Self-service resource provisioning having collaborative compliance enforcement

• US 7,707,623 B2
• Filed: 10/24/2006
• Issued: 04/27/2010
• Est. Priority Date: 10/24/2006
• Status: Active Grant

• Current Assignee: Avatier Corporation
• Original Assignee: Avatier Corporation
• Inventors: Barron, Billy J., Cicchitto, Nelson A., Chiou, Scott L.
• Primary Examiner(s): Nalven; Andrew L
• Application Number:
  US11/552,259
• Publication Number:
  US 20080098484A1
• Time in Patent Office: 1,281 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Exemplary embodiments provide a method and system for self-service resource provisioning having collaborative compliance enforcement. Method and system aspects of the exemplary embodiments include displaying a hierarchical list of resources for selection of at least one privilege associated with the resources; in response to a user selecting least one of the privileges from the hierarchical list, adding the selected privilege to a request cart to enable the user to initiate a request for the privilege; and in response to a user submitting the request cart, automatically invoking a workflow process to approve a request for the privilege, wherein the workflow is dynamically generated at least in part from the structure of the hierarchical list of resources and a location of the privilege within the hierarchical list.

Claims

1. A computer-implemented method for providing self-service resource provisioning having collaborative compliance enforcement, comprising:

displaying a hierarchical list of resources for selection of at least one of a plurality of privileges associated with the resources;

in response to a user selecting at least one of the privileges from the hierarchical list, adding the selected privilege to a request cart to enable the user to initiate a request for the privilege; and

in response to a user submitting the request cart, automatically invoking a workflow process to approve a request for the privilege, wherein the workflow is dynamically generated at least in part from a structure of the hierarchical list of resources and a location of the privilege within the hierarchical list,

wherein approval for the request of the privilege is granted by requesting approval from a chain of one or more people associated with the privilege and its corresponding resource as defined by the structure of the hierarchical list;

wherein once the request for the privilege is submitted for a target user, the workflow process initiates a chain of approval by first sending a request for approval to a manager of the target user, then sending respective requests for approval to a manager of the privilege and a manager of the resource to which the privilege is linked in the hierarchical list; and

wherein the workflow process is configured such that a countdown timer having a designated duration is associated with each privilege in the hierarchical list, wherein once the request for the privilege is submitted the corresponding countdown timer is started, and as the countdown timer begins to expire, the workflow low process sends approval request reminders at increasingly rapid intervals to the managers who have yet to respond.

2. The method of claim 1 wherein the workflow process associated with each privilege is derived from the location of the privilege in the hierarchical list, such that if the privilege is moved to a different location in the hierarchical list, then the workflow process is automatically changed.

3. The method of claim 2 further including determining if the requested privilege is special such that the privilege requires further approval by a person within a designated position of an organization/enterprise providing the self-provisioning resource process, and if so, then requesting further approval from the person having the designated position associated with granting of the special privilege.

4. The method of claim 3 wherein the request for the privilege is granted or denied based on responses received from the managers.

5. The method of claim 4 further including denying the request for the privilege if any of the managers requested to approve the request for the privilege deny the request, and granting the request for the privilege if each one of the managers requested to approve the request for the privilege approve the request.

6. The method of claim 1 wherein the workflow process sends requests for approvals to the managers using electronic messages.

7. The method of claim 1 wherein the workflow process serially sends each request for approval to the managers based on a hierarchy of the workflow such that a request for approval is not sent out to a manager associated with one level the hierarchical list until a response is received the manager on a next lower-level of the hierarchical list.

8. The method of claim 1 wherein the workflow sends all the requests for approvals to the managers at one time.

9. The method of claim 1 wherein the workflow process allows the user to view a progress of pending workflow processes initiated by the user.

10. The method of claim 1 wherein a privilege comprises at least one of a permission to perform an action with respect to an associated resource, and a grantable attribute of the resource.

11. The method of claim 1 wherein the hierarchal list of resources includes multiple levels of resources, sub-resources, and privileges, wherein privileges occupy leaf nodes of the hierarchical list of resources.

12. The method of claim 1 wherein the hierarchical list of resources is displayed in a graphical user interface comprising a window with two panes, wherein one pane displays the hierarchal list of resources, and a second pane displays the request cart, such that the user can add a particular privilege to the request cart by dragging and dropping the privilege from the hierarchical resource list into the request cart.

13. The method of claim 1 wherein the self-service provisioning process is used by an organization/enterprise, and wherein users of the self-service provisioning process include both members of the organization/enterprise and non-members of the organization/enterprise, wherein the members of the organization/enterprise include at least one of as officers, employees, and contractors, and the non-members include at least one of vendors, customers, and guests.

14. The method of claim 1 wherein the self-service provisioning process is used by an organization/enterprise, and wherein actual granting of the privilege is performed by at least one of the organization/enterprise, and a third-party.

15. An executable software product stored on a computer-readable medium containing program instructions for providing self-service resource provisioning having collaborative compliance enforcement, the program instructions for:

displaying a hierarchical list of resources for selection of at least one of a plurality of privileges associated with the resources;

in response to a user selecting at least one of the privileges from the hierarchical list, adding the selected privilege to a request cart to enable the user to initiate a request for the privilege; and

in response to a user submitting the request cart, automatically invoking a workflow process to approve a request for the privilege, wherein the workflow is dynamically generated at least in part from a structure of the hierarchical list of resources and a location of the privilege within the hierarchical list,

wherein approval for the request of the privileqe is granted by requesting approval from a chain of one or more people associated with the privilege and its corresponding resource as defined by the structure of the hierarchical list;

wherein once the request for the privilege is submitted for a target user, the workflow process initiates a chain of approval by first sending a request for approval to a manager of the target user, then sending respective requests for approval to a manager of the privilege and a manager of the resource to which the privilege is linked in the hierarchical list; and

wherein the workflow process is configured such that a countdown timer having a designated duration is associated with each privilege in the hierarchical list, wherein once the request for the privilege is submitted the corresponding countdown timer is started, and as the countdown timer begins to expire, the workflow process sends approval request reminders at increasingly rapid intervals to the managers who have yet to respond.

16. The executable software product of claim 15 wherein the workflow process associated with each privilege is derived from the location of the privilege in the hierarchical list, such that if the privilege is moved to a different location in the hierarchical list, then the workflow process is automatically changed.

17. The executable software product of claim 16 further including determining if the requested privilege is special such that the privilege requires further approval by a person within a designated position of an organization/enterprise providing the self-provisioning resource process, and if so, then requesting further approval from the person having the designated position associated with granting of the special privilege.

18. The executable software product of claim 17 wherein the request for the privilege is granted or denied based on responses received from the managers.

19. The executable software product of claim 18 further including denying the request for the privilege if any of the managers requested to approve the request for the privilege deny the request, and granting the request for the privilege if each one of the managers requested to approve the request for the privilege approve the request.

20. The executable software product of claim 15 wherein the workflow process sends requests for approvals to the managers using electronic messages.

21. The executable software product of claim 15 wherein the workflow process serially sends each request for approval to the managers based on a hierarchy of the workflow such that a request for approval is not sent out to a manager associated with one level the hierarchical list until a response is received the manager on a next lower-level of the hierarchical list.

22. The executable software product of claim 15 wherein the workflow sends all the requests for approvals to the managers at one time.

23. The executable software product of claim 15 wherein the workflow process allows the user to view a progress of pending workflow processes initiated by the user.

24. The executable software product of claim 15 wherein a privilege comprises at least one of a permission to perform an action with respect to an associated resource, and a grantable attribute of the resource.

25. The executable software product of claim 15 wherein the hierarchal list of resources includes multiple levels of resources, sub-resources, and privileges, wherein privileges occupy leaf nodes of the hierarchical list of resources.

26. The executable software product of claim 15 wherein the hierarchical list of resources is displayed in a graphical user interface comprising a window with two panes, wherein one pane displays the hierarchal list of resources, and a second pane displays the request cart, such that the user can add a particular privilege to the request cart by dragging and dropping the privilege from the hierarchical resource list into the request cart.

27. The executable software product of claim 15 wherein the self-service provisioning process is used by an organization/enterprise, and wherein users of the self-service provisioning process include both members of the organization/enterprise and non-members of the organization/enterprise, wherein the members of the organization/enterprise include at least one of as officers, employees, and contractors, and the non-members include at least one of vendors, customers, and guests.

28. The executable software product of claim 15 wherein the self-service provisioning process is used by an organization/enterprise, and wherein actual granting of the privilege is performed by at least one of the organization/enterprise, and a third-party.

29. A self-service resource provisioning system, comprising:

a server; and

an identity management application executing on the server, the identity management application for providing a user with self-service resource provisioning of resources, wherein in response to communication with the user over a network, the identity management application is configured to;

display a hierarchical list of resources for selection of at least one of a plurality of privileges associated with the resources;

in response to the user selecting at least one of the privileges from the hierarchical list, add the selected privilege to a request cart to enable the user to initiate a request for the privilege; and

in response to a user submitting the request cart, automatically invoke a workflow process to approve a request for the privilege, wherein the workflow is dynamically generated at least in part from a structure of the hierarchical list of resources and a location of the privilege within the hierarchical list,

wherein approval for the request of the privilege is granted by requesting approval from a chain of one or more people associated with the privilege and its corresponding resource as defined by the structure of the hierarchical list;

wherein once the request for the privilege is submitted for a target user, the workflow process initiates a chain of approval by first sending a request for approval to a manager of the target user, then sending respective requests for approval to a manager of the privilege and a manager of the resource to which the privilege is linked in the hierarchical list; and

wherein the workflow process is configured such that a countdown timer having a designated duration is associated with each privilege in the hierarchical list, wherein once the request for the privilege is submitted the corresponding countdown timer is started, and as the countdown timer begins to expire, the workflow process sends approval request reminders at increasingly rapid intervals to the managers who have yet to respond.

30. The self-service resource provisioning system of claim 29 wherein the workflow process associated with each privilege is derived from the location of the privilege in the hierarchical list, such that if the privilege is moved to a different location in the hierarchical list, then the workflow process is automatically changed.

31. The self-service resource provisioning system of claim 30 further including determining if the requested privilege is special such that the privilege requires further approval by a person within a designated position of an organization/enterprise providing the self-provisioning resource process, and if so, then requesting further approval from the person having the designated position associated with granting of the special privilege.

32. The self-service resource provisioning system of claim 31 wherein the request for the privilege is granted or denied based on responses received from the managers.

33. The self-service resource provisioning system of claim 32 further including denying the request for the privilege if any of the managers requested to approve the request for the privilege deny the request, and granting the request for the privilege if each one of the managers requested to approve the request for the privilege approve the request.

34. The self-service resource provisioning system of claim 29 wherein the workflow process sends requests for approvals to the managers using electronic messages.

35. The self-service resource provisioning system of claim 29 wherein the workflow process serially sends each request for approval to the managers based on a hierarchy of the workflow such that a request for approval is not sent out to a manager associated with one level the hierarchical list until a response is received the manager on a next lower-level of the hierarchical list.

36. The self-service resource provisioning system of claim 29 wherein the workflow sends all the requests for approvals to the managers at one time.

37. The self-service resource provisioning system of claim 29 wherein the workflow process allows the user to view a progress of pending workflow processes initiated by the user.

38. The self-service resource provisioning system of claim 29 wherein a privilege comprises at least one of a permission to perform an action with respect to an associated resource, and a grantable attribute of the resource.

39. The self-service resource provisioning system of claim 29 wherein the hierarchal list of resources includes multiple levels of resources, sub-resources, and privileges, wherein privileges occupy leaf nodes of the hierarchical list of resources.

40. The self-service resource provisioning system of claim 29 wherein the hierarchical list of resources is displayed in a graphical user interface comprising a window with two panes, wherein one pane displays the hierarchal list of resources, and a second pane displays the request cart, such that the user can add a particular privilege to the request cart by dragging and dropping the privilege from the hierarchical resource list into the request cart.

41. The self-service resource provisioning system of claim 29 wherein the self-service provisioning process is used by an organization/enterprise, and wherein users of the self-service provisioning process include both members of the organization/enterprise and non-members of the organization/enterprise, wherein the members of the organization/enterprise include at least one of as officers, employees, and contractors, and the non-members include at least one of vendors, customers, and guests.

42. The self-service resource provisioning system of claim 29 wherein the self-service provisioning process is used by an organization/enterprise, and wherein actual granting of the privilege is performed by at least one of the organization/enterprise, and a third-party.

43. A self-service resource provisioning system, comprising:

means for displaying a hierarchical list of resources for selection of at least one of a plurality of privileges associated with the resources;

means responsive to a user selecting at least one of the privileges from the hierarchical list for adding the selected privilege to a request cart to enable the user to initiate a request for the privilege; and

means responsive to a user submitting the request cart for automatically invoking a workflow process to approve a request for the privilege, wherein the workflow is dynamically generated at least in part from a structure of the hierarchical list of resources and a location of the privilege within the hierarchical list,

wherein approval for the request of the privilege is granted by requesting approval from a chain of one or more people associated with the privilege and its corresponding resource as defined by the structure of the hierarchical list;

wherein once the request for the privilege is submitted for a target user, the workflow process initiates a chain of approval by first sending a request for approval to a manager of the target user, then sending respective requests for approval to a manager of the privilege and a manager of the resource to which the privilege is linked in the hierarchical list; and

wherein the workflow process is configured such that a countdown timer having a designated duration is associated with each privilege in the hierarchical list, wherein once the request for the privilege is submitted the corresponding countdown timer is started, and as the countdown timer begins to expire, the workflow process sends approval request reminders at increasingly rapid intervals to the managers who have yet to respond.