PRIVILEGED ACCOUNT MANAGER, MANAGED ACCOUNT PERSPECTIVES

• US 20130086060A1
• Filed: 05/31/2012
• Published: 04/04/2013
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Wilcox, Mark Edward, Ho, Fannie, Donley, Clayton, Phillips, Duncan V., Chou, Ming-Yau, Moscovitz, Tal
• Granted Patent: US 9,129,105 B2
• Time in Patent Office: Days
• US Class Current: 707/736
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques for managing accounts are provided. An access management system may check out credentials for accessing target systems. For example a user may receive a password for a period of time or until checked back in. Access to the target system may be logged during this time. Upon the password being checked in, a security account may modify the password so that the user may not log back in without checking out a new password. Additionally, in some examples, password policies for the security account may be managed. As such, when a password policy changes, the security account password may be dynamically updated. Additionally, in some examples, hierarchical viewing perspectives may be determined and/or selected for visualizing one or more managed accounts. Further, accounts may be organized into groups based on roles, and grants for the accounts may be dynamically updated as changes occur or new accounts are managed.

Claims

1. An account management system, comprising:

a memory storing a plurality of instructions; and

one or more processors configured to access the memory, wherein the one or more processors are further configured to execute the plurality of instructions to;

receive, from an administrator account, identification of a plurality of accounts of a target system, at least one of the plurality of the accounts of the target system managed by the account management system; and

prepare, for display to a user account, at least one of the plurality of accounts of the target system in a user-configurable hierarchical view.

2. The system of claim 1, wherein the administrator account is associated with the account management system and acts on behalf of the target system.

3. The system of claim 1, wherein the user account is associated with an application for accessing the target system.

4. The system of claim 1, wherein the one or more processors are further configured to execute the plurality of instructions to receive, from the administrator account, an attribute/value pair for at least one of each of the plurality of accounts.

5. The system of claim 4, wherein the attribute comprises a geographic attribute, a functional attribute, a domain attribute, or a user-defined attribute.

6. The system of claim 4, wherein the value comprises a location, an account function, a domain name, or a user-defined value associated with the at least one of each of the plurality of accounts.

7. The system of claim 4, wherein the one or more processors are further configured to execute the plurality of instructions to receive, from the user account, a perspective selection for viewing the plurality of accounts based at least in part on the attribute/value pair.

8. The system of claim 7, wherein the display of the at least one of the plurality of accounts of the target system in the user-configurable view is based at least in part on the selected perspective.

9. A computer-implemented method, comprising:

receiving, by a computer system, identification of a plurality of accounts of a target system from an administration account, the plurality of the accounts of the target system managed by an account management server of the computer system;

receiving, by the computer system, a tag for at least one of the plurality of accounts of the target system from the administration account;

receiving, by the computer system, a perspective selection from a user account; and

preparing, by the computer system, the at least one of the plurality of accounts of the target system for display, to a user of the user account, in a user-defined hierarchical view.

10. The computer-implemented method of claim 9, wherein the tag comprises at least one of an attribute or a value associated with the attribute.

11. The computer-implemented method of claim 9, wherein displaying the at least one of the plurality of accounts is based at least in part on the tag.

12. The computer-implemented method of claim 9, wherein displaying the at least one of the plurality of accounts is based at least in part on the perspective selection.

13. The computer-implemented method of claim 9, further comprising registering, by the computer system, the plurality of the accounts of the target system with the account management server.

14. The computer-implemented method of claim 13, wherein displaying the at least one of the plurality of accounts of the target system to the user comprises only displaying registered accounts.

15. A computer-readable memory storing a plurality of instructions executable by one or more processors, the plurality of instructions comprising:

instructions that cause the one or more processors to receive, from an administrative account, information associated with a plurality of managed accounts of a target system, the plurality of managed accounts of the target system managed by an account management system;

instructions that cause the one or more processors to receive, from the administrative account, tags for the plurality of managed accounts of the target system;

instructions that cause the one or more processors to receive, from a user account, a selection of a perspective out of a plurality of perspectives based at least in part on the tags; and

instructions that cause the one or more processors to display the plurality of managed accounts of the target system based at least in part on at least one of the tags or the perspective.

16. The computer-readable memory of claim 15, wherein the tag comprises at least one of an attribute or a value associated with the attribute.

17. The computer-readable memory of claim 16, wherein the attribute comprises a geographic attribute, a functional attribute, a domain attribute, or a user-defined attribute.

18. The computer-readable memory of claim 16, wherein the value associated with the attribute comprises a location, an account function, a domain name, or a user-defined value.

19. The computer-readable memory of claim 15, the plurality of instructions further comprising instructions that cause the one or more processors to register, with the account management system, the target system.

20. The computer-readable memory of claim 15, the plurality of instructions further comprising instructions that cause the one or more processors to register, with the account management system, the plurality of accounts of the target system.