Common data model for identity access management data

• US 9,639,594 B2
• Filed: 03/13/2013
• Issued: 05/02/2017
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Kling, John H., Barbir, Abdulkader, Frick, Cynthia A., Marian, Radu, Ritchey, Ronald W.
• Primary Examiner(s): Reyes, Mariela
• Assistant Examiner(s): HARMON, COURTNEY N
• Application Number:
  US13/801,314
• Publication Number:
  US 20140181003A1
• Time in Patent Office: 1,511 Days
• CPC Class Codes: G06F 16/254 Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP

Abstract

A data model for managing identity and access management (IAM) data implemented at an electronic database may include a set of logical resource elements, a set of physical resource elements, and a set of access requests elements that respectively model logical resources, physical resources, and access requests received at an access request manager of an enterprise. The physical resource elements may be respectively associated with the logical resource elements such that access rights for the physical resources may be obtained based on a logical resource specified in the access request. A system for managing IAM may include a mapping module configured to transform heterogeneous IAM data provided by a plurality of IAM data sources into homogeneous IAM data formatted according to the common IAM data format. A data store may implement the IAM data model such that the data store is configured to store the homogeneous IAM data.

Claims

1. A system for managing identity and access management (IAM) data comprising:

an IAM data model that models an IAM domain space using a common IAM data format, the IAM data model defining a logical computing resource entity, a physical computing resource entity, and a relationship between the logical computing resource entity and the physical computing resource entity;

a mapping module implemented at a computing device wherein the mapping module is configured to transform heterogeneous IAM data provided by a plurality of IAM data sources based on the IAM data model into homogenous IAM data formatted according to the common IAM data format;

a data store of the computing device that implements the IAM data model such that the data store is configured to store the homogeneous IAM data as a set of database records, the set of database records conforming to the IAM data model, the set of database records comprising (a) a set of physical computing resource records, each physical computing resource record conforming to the physical computing resource entity and corresponding to one of a plurality of physical computing resources of a computing system, and (b) a set of logical computing resource records, each logical computing resource record conforming to the logical computing resource entity and indicating at least one of the plurality of physical computing resources that implements the logical computing resource at the computing system; and

an access request manager configured to change access rights for a user account using the IAM data model by;

i) receiving a request to change access rights for the user account, wherein the request indicates one of a job function, a business activity, or a business unit,

ii) evaluating the homogenous IAM data to identify a logical computing resource associated with the job function, the business activity, or the business unit indicated in the request, and to identify a logical permission to change with respect to the logical computing resource identified,

iii) evaluating the homogenous IAM data to identify a physical computing resource that implements the logical computing resource identified,

iv) obtaining, from the homogenous IAM data, a physical permission specification associated with the physical computing resource identified, the physical permission specification mapping the logical permission to at least one physical permission that implements the logical permission at the physical computing resource, and

v) initiating a change to the access rights for the user account with respect to the physical computing resource identified based on the at least one physical permission of the physical permission specification wherein the change to the access rights either provisions the at least one physical permission to the physical computing resource for the user account or revokes the at least one physical permission to the physical computing resource from the user account.

2. The system of claim 1 wherein the mapping module is a first mapping module and further comprising a second mapping module implemented at the computing device wherein the second mapping module is configured to transform at least a portion of the homogeneous IAM into reformatted IAM data having a format specified by a data analysis tool.

3. The system of claim 1 wherein:

the IAM data model further defines an account entity, and wherein the set of database records further comprises (c) a set of account records, each account record conforming to the account entity and corresponding to one of a plurality of user accounts of the computing system; and

the IAM data model further defines a physical entitlement entity, a physical permission entity, a first relationship between the physical entitlement entity the physical permission entity, and a second relationship between the physical entitlement entity and the account entity, and wherein the set of database records further comprises (d) a set of physical permission records, each physical permission record corresponding to the physical permission entity and indicating a physical permission associated with one of the plurality of physical computing resources and (e) a set of physical entitlement records, each physical entitlement record conforming to the physical entitlement entity and indicating one of the account records and one of the physical permission records.

4. The system of claim 3 wherein:

the IAM data model further defines a business task entity, and wherein the set of database records further comprises (f) a set of business task records, each business task record conforming to the business task entity and corresponding to a business task of an enterprise that provides the computing system;

the IAM data model further defines a business activity entity and a relationship between the business activity entity and the business task entity, wherein the set of database records further comprises (g) a set of business activity records, each business activity record conforming to the business activity entity and corresponding to a business activity of the enterprise, and wherein one or more business task records of the set of business task records indicates one of the business activity records;

the IAM data model further defines a business process entity and a relationship between the business process entity and the business activity entity, wherein the set of database records further comprises (h) a set of business process records, each business process record conforming to the business process entity and corresponding to a business process of the enterprise, and wherein one or more business activity records of the set of business activity records indicates one of the business process records; and

the IAM data model further defines a business function entity and a relationship between the business function entity and the business activity entity, wherein the set of database records further comprises (i) a set of business function records, each business function record conforming to the business function entity and corresponding to a business function of the enterprise, and wherein one or more business activity records of the set of business activity records indicates one of the business function records.

5. The system of claim 4 wherein the IAM data model further defines a logical permission entity, a first relationship between the logical permission entity and the logical computing resource entity, and a second relationship between the logical permission entity and the business activity entity, wherein the set of database records further comprises (i) a set of logical permission records, each logical permission record conforming to the logical permission entity and indicating one of the logical computing resource records, and wherein one or more business activity records of the set of business activity records indicates one of the logical permission records.

6. The system of claim 5 wherein the IAM data model further defines a job function entity and a relationship between the job function entity and the business activity entity, and wherein the set of database records further comprise (j) a set of job function records, each job function record conforming to the job function entity, corresponding to a job function of the enterprise, and indicating one of the business activity records.

7. A computer-implemented method for managing identity and access management (IAM) data comprising:

implementing, at a data store, an IAM data model that models an IAM domain space using a common IAM data format, the IAM data model defining a logical computing resource entity, a physical computing resource entity, and a relationship between the logical computing resource entity and the physical computing resource entity;

receiving heterogeneous IAM data from a plurality of IAM data sources;

mapping the heterogeneous IAM data based on the IAM data model in order to obtain homogeneous IAM data formatted according to the common IAM data format;

storing the homogeneous IAM data at the data store that implements the IAM data model as a set of database records conforming to the IAM data model, the set of database records comprising (a) a set of physical computing resource records, each physical computing resource record conforming to the physical computing resource entity and corresponding to one of a plurality of physical computing resources of a computing system, and (b) a set of logical computing resource records, each logical computing resource record conforming to the logical computing resource entity and indicating at least one of the plurality of physical computing resources that implements the logical computing resource at the computing system; and

changing, by an access request manager, access rights for a user account using the IAM data model by;

i) receiving a request to change access rights for the user account, wherein the request indicates one of a job function, a business activity, or a business unit,

ii) evaluating the homogenous IAM data to identify a logical computing resource associated with the job function, the business activity, or the business unit indicated in the request, and to identify a logical permission to change with respect to the logical computing resource identified,

iii) evaluating the homogenous IAM data to identify a physical computing resource that implements the logical computing resource identified,

iv) obtaining, from the homogenous IAM data, a physical permission specification associated with the physical computing resource identified, the physical permission specification mapping the logical permission to at least one physical permission that implements the logical permission at the physical computing resource, and

v) initiating a change to the access rights for the user account with respect to the physical computing resource identified based on the at least one physical permission of the physical permission specification wherein the change to the access rights either provisions the at least one physical permission to the physical computing resource for the user account or revokes the at least one physical permission to the physical computing resource from the user account.

8. The method of claim 7 further comprising:

transforming the homogeneous IAM data into reformatted IAM data having a format specified by a data analysis tool; and

providing the reformatted IAM data to the data analysis tool.

9. The method of claim 7 wherein:

the IAM data model further defines a business activity entity, a job function entity, and a relationship between the business activity entity and the job function entity;

the IAM data model further defines a logical permission entity and a relationship between the logical permission entity and the logical computing resource entity;

the set of database records further comprises (c) a set of business activity records, each business activity record conforming to the business activity entity and corresponding to a business activity of an enterprise that provides the computing system;

the set of database records further comprises (d) a set of job function records, each job function record conforming to the job function entity, corresponding to a job function of the enterprise, and indicating one of the business activity records; and

the set of database records further comprises (e) a set of logical permission records, each logical permission record conforming to the logical permission entity, indicating one of the logical computing resource records, and indicating a logical permission associated with a logical computing resource that corresponds to the logical computing resource record indicated.

10. A non-transitory computer-readable medium having instructions stored thereon that, when executed, cause a computing device to perform steps comprising:

implementing, at a data store, a data model for managing identity and access management (IAM) data, the data model defines;

a logical computing resource entity,

a physical computing resource entity, and

a relationship between the physical computing resource entity and the logical computing resource entity;

storing, at the data store, the IAM data as a set of database records, the set of database records conforming to the data model, the set of database records comprising;

(a) a set of physical computing resource records, each physical computing resource record conforming to the physical computing resource entity and corresponding to one of a plurality of physical computing resources of a computing system, and

(b) a set of logical computing resource records, each logical computing resource record conforming to the logical computing resource entity and indicating at least one of the plurality of physical computing resources that implements the logical computing resource at the computing system,

changing access rights for a user account by;

i) receiving a request to change access rights for the user account, wherein the request indicates one of a job function, a business activity, or a business unit,

ii) evaluating the IAM data to identify a logical computing resource associated with the job function, the business activity, or the business unit indicated in the request, and to identify a logical permission to change with respect to logical computing resource identified,

iii) evaluating the IAM data to identify a physical computing resource that implements the logical computing resource identified,

iv) obtaining, from the IAM data, a physical permission specification associated with the physical computing resource identified, the physical permission specification mapping the logical permission to at least one physical permission that implements the logical permission at the physical computing resource, and

v) initiating a change to the access rights for the user account with respect to the physical computing resource identified based on the at least one physical permission of the physical permission specification wherein the change to the access rights either provisions the at least one physical permission to the physical computing resource for the user account or revokes the at least one physical permission to the physical computing resource from the user account.

11. The non-transitory computer-readable medium of claim 10 wherein:

the data model further defines a business task entity, and wherein the set of database records further comprises (c) a set of business task records, each business task record conforming to the business task entity and corresponding to a business task of an enterprise that provides the computing system;

the data model further defines a business activity entity and a relationship between the business activity entity and the business task entity, wherein the set of database records further comprises (d) a set of business activity records, each business activity record conforming to the business activity entity and corresponding to a business activity of the enterprise, and wherein one or more business task records of the set of business task records indicates one of the business activity records;

the data model further defines a business process entity and a relationship between the business process entity and the business activity entity, wherein the set of database records further comprises (e) a set of business process records, each business process record conforming to the business process entity and corresponding to a business process of the enterprise, and wherein one or more business activity records of the set of business activity records indicates one of the business process records;

the data model further defines a business function entity and a relationship between the business function entity and the business activity entity, wherein the set of database records further comprises (f) a set of business function records, each business function record conforming to the business function entity and corresponding to a business function of the enterprise, and wherein one or more business activity records of the set of business activity records indicates one of the business function records; and

the data model further defines a job function entity and a relationship between the job function entity and the business activity entity, and wherein the set of database records further comprise (g) a set of job function records, each job function record conforming to the job function entity, corresponding to a job function of the enterprise, and indicating one of the business activity records.

12. The non-transitory computer-readable medium of claim 11 wherein the data model further comprises:

the data model further defines an account entity, and wherein the set of database records further comprises (h) a set of account records, each account record conforming to the account entity and corresponding to one of a plurality of user accounts of the computing system; and

the data model further defines a physical entitlement entity, a physical permission entity, a first relationship between the physical entitlement entity the physical permission entity, and a second relationship between the physical entitlement entity and the account entity, and wherein the set of database records further comprises (d) a set of physical permission records, each physical permission record corresponding to the physical permission entity and indicating a physical permission associated with one of the plurality of physical computing resources and (i) a set of physical entitlement records, each physical entitlement record conforming to the physical entitlement entity and indicating one of the account records and one of the physical permission records.