User Permissions In Computing Systems

• US 20120030756A1
• Filed: 07/29/2010
• Published: 02/02/2012
• Est. Priority Date: 07/29/2010
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Todd, Paul H.
• Granted Patent: US 8,484,724 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6236 between heterogeneous systems

Abstract

A system and method of verifying accuracy of permission and access levels in a mainframe system are presented. The system and method may include receiving a plurality of records including a user identifier and an associated access level. The access level in the record may be matched (e.g., the access level on the stored record must be less than or equal to the access on the new system to “pass” the test) to the access level in a mainframe system. If the access levels match, the access level may be stored in the mainframe system. If the access levels do not match, the record may be flagged and correction of the inconsistency may be performed.

Claims

1. A method, comprising:

receiving, at a permissions verification system, a plurality of records identifying at least a user identifier and associated first access level, the associated first access level indicating a level of access to a first mainframe system;

determining, at the permissions verification system, whether the first access level associated with the user identifier in the record matches a second access level associated with the user identifier stored at a second mainframe system, the second access level indicating a level of access to the second mainframe system; and

responsive to determining that the first access level does not match the second access level, providing a notification of an inconsistency between the first access level and the second access level.

2. The method of claim 1, wherein providing the notification of the inconsistency includes a request to correct the inconsistency.

3. The method of claim 2, further including receiving a correction of the inconsistency and saving a corrected access level to the second mainframe system.

4. The method of claim 1, wherein the first mainframe system includes a plurality of mainframe systems.

5. The method of claim 1, wherein responsive to determining that the first access level matches the second access level, storing the second access level on the second mainframe system.

6. The method of claim 1, wherein the plurality of records are collected over a predetermined period of time.

7. The method of claim 1, wherein the plurality of records are received from a plurality of systems.

8. The method of claim 1, wherein the plurality of records include records of at least two different record formats.

12. The one or more computer readable media of claim 1, further including instructions that, when executed, cause the apparatus to:

responsive to determining that the first access level matches the second access level, store the second access level on the second mainframe system.

9. One or more computer readable media storing computer readable instructions that, when executed, cause an apparatus to:

receive, at a permissions verification system, a plurality of records identifying at least a user identifier and associated first access level, the associated first access level indicating a level of access to a first mainframe system;

determine, at the permissions verification system, whether the first access level associated with the user identifier in the record matches a second access level associated with the user identifier stored at a second mainframe system, the second access level indicating a level of access to the second mainframe system; and

responsive to determining that the first access level does not match the second access level, provide a notification of an inconsistency between the first access level and the second access level.

10. The one or more computer readable media of claim 9, wherein providing the notification of the inconsistency includes a request to correct the inconsistency.

11. The one or more computer readable media of claim 10, further including instructions that, when executed, cause the apparatus to correct the inconsistency and save the corrected access level to the second mainframe system.

13. The one or more computer readable media of claim 9, wherein the plurality of records are collected over a predetermined period of time.

14. The one or more computer readable media of claim 9, wherein the plurality of records include records of at least two different record formats.

15. An apparatus comprising:

a processor; and

memory operatively coupled to the processor and storing computer readable instructions that, when executed, cause the apparatus to;

receive, at a permissions verification system, a plurality of records identifying at least a user identifier and associated first access level, the associated first access level indicating a level of access to a first mainframe system;

determine, at the permissions verification system, whether the first access level associated with the user identifier in the record matches a second access level associated with the user identifier stored at a second mainframe system, the second access level indicating a level of access to the second mainframe system; and

responsive to determining that the first access level does not match the second access level, provide a notification of an inconsistency between the first access level and the second access level.

16. The apparatus of claim 15, wherein providing the notification of the inconsistency includes a request to correct the inconsistency.

17. The apparatus of claim 16, further including instructions that, when executed, cause the apparatus to correct the inconsistency and save the corrected access level to the second mainframe system.

18. The apparatus of claim 15, further including instructions that, when executed, cause the apparatus to:

responsive to determining that the first access level matches the second access level, store the second access level on the second mainframe system.

19. A method, comprising:

receiving, at a permissions verification system, a first user identifier;

attempting a first login to a mainframe system, by the permissions verification system, including inputting the first user identifier and a default password, the default password being a password provided upon creation of the first user identifier; and

responsive to determining that the first login was successful, notifying a user associated with the first user identifier that the default password is associated with the first user identifier and does not meet a predetermined level of security.

20. The method of claim 19, further including:

responsive to determining that the first login was unsuccessful, attempting a second login to the mainframe system including inputting a second user identifier and the default password; and

responsive to determining that the second login was successful, notifying a user associated with the second user identifier that the default password is associated with the second user identifier and does not meet the predetermined level of security.

21. The method of claim 19, wherein notification of the user associated with the first user identifier includes a request to change the password associated with the first user identifier.