RECONCILIATION OF ACCESS RIGHTS IN A COMPUTING SYSTEM

• US 20140289796A1
• Filed: 05/01/2014
• Published: 09/25/2014
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Moloian, Armen, Ritchey, Ronald W.
• Granted Patent: US 9,477,838 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 10/08 Logistics, e.g. warehousing, loading or distribution; Inventory or stock management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Systems and methods are provide for reconciling access rights of a computing system are described. Access right information that respectively corresponds to access rights of a computing system may be obtained and evaluated. Reconciliation tasks may be performed using the access right information, and a reconciliation report may be generated during performance of at least one of the reconciliation tasks. The reconciliation report may indicate that one or more of the access rights should either be provisioned or revoked at the computing system.

Claims

1. A system for reconciling access rights of a computing system comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the system to

obtain access right information respectively corresponding to one or more access rights of a computing system;

perform one or more reconciliation tasks using the access right information, and

generate a reconciliation report during performance of one of the reconciliation tasks;

wherein the reconciliation report indicates that one or more of the access rights should either be provisioned or revoked at the computing system.

2. The system of claim 1 wherein:

the one or more reconciliation tasks include a reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, cause the system to

obtain an access report that identifies a set of reported access rights that were used to access a computing resource of the computing system,

obtain an access request list that identifies a set of requested access rights, and

generate the reconciliation report based on a comparison between the at least one of the reported access rights and at least one of the requested access rights.

3. The system of claim 2 wherein:

generating the reconciliation report includes identifying one of the reported access rights as either an expected access right or an unexpected access right in the reconciliation report based on whether that reported access right corresponds to one of the requested access rights.

4. The system of claim 2 wherein:

generating the reconciliation report includes identifying one of the requested access rights as either a provisioned access right or a non-provisioned access right in the reconciliation report based on whether that requested access right corresponds to one of the reported access rights.

5. The system of claim 1 wherein:

the one or more reconciliation tasks include a reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, cause the system to

obtain an access rights history that identifies a set of historical access rights associated with a user,

obtain an access right revocation list that identifies a set of fulfilled access revocation requests associated with the user, and

generate the reconciliation report based on a comparison between at least one of the historical access rights and at least one of the fulfilled access revocation requests.

6. The system of claim 5 wherein:

generating the reconciliation report includes identifying one of the historical access rights as either a successfully revoked access right or an unsuccessfully revoked access right in the reconciliation report based on whether that historical access right corresponds to one of the fulfilled access revocation requests.

7. The system of claim 1 wherein:

the one or more reconciliation tasks include a reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, cause the system to

obtain an access rights history that identifies a set of provisioned access rights associated with a user,

obtain an access right grant list that identifies a set of approved access grant requests associated with the user, and

generate the reconciliation report based on a comparison between at least one of the provisioned access rights and at least one of the approved access grant request.

8. The system of claim 7 wherein:

generating the reconciliation report includes identifying one of the provisioned access rights either as an approved access right or an unapproved access right in the reconciliation report based on whether that provisioned access right corresponds to one of the approved access grant request.

9. The system of claim 1 wherein:

the one or more reconciliation tasks include a reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, cause the system to

obtain an access report that identifies a plurality of users that are each associated with one of the access rights,

obtain attribute information corresponding to one or more attributes of the plurality of users,

select one of the users of the plurality of users,

generate the reconciliation report based on a comparison between attribute information associated with the user selected and attribute information respectively associated with one or more other users of the plurality of users.

10. The system of claim 9 wherein:

generating the reconciliation report includes

calculating an attribute deviation score based on the comparison between the attribute information associated with the user selected and the attribute information respectively associated with one or more other users,

determining whether to identify the user selected as an outlier in the reconciliation report based on a comparison of the attribute deviation score to a predetermined attribute deviation threshold.

11. A computer-implemented method of reconciling access rights of a computing system comprising:

obtaining access right information respectively corresponding to one or more access rights of a computing system;

performing one or more reconciliation tasks using the access right information; and

generating a reconciliation report during performance of one of the reconciliation tasks wherein the reconciliation report indicates that one or more of the access rights should either be provisioned or revoked at the computing system.

12. The computer-implemented method of claim 11 wherein the one or more reconciliation tasks include a reconciliation task comprising:

obtaining an access report that identifies a set of reported access rights that were used to access a computing resource of the computing system;

obtaining an access request list that identifies a set of requested access rights of the computing system; and

comparing at least one of the reported access rights to at least one of the requested access rights.

13. The computer-implemented method of claim 12 wherein the reconciliation task further comprises:

identifying one of the reported access rights as either an expected access right or an unexpected access right in the reconciliation report based on whether that reported access right corresponds to one of the requested access rights.

14. The computer-implemented method of claim 12 wherein the reconciliation task further comprises:

identifying one of the requested access rights as either a provisioned access right or a non-provisioned access right in the reconciliation report based on whether that requested access right corresponds to one of the reported access rights.

15. The computer-implemented method of claim 11 wherein the one or more reconciliation tasks include a reconciliation task comprising:

obtaining an access rights history that identifies a set of historical access rights associated with a user;

obtaining an access right revocation list that identifies a set of fulfilled access revocation requests associated with the user;

comparing at least one of the historical access rights to at least one of the fulfilled access revocation requests; and

identifying one of the historical access rights as either a successfully revoked access right or an unsuccessfully revoked access right in the reconciliation report based on whether that historical access right corresponds to one of the access revocation requests.

16. The computer-implemented method of claim 11 wherein the one or more reconciliation tasks include a reconciliation task comprising:

obtaining an access rights history that identifies a set of provisioned access rights associated with a user;

obtaining an access right grant list that identifies a set of approved access grant requests associated with the user;

comparing at least one of the provisioned access rights to at least one of the approved access grant requests; and

identifying one of the provisioned access rights as either an approved access right or an unapproved access right in the reconciliation report based on whether that provisioned access right corresponds to one of the approved access requests.

17. The computer-implemented method of claim 11 wherein the one or more reconciliation tasks include a reconciliation task comprising:

obtaining an access report that identifies a plurality of users that are each associated with one of the access rights;

obtaining attribute information corresponding to one or more attributes of the plurality of users;

selecting one of the users of the plurality of users;

comparing attribute information associated with the user selected to attribute information respectively associated with one or more other users of the plurality of users;

calculating an attribute deviation score based on the comparison between the attribute information associated with the user selected and the attribute information respectively associated with one or more other users; and

determining whether to identify the user selected as an outlier in the reconciliation report based on a comparison of the attribute deviation score to a predetermined attribute deviation threshold.

18. Non-transitory computer-readable media having instructions, that when executed by a processor of a computing device, cause the computing device to:

obtain access right information respectively corresponding to one or more access rights of a computing system;

perform one or more reconciliation tasks using the access right information; and

generate a reconciliation report during performance of one of the reconciliation tasks wherein the reconciliation report indicates that one or more of the access rights should either be provisioned or revoked at the computing system.

19. The computer-readable media of claim 18 wherein:

the one or more reconciliation tasks include

a first reconciliation task that comprises at least one of i) determining whether an access right reported as having been used by a user corresponds to an access right requested to be provisioned for that user and ii) determining whether an access right requested to be provisioned for a user corresponds to an access right reported as having been used by that user,

a second reconciliation task that comprises determining whether an access right associated with a user corresponds to a fulfilled request to revoke that access right from that user,

a third reconciliation task that comprises determining whether an access right provisioned for a user corresponds to an approved request to provision that access right for that user, and

a fourth reconciliation task that comprises determining whether a user associated with an access right has one or more attributes that deviate from corresponding attributes of one or more other users that are also associated with that access right based on a deviation score that quantifies a difference between the attributes associated with the user and the corresponding attributes associated with the one or more other users.

20. The computer-readable media of claim 19 wherein:

the reconciliation report includes a plurality of report sections; and

individual report sections of the reconciliation report respectively correspond to one of the one or more reconciliation tasks performed.