Methods, Systems and Computer Program Products for Identity and Access Management

• US 20110162047A1
• Filed: 12/30/2009
• Published: 06/30/2011
• Est. Priority Date: 12/30/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Johnson, Michael, Reeves, Allison, Toretti, Gary, Kirkpatrick, Michael
• Granted Patent: US 9,893,955 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Methods of managing access to systems of an organization are provided. The methods include creating a unique identifier for a user, the unique identifier having an associated user profile for the user and being stored with the associated user profile in an identifier repository associated with the organization; requesting at least one account for the user on at least one system of the organization responsive to the creation of the unique identifier for the user, wherein the at least one account is defined based on the user profile of the user associated with the unique identifier; and generating the at least one account for the user on the at least one system of the organization responsive to the request. Related systems and computer program products are also provided herein.

Claims

1. A method of managing access to systems of an organization, comprising:

creating a unique identifier for a user, the unique identifier having an associated user profile for the user and being stored with the associated user profile in an identifier repository associated with the organization;

requesting at least one account for the user on at least one system of the organization responsive to the creation of the unique identifier for the user, wherein the at least one account is defined based on the user profile of the user associated with the unique identifier; and

generating the at least one account for the user on the at least one system of the organization responsive to the request.

2. The method of claim 1, further comprising:

detecting a change in the user profile; and

adding and/or removing access to at least one account on the at least one system of the organization responsive to the detected change the user profile.

3. The method of claim 2, wherein detecting a change in the user profile comprises detecting termination of the user and wherein the method further comprises:

deleting the at least one account of the user on the at least one system responsive to the detected termination; and

removing the unique identifier associated with the user from the identifier repository.

4. The method of claim 3, wherein requesting, generating, detecting, adding and/or removing, deleting and/or removing are performed automatically without user intervention.

5. The method of claim 1, further comprising:

receiving a request to change and/or reset a password associated with a selected one of the at least one account for the at least one system; and

changing and/or resetting the password associated with the selected one.

6. The method of claim 1, wherein generating is followed by providing account information associated with the at least one account to the user so as to allow the user to access the at least one system associated with the at least one account.

7. The method of claim 1, wherein storing the unique identifier in the identifier repository comprises storing unique identifiers for all users of the systems of the organization in the identifier repository.

8. An access management system for an organization, the system comprising:

an identifier creation module configured to create a unique identifier for a user, the unique identifier having an associated user profile for the user;

an identifier repository associated with the organization and configured to store the unique identifier and the associated user profile;

an account requestor module configured to request at least one account for the user on at least one system of the organization responsive to the creation of the unique identifier for the user, wherein the at least one account is defined based on the user profile of the user associated with the unique identifier; and

an account generation module configured to generate the at least one account for the user on the at least one system of the organization responsive to the request.

9. The system of claim 8:

wherein the account requestor module is further configured to detect a change in the user profile; and

wherein the account generation module is further configured to add and/or remove access to at least one account on the at least one system of the organization responsive to the detected change the user profile.

10. The system of claim 9:

wherein the detected change in the user profile comprises termination of the user;

wherein the account generation module is further configured to;

delete the at least one account of the user on the at least one system responsive to the detected termination; and

remove the unique identifier associated with the user from the identifier repository.

11. The system of claim 10, wherein the account requestor module and the account generation module are configured to function automatically without user intervention.

12. The system of claim 8:

wherein the requestor module is further configured to receive a request to change and/or reset a password associated with a selected one of the at least one account for the at least one system; and

wherein the account generation module is configured to change and/or reset the password associated with the selected one.

13. The system of claim 8, wherein the account requestor module is further configured to provide account information associated with the at least one account to the user so as to allow the user to access the at least one system associated with the at least one account.

14. A computer program product for managing access to systems of an organization, comprising:

a computer readable storage medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to create a unique identifier for a user, the unique identifier having an associated user profile for the user and being stored with the associated user profile in an identifier repository associated with the organization;

computer readable program code configured to request at least one account for the user on at least one system of the organization responsive to the creation of the unique identifier for the user, wherein the at least one account is defined based on the user profile of the user associated with the unique identifier; and

computer readable program code configured to generate the at least one account for the user on the at least one system of the organization responsive to the request.

15. The computer program product of claim 14, further comprising:

computer readable program code configured to detect a change in the user profile; and

computer readable program code configured to add and/or remove access to at least one account on the at least one system of the organization responsive to the detected change the user profile.

16. The computer program product of claim 15, wherein the computer readable program code configured to detect a change in the user profile comprises computer readable program code configured to detect termination of the user and wherein the computer program product further comprising:

computer readable program code configured to delete the at least one account of the user on the at least one system responsive to the detected termination; and

computer readable program code configured to remove the unique identifier associated with the user from the identifier repository.

17. The computer program product of claim 16, wherein the computer readable program code configured to request, generate, detect, add and/or remove, delete and/or remove are performed automatically without user intervention.

18. The computer program product of claim 14, wherein the computer program product further comprises:

computer readable program code configured to receive a request to change and/or reset a password associated with a selected one of the at least one account for the at least one system; and

computer readable program code configured to change and/or reset the password associated with the selected one.

19. The computer program product of claim 14, further comprising computer readable program code configured to provide account information associated with the at least one account to the user so as to allow the user to access the at least one system associated with the at least one account.

20. The computer program product of claim 14, further comprising computer readable program code configured to store all unique identifiers for all users of the systems of the organization in the identifier repository.