Systems and methods for software application security management

• US 8,055,904 B1
• Filed: 06/08/2007
• Issued: 11/08/2011
• Est. Priority Date: 10/19/2006
• Status: Active Grant

• Current Assignee: United Services Automobile Association
• Original Assignee: United Services Automobile Association
• Inventors: Cato, David, Sanclemente, Tammy
• Primary Examiner(s): Shiferaw; Eleni
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US11/760,714
• Time in Patent Office: 1,614 Days
• Field of Search: 713/183, 713/184, 705/72, 726/6, 726/28
• US Class Current: 713/183
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Apparatus and method for managing password information associated with a service account are disclosed. In some embodiments, a service account management system is configured to include a security account utility and a password information data store. In some embodiments, a security account utility is used when registering, tracking, and adjusting password change information. In some embodiments, notification of a password change date is transmitted to a service account owner and a security auditor for enforcement. Use of a security account management system with a middleware application is also disclosed.

Claims

1. An apparatus for security management, the apparatus comprising:

a machine including a service account module, the module configured to include access information, the access information including a password for launching process code; and

a security account management system configured to associate the service account module with an adjustable timestamp, and to assess a security level for the service account module based on a combination of a security risk level and an operational risk level associated with a service account function and data to be accessed, the security account management system comprising;

a service account utility, the utility configured to include service account application code to communicate with the service account module and to register a password change date associated with the access information; and

a security record data store, the store configured to retain a security record including an identifier associated with the service account module, the password change date, an identification of a service account module user and a service account module owner, the security risk level, and the operation risk level; and

a notification module, the module configured to periodically check the security record for updated information and compliance with a predetermined security policy, wherein the security policy is based on the security risk level and the operational risk level, and notify the service account module owner when the security record needs to be updated to comply with the security policy.

2. The apparatus of claim 1, wherein the security account management system is configured to provide audit information associated with the password change date.

3. The apparatus of claim 1, wherein the service account module is coupled to another module including the process code through a middleware application manager.

4. The apparatus of claim 1, wherein the security account management system is configured to track the password change date using the service account utility.

5. The apparatus of claim 1, wherein the service account utility is configured to process the password change date to generate another password change date.

6. The apparatus of claim 1, wherein the security account management system is configured to provide notification of a pending password change date to a user.

7. A non-transitory machine-readable medium for routing an inbound communication comprising instructions, which when executed by a machine, cause the machine to execute the following software modules:

a machine including a service account module, the module configured to include access information, the access information including a password for launching process code; and

a security account management system configured to associate the service account module with an adjustable timestamp, and to assess a security level for the service account module based on a combination of a security risk level and an operational risk level associated with a service account function and data to be accessed, the security account management system comprising;

a service account utility, the utility configured to include service account application code to communicate with the service account module and to register a password change date associated with the access information;

a security record data store, the store configured to retain a security record including an identifier associated with the service account module, the password change date, an identification of a service account module user and a service account module owner, the security risk level, and the operation risk level and

a notification module, the module configured to periodically check the security record for updated information and compliance with a predetermined security policy, wherein the security policy is based on the security risk level and the operational risk level, and notify the service account module owner when the security record needs to be updated to comply with the security policy.

8. The machine-readable medium of claim 7, wherein the security account management system is configured to provide audit information associated with the password change date.

9. The machine-readable medium of claim 7, wherein the service account module is coupled to another module including the process code through a middleware application manager.

10. The machine-readable medium of claim 7, wherein the security account management system is configured to track the password change date using the service account utility.

11. The machine-readable medium of claim 7, wherein the service account utility is configured to process the password change date to generate another password change date.

12. The machine-readable medium of claim 7, wherein the security account management system is configured to provide notification of a pending password change date to a user.

13. A system for message delivery, the system comprising:

a processor;

a storage device having instructions contained therein which when executed cause the processor to execute the following software modules;

a machine including a service account module, the module configured to include access information, the access information including a password for launching process code; and

a security account management system configured to associate the service account module with an adjustable timestamp, and to assess a security level for the service account module based on a combination of a security risk level and an operational risk level associated with a service account function and data to be accessed, the security account management system comprising;

a service account utility, the utility configured to include service account application code to communicate with the service account module and to register a password change date associated with the access code;

a security record data store, the store configured to retain a security record including an identifier associated with the service account module, the password change date, an identification of a service account module user and a service account module owner, the security risk level, and the operation risk level; and

a notification module, the module configured to periodically check the security record for updated information and compliance with a predetermined security policy, wherein the security policy is based on the security risk level and the operational risk level, and notify the service account module owner when the security record needs to be updated to comply with the security policy.

14. The system of claim 13, wherein the security account management system is configured to provide audit information associated with the password change date.

15. The system of claim 13, wherein the service account module is coupled to another module including the process code through a middleware application manager.

16. The system of claim 13, wherein the security account management system is configured to track the password change date using the service account utility.

17. The system of claim 13, wherein the service account utility is configured to process the password change date to generate another password change date.

18. The system of claim 13, wherein the security account management system is configured to provide notification of a pending password change date to a user.