Rule based data management

• US 20040010519A1
• Filed: 12/20/2002
• Published: 01/15/2004
• Est. Priority Date: 07/11/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Remahl, Thomas B., Sinn, Richard P., Tsang, Andy M.
• Granted Patent: US 7,467,142 B2
• Time in Patent Office: Days
• US Class Current: 707/200
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99952 Coherency, e.g. same view to multiple users
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

Data is acquired for an Identity System based on a one or more rules. The data can be from the same Identity System Component, another Identity System Component or a component external to the Identity System. The acquired data can be used to populate an Identity Profile, configure a workflow, or provide information to any other object, process, component, etc. of the Identity System. In one embodiment, the present invention combines dynamic identity value substitution and directory filter rules to enable rule based identity management. It enables dynamic population of identity data and real-time routing for identity management workflows. In other embodiments, the present invention can be applied to systems other than Identity Systems.

Claims

1. A method for performing rule based data management, comprising the steps of:

accessing first data from a data unit;

applying said first data to a rule;

identifying additional data based on said rule; and

adding said additional data to said data unit.

2. A method according to claim 1, wherein:

said data unit is an identity profile.

3. A method according to claim 1, wherein:

said rule includes a dynamic variable;

said method further includes reading said rule, including reading said dynamic variable;

said dynamic variable corresponds to a first attribute in said data unit; and

said first data is a value for said first attribute.

4. A method according to claim 3, wherein:

said data unit is an identity profile; and

said identity profile is stored as an object in a directory.

5. A method according to claim 4, wherein:

said step of identifying additional data includes running a query in said directory based on said rule with said first data.

6. A method according to claim 5, wherein:

said step of identifying additional data further includes reporting results of said query and receiving a selection of said results, said step of adding said additional data includes adding said selected results to said data unit.

7. A method according to claim 5, wherein:

said step of identifying additional data further includes receiving multiple results for said query; and

said step of adding said additional data includes automatically adding said multiple results to said data unit.

8. A method according to claim 3, wherein:

said rule corresponds to a second attribute of said data unit; and

said additional data is stored as a value for said second attribute.

9. A method according to claim 8, wherein:

said rule includes an attribute identification;

said step of identifying additional data includes running a query based on said rule;

said query returns results; and

said step of identifying additional data further includes accessing attributes of said results corresponding to said attribute identification, said attributes of said results corresponding to said attribute identification includes said additional data.

10. A method according to claim 9, further comprising the steps of:

receiving said rule; and

receiving said attribute identification.

11. A method according to claim 1, wherein:

said additional data includes one or more job codes.

12. A method according to claim 1, wherein:

said additional data includes an identification of a resource external to a system that is performing said steps of accessing, applying, identifying and adding.

13. A method according to claim 1, wherein:

said additional data includes an identification of a first resource.

14. A method according to claim 13, wherein:

said step of identifying includes using said rule to search for control information about a set of resources.

15. A method according to claim 13, further comprising the step of:

sending a request for said first resource in response to said step of adding.

16. A method according to claim 13, further comprising the step of:

provisioning a task related to said first resource in response to said additional data.

17. A method according to claim 1, wherein:

said data unit is an identity profile;

said rule includes a first dynamic variable for a region and a second dynamic variable for an organization;

said method further includes reading said rule, including reading said first dynamic variable and said second dynamic variable;

said first dynamic variable corresponds to a region attribute in said identity profile;

said second dynamic variable corresponds to an organization attribute in said identity profile;

said step of applying includes replacing said first dynamic variable with a value stored for said region attribute and replacing said second dynamic variable with a value stored for said organization attribute;

said step of identifying includes running a query using said rule with said value stored for said region attribute and said value stored for said organization attribute, said query returns a set of manager names; and

at least one of said manager names are added to said identity profile.

18. A method according to claim 1, wherein:

said method is at least partially performed by an Identity System.

19. A method according to claim 1, wherein:

said method is at least partially performed by an integrated Identity System and Access System.

20. A method according to claim 1, wherein:

said data unit is an identity profile; and

said identity profile is stored as an object in a directory.

21. A method for performing rule based data management, comprising the steps of:

receiving a request to create a new identity profile;

accessing a class definition for said new identity profile;

providing an interface to input values for a first set of attributes for said new identity profile;

receiving said values for said first set of attributes for said new identity profile;

accessing a rule for a particular attribute, said rule including one or more dynamic variables, said one or more dynamic variables correspond to one or more of said first set of attributes;

replacing said one or more dynamic variables with one or more of said values for said first set of attributes;

using said rule to run a query;

receiving results of said query; and

storing one or more of said results of said query for said particular attribute.

22. A method according to claim 21, wherein:

said stored one or more of said results of said query are identifications of external resources.

23. A method according to claim 21, wherein:

said stored one or more of said results of said query are data from other identity profiles.

24. A method for performing rule based data management, comprising the steps of:

adding data values for attributes of an identity profile;

access a rule for a first attribute, said rule including one or more dynamic variables;

replacing said one or more dynamic variables with one or more of said data values from said identity profile;

using said rule to identity additional data, said additional data identifies resources; and

adding said additional data to said identity profile for said first attribute.

25. A method according to claim 24, further comprising the step of:

provisioning a task for said resource based on said first attribute.

26. A method according to claim 25, wherein:

said resource is external to a system that is performing said steps of adding data values and adding said additional data.

27. A method for performing rule based data management, comprising the steps of:

accessing first data from a first data unit, said first data unit being accessed as part of a workflow;

applying said first data to a rule;

identifying additional data based on said rule; and

using said additional data to perform said workflow.

28. A method according to claim 27, wherein:

said rule includes a dynamic variable;

said method further includes reading said rule, including reading said dynamic variable;

said dynamic variable corresponds to a first attribute in said first data unit; and

said first data is a value for said first attribute.

29. A method according to claim 28, wherein:

said first data unit is an identity profile; and

said identity profile is stored as an object in a directory.

30. A method according to claim 29, wherein:

said step of identifying additional data includes running a query in said directory based on said rule with said first data.

31. A method according to claim 30, wherein:

said step of using includes providing for a first entity to perform a step of said workflow.

32. A method according to claim 27, wherein:

said step of using includes contacting entities identified with said additional data.

33. A method according to claim 27, wherein:

said step of using includes providing for a first entity to perform a step of said workflow.

34. A method according to claim 27, wherein:

said step of identifying additional data comprises performing a query based on said rule with said first data and receiving a results set from said query.

35. A method according to claim 27, wherein:

said step of identifying additional data comprises evaluating whether a second data unit satisfies said rule with said first data.

36. A method according to claim 35, further comprising the steps of:

starting said workflow; and

adding attribute data to said first data unit, said attribute data includes said first data, said step of using includes providing for a first entity to perform a step of said workflow.

37. A method according to claim 27, wherein:

said method is at least partially performed by an integrated Identity System and Access System.

38. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

accessing first data from a data unit;

applying said first data to a rule;

identifying additional data based on said rule; and

adding said additional data to said data unit.

39. One or more processor readable storage devices according to claim 38, wherein:

said data unit is an identity profile;

said rule includes a dynamic variable;

said method further includes reading said rule, including reading said dynamic variable;

said dynamic variable corresponds to a first attribute in said data unit; and

said first data is a value for said first attribute.

40. One or more processor readable storage devices according to claim 39, wherein:

said data unit is an identity profile;

said identity profile is stored as an object in a directory; and

said step of identifying additional data includes running a query in said directory based on said rule with said first data.

41. One or more processor readable storage devices according to claim 39, wherein:

said rule corresponds to a second attribute of said data unit;

said additional data is stored as a value for said second attribute;

said rule includes an attribute identification;

said step of identifying additional data includes running a query based on said rule;

said query returns results; and

said step of identifying additional data further includes accessing attributes of said results corresponding to said attribute identification, said attributes of said results corresponding to said attribute identification includes said additional data.

42. One or more processor readable storage devices according to claim 38, wherein:

said additional data includes an identification of a first resource; and

said method further includes provisioning a task related to said first resource in response to said additional data.

43. One or more processor readable storage devices according to claim 38, wherein:

said processor readable code at least partially implements an integrated Identity System and Access System.

44. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

accessing first data from a first data unit, said first data unit being accessed as part of a workflow;

applying said first data to a rule;

identifying additional data based on said rule; and

using said additional data to perform said workflow.

45. One or more processor readable storage devices according to claim 44, wherein:

said rule includes a dynamic variable;

said method further includes reading said rule, including reading said dynamic variable;

said dynamic variable corresponds to a first attribute in said first data unit; and

said first data is a value for said first attribute.

46. One or more processor readable storage devices according to claim 45, wherein:

said first data unit is an identity profile;

said identity profile is stored as an object in a directory; and

said step of identifying additional data includes running a query in said directory based on said rule with said first data.

47. One or more processor readable storage devices according to claim 45, wherein said method further comprises the steps of:

starting said workflow; and

adding attribute data to said first data unit, said attribute data includes said first data, said step of using includes providing for a first entity to perform a step of said workflow, said step of identifying additional data comprises evaluating whether a second data unit satisfies said rule with said first data.

48. One or more processor readable storage devices according to claim 44, wherein:

said processor readable code at least partially implements an integrated Identity System and Access System.

49. An Identity System, comprising:

one or more storage devices; and

one or more processor in communication with said one or more storage devices, said one or more processor perform a method comprising the steps of;

accessing first data from a data unit,

applying said first data to a rule,

identifying additional data based on said rule, and

adding said additional data to said data unit.

50. An Identity System according to claim 49, wherein:

said data unit is an identity profile;

said rule includes a dynamic variable;

said method further includes reading said rule, including reading said dynamic variable;

said dynamic variable corresponds to a first attribute in said data unit; and

said first data is a value for said first attribute.

51. An Identity System according to claim 49, wherein:

said data unit is an identity profile;

said identity profile is stored as an object in a directory; and

said step of identifying additional data includes running a query in said directory based on said rule with said first data.

52. An Identity System according to claim 49, wherein:

said additional data includes an identification of a first resource; and

said method further includes provisioning a task related to said first resource in response to said additional data.

53. An Identity System according to claim 52, further comprising:

a provisioning bridge, said provisioning bridge performs said step of provisioning a task.

54. An Identity System, comprising:

one or more storage devices; and

one or more processor in communication with said one or more storage devices, said one or more processor perform a method comprising the steps of;

accessing first data from a first data unit, said first data unit being accessed as part of a workflow,

applying said first data to a rule,

identifying additional data based on said rule, and

using said additional data to perform said workflow.

55. An Identity System according to claim 54, wherein:

said rule includes a dynamic variable;

said method further includes reading said rule, including reading said dynamic variable;

said dynamic variable corresponds to a first attribute in said first data unit; and

said first data is a value for said first attribute.

56. An Identity System according to claim 55, wherein:

said first data unit is an identity profile;

said identity profile is stored as an object in a directory; and

said step of identifying additional data includes running a query in said directory based on said rule with said first data.

57. An Identity System according to claim 55, wherein said method further comprises the steps of:

starting said workflow; and

adding attribute data to said first data unit, said attribute data includes said first data, said step of using includes providing for a first entity to perform a step of said workflow, said step of identifying additional data comprises evaluating whether a second data unit satisfies said rule with said first data.