Policy-driven approach to managing privileged/shared identity in an enterprise

• US 20130232541A1
• Filed: 03/02/2012
• Published: 09/05/2013
• Est. Priority Date: 03/02/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kapadia, Kaushal Kiran, Gupta, Gaurav, Jaiswal, Rohit, Tapase, Gaurang Sudhakar, Gujar, Sachin Sanjay
• Granted Patent: US 9,529,993 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Access to a privileged account is managed by first requiring authentication of a user logging into the account and then performing a policy evaluation to determine whether the identified user is allowed to log in using the privileged identity. Preferably, the authentication is a two factor authentication. The policy evaluation preferably enforces a policy, such as a role-based access control, and a context-based access control, a combination of such access controls, or the like. Thus, according to this approach, the entity is provided access to the privileged account if the user'"'"'s identity is verified and a policy is met. In the alternative, the entity is denied access to the privileged account if either the authentication fails, or (assuming authentication does not fail) policy criteria for the user is not met.

Claims

1. A method to manage privileged accounts associated with an enterprise, comprising:

determining that an entity is attempting to logon to a privileged account associated with a resource;

if the entity is attempting to logon to the privileged account, prompting the entity to provide additional identifying information;

verifying, based on additional identifying information received following the prompt and a policy, that the entity is authorized to login to the privileged account; and

providing the entity access to the privileged account.

2. The method as described in claim 1 wherein the determining step determines whether the entity is attempting to logon with a privileged account credential adapted to be shared among a set of entities.

3. The method as described in claim 1 wherein the additional identifying information is a credential uniquely associated with the entity.

4. The method as described in claim 1 wherein the policy enforces an access control.

5. The method as described in claim 4 wherein the access control is one of:

a role-based access control, a context-based access control, and an identity-context-based access control.

6. The method as described in claim 1 wherein the determining step verifies that information provided by the entity matches a privileged account credential associated with the privileged account.

7. The method as described in claim 1 further including denying the entity access to the privileged account if, based on the additional identifying information received following the prompt or information in the policy, the entity is not authorized to login to the privileged account.

8. The method as described in claim 1 wherein the entity is a user or an application associated with the entity.

9. Apparatus, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method to manage privileged accounts associated with an enterprise, the method comprising;

determining that an entity is attempting to logon to a privileged account associated with a resource;

if the entity is attempting to logon to the privileged account, prompting the entity to provide additional identifying information;

verifying, based on additional identifying information received following the prompt and a policy, that the entity is authorized to login to the privileged account; and

providing the entity access to the privileged account.

10. The apparatus as described in claim 9 wherein the determining step determines whether the entity is attempting to logon with a privileged account credential adapted to be shared among a set of entities.

11. The apparatus as described in claim 9 wherein the additional identifying information is a credential uniquely associated with the entity.

12. The apparatus as described in claim 9 wherein the policy enforces an access control.

13. The apparatus as described in claim 12 wherein the access control is one of:

a role-based access control, a context-based access control, and an identity context-based access control.

14. The apparatus as described in claim 9 wherein the determining step verifies that information provided by the entity matches a privileged account credential associated with the privileged account.

15. The apparatus as described in claim 9 wherein the method further includes denying the entity access to the privileged account if, based on the additional identifying information received following the prompt or information in the policy, the entity is not authorized to login to the privileged account.

16. The apparatus as described in claim 9 wherein the entity is a user or an application associated with the entity.

17. A computer program product in a computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method to manage privileged accounts associated with an enterprise, the method comprising:

determining that an entity is attempting to logon to a privileged account associated with a resource;

if the entity is attempting to logon to the privileged account, prompting the entity to provide additional identifying information;

verifying, based on additional identifying information received following the prompt and a policy, that the entity is authorized to login to the privileged account; and

providing the entity access to the privileged account.

18. The computer program product as described in claim 17 wherein the determining step determines whether the entity is attempting to logon with a privileged account credential adapted to be shared among a set of entities.

19. The computer program product as described in claim 17 wherein the additional identifying information is a credential uniquely associated with the entity.

20. The computer program product as described in claim 17 wherein the policy enforces an access control.

21. The computer program product as described in claim 20 wherein the access control is one of:

a role-based access control, a context-based access control, and an identity context-based access control.

22. The computer program product as described in claim 17 wherein the determining step verifies that information provided by the entity matches a privileged account credential associated with the privileged account.

23. The computer program product as described in claim 17 wherein the method further includes denying the entity access to the privileged account if, based on the additional identifying information received following the prompt or information in the policy, the entity is not authorized to login to the privileged account.

24. The computer program product as described in claim 17 wherein the entity is a user or an application associated with the entity.