Access violation mitigation system

• US 9,729,552 B2
• Filed: 12/15/2015
• Issued: 08/08/2017
• Est. Priority Date: 12/15/2015
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Tadi, Ravi Kumar, Mohanty, Subramanyam, Natarajan, Swaminathan, Purushothaman, Sasidhar
• Primary Examiner(s): Waliullah, Mohammed
• Application Number:
  US14/968,998
• Publication Number:
  US 20170171208A1
• Time in Patent Office: 602 Days
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Apparatus and methods for enhancing system security are provided. The apparatus may include an article of manufacture comprising a computer usable medium having computer readable program code embodied therein for receiving a request from a user to access a system, the request including user-identifying information. The apparatus may also include computer readable program code for accessing a database and identifying one or more user groups associated with at least a portion of the user-identifying data in the database. The apparatus may further include computer readable program code for identifying one or more security groups associated with each of the one or more user groups. The apparatus may additionally include computer readable program code for retrieving access permissions associated with each of the identified one or more security groups. The apparatus may also include computer readable program code for granting the user access to the system.

Claims

1. One or more non-transitory computer-readable media storing computer-executable instructions which, when executed by a processor on a computer system, perform a method for enhancing computer security, the method comprising:

storing in a database a first group of users associated with a first user group and a second group of users associated with a second user group;

storing in the database a first security group, a second security group, a first plurality of permissions associated with the first security group and a second plurality of permissions associated with the second security group, wherein the first plurality of permissions include authorized access to a physical layer of a first server and the second plurality of permissions include authorized access to an application layer of a second server;

storing in the database a first set of data associating the first group of users with the first security group and a second set or data associating the second group of users with the second security group;

storing in the database a first set of traversing rules associated with the first security group and a second set of traversing rules associated with the second security group, each of the sets of traversing rules including a plurality of user commands;

continuously comparing commands executed by each of the users included in the first group of users to the first set of traversing rules, and continuously comparing commands executed by each of the users included in the second group of users to the second set of traversing rules;

generating an electronic notification in response to identifying a command executed by a first user included in the first group of users that is not included in the first set of traversing rules; and

if a response to the notification is not received within a predetermined length of time, automatically suspending the first user'"'"'s access to the physical layer of the first server.

2. The media of claim 1 wherein, in the method, the first plurality of permissions further includes permissions to access a physical layer of an application.

3. The media of claim 2 wherein, in the method, the second plurality of permissions further includes permissions to access a firewall.

4. The media of claim 1 wherein, in the method, a second user is associated with both the first user group and the second user group.

5. The media of claim 4 wherein, in the method, the commands executed by the second user are continuously compared to both the first set of traversing rules and the second set of traversing rules.

6. The media of claim 1 wherein, in the method, the storing further comprises storing in the database a third set of data associating the second group of users with the first security group, wherein the commands executed by each of the users included in the second group of users are compared to both the first set of traversing rules and the second set of traversing rules.

7. The media of claim 1 wherein, in the method, the command executed by the first user is a command attempting to access the application layer of the second server.

8. The media of claim 1 wherein, in the method, the electronic notification is transmitted to a manager of the first user group.

9. The media of claim 8 wherein, in the method, the predetermined length of time is based at least in part on at least one of a geographic location of the manager, a historical response time of the manager, and a number of employees that the manager is responsible for overseeing.