the data payload;

generate an action based on the type for the access command and the data payload;

translate the data payload into a common format, wherein the common format is determined using the first format and the second format;

respond to the access command using the action and the translated payload;

access, at the processor, an application programming interface, wherein the application programming interface comprises a set of protocols; and

translate, at the processor, the data payload into the common format according to the set of protocols in the application programming interface.

24. The system of claim 23, wherein the access command is a request to modify rights, privileges, resources, or combinations thereof, assigned to the user.

25. The system of claim 24, wherein the request to modify is a request to on-board the user to the at least one destination application, or a request to off-board the user from the at least one destination application.

26. The system of claim 23, wherein the action comprises granting, or revoking, at the processor, rights, privileges, resources, or combinations thereof, to the user.

27. The system of claim 23, wherein to generate the action, the processor is further configured to:

generate a dynamic identity score for the user, wherein the dynamic identity score is based on a set of user characteristics; and

generate the action based on the dynamic identity score for the user.

28. The system of claim 23, wherein to respond to the access command, the processor is further configured to:

transmit a notification to the user regarding the access command; and

transmit the translated data payload and action to the at least one destination application.