SYSTEM AND METHOD FOR MANAGING USER PROFILES

• US 20070214144A1
• Filed: 05/16/2007
• Published: 09/13/2007
• Est. Priority Date: 04/26/2001
• Status: Active Grant

• Current Assignee: General Electric Company
• Original Assignee: General Electric Company
• Inventors: Basu, Subroto, Lawson, Robert, Creekmore, Mark
• Granted Patent: US 7,730,092 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A system and a method for managing user and data profiles utilizing a web-enabled interactive database to organize, store and retrieve the information to create a consistent security model through centralized administration, are disclosed. The system captures various rules and pre-determined methodologies to provide on-line, up-to-date decisions to the users when users request access to a set of specific data or an application. The system further provides the capability to the user to request access to information that the user currently does not have access to, tracks the status of the request, obtains approval/disapproval decision from the data owner, implements the decision, and notifies requester within a reasonable time.

Claims

1-4. -4. (canceled)

5. A method for managing user profile information, including managing access control to applications and data by implementing a level of security across the different applications that is the same for each application, using a web-based system that includes a server system coupled to a centralized interactive database and at least one client system, said method comprising the steps of:

providing capabilities for a user to request access to information that the user currently does not have access to;

tracking a status of a request using a tracking component coupled to the centralized interactive database;

determining whether to grant the user access to a user requested application from an owner of the application requested;

implementing the decision comprising;

if the user is denied access to the application, notifying the user of the denial to access the application;

if the user is granted access to the application, determining whether to grant the user access to a set of specific data within the application after completing an evaluation based on the electronic profiles, pre-determined rules, and operating methodology in response to a request from the user for access to the set of specific data;

if the user is denied access to the set of specific data;

prompting the user to complete a request for quick approval wherein the request for quick approval includes a list of data for approval;

automatically determining, using an internal exception access process an approval or a disapproval of quick access based on pre-established criteria and the list of data for approval;

if the request for quick approval is approved, at least one of automatically adding a rule to the centralized interactive database and automatically adding the user to the centralized interactive database for access to the set of specific data;

if the rule is added, updating an exception list;

if the user is added, updating the centralized interactive database to permit the user access to the set of specific data;

notifying the user of the approval of the request for quick approval;

if the request for quick approval is denied, notifying the user of the denial of the request for quick approval; and

if the user is granted access to the set of specific data, making the set of specific data available to the user.

7. A method according to claim 5 wherein said implementing the decision further includes reviewing and auditing the user access.

8. A method according to claim 5 wherein said implementing the decision further includes creating a consistent security model that includes centralized administration of security of the system and uses single user profile and privilege for accessing different applications.

9. A method according to claim 5 further comprising:

creating user profiles;

providing access control to data associated with user profiles;

defining permissions based on a user identifier associated with user profiles; and

developing a specification for user interfaces.

10. A method according to claim 5 further comprising providing administration of a common security model for access control and event notification.

11. A method according to claim 5 further comprising updating profiles automatically on at least one of a pre-determined timed interval and a change in organization hierarchy.

12. A method according to claim 5 further comprising updating profiles automatically when a user transfers departments.

13. A method according to claim 5 further comprising generating access list reports that identify accessible and non-accessible data and restrictions for access.

14. A method according to claim 5 further comprising retrieving information from the centralized interactive database in response to a specific inquiry from an administrator.

15. A method according to claim 5 wherein the client system and the server system are connected via a network and wherein the network is one of a wide area network, a local area network, an intranet and the Internet.

21. A method according to claim 9 wherein said creating user profiles comprises creating an electronic profile based on information available from at least one an Oracle Human Resource Application and a Request for Computer Access Application.

22. A method according to claim 5 further comprising creating data profiles.

23. A method according to claim 22 wherein creating data profiles is based on at least one of Data Elements, Data Tags, Rules of Access, an Approver'"'"'s Name for Each Rule of Access, Rules of Exclusion, an Exception List, and Field Tags.

24. A method according to claim 5 further comprising establishing rules based on at least one of Rule Based Access guidelines, Group Based Access guidelines, Search &

Subscribe Utilities guidelines, Active Positioning Monitoring guidelines, Hard Exclusion Rules guidelines, and Access Audits guidelines.

25. A method according to claim 5 further comprising establishing access methods, wherein the access methods ensure timely and accurate decision making.

26. A method according to claim 25 wherein said establishing access methods is based on criteria established by system administrators.

6. (canceled)

16. A computer-implemented database embodied on a computer-readable medium configured to be protected from access by unauthorized individuals by managing user and data profiles by an administrator, said database providing access to users based on pre-determined rules and criteria further comprising:

pre-established criteria data developed from access rules and criteria including at least one of Rule Based Access guidelines, Group Based Access guidelines, Search &

Subscribe Utilities guidelines, Active Positioning Monitoring guidelines, Hard Exclusion Rules guidelines, and Access Audits guidelines;

applications data including system administrator defined attributes that cross-references the applications profile data against unique identifiers;

user data that includes a user'"'"'s organization and citizenship, that cross-references the users profile data against unique identifiers; and

pre-determined rules and methodologies data that facilitates accurate user access decision making.

17-20. -20. (canceled)