Distributed environment controlled access facility

• US 7,464,400 B2
• Filed: 04/24/2003
• Issued: 12/09/2008
• Est. Priority Date: 04/24/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jindani, Rahul, Krishnamurthy, Jay, Peachey-Kountz, Penny J., Kannoth, Vinod, Kanwar, Deepak, McKee, Gregory L., Mehta, Sandeep, Ravipati, Ravi K., Kanwar, Rinku
• Primary Examiner(s): Chai; Longbit
• Application Number:
  US10/249,623
• Publication Number:
  US 20030204751A1
• Time in Patent Office: 2,056 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A computer implemented web based access control facility for a distributed environment, which allows users to request for access, take the request through appropriate approval work flow and finally make it available to the users and applications. This program also performs an automatic task of verifying the health of data, access control data as well as the entitlements, to avoid malicious user access. The system also provides an active interface to setup a backup, to delegate the duty in absence. Thus this system provides a comprehensive facility to grant, re-certify and control the entitlements and users in a distributed environment.

Claims

1. A method for controlling access to an application in a distributed computer networked environment, the networked environment comprising an application area and a distributed access control facility, comprising the steps of:

submitting a user request for access to an application;

issuing through the application the request to the distributed access control facility along with pertinent user information;

performing a separation of duties check based on a separation of duties matrix which is defined prior to entitlements being made available for access requests so that separation of duty check can be automatically performed and involved in checking cross-entitlements to identify a conflict before the separation of duties matrix can be used for an entitlement request approval process;

determining the type of user;

seeking separation of duties approval based on type of user; and

providing for an override of the separation of duties check if the user failed the separation of duties check.

2. The method of claim 1 wherein the types of users comprise external and internal users.

3. The method of claim 2 also comprising the step of routing the external user request to a point of contact.

4. The method of claim 3 also comprising the step of routing the internal user through an approval process if the internal user failed the separation of duties check.

5. A method for controlling access to an application in a distributed computer networked environment, the networked environment comprising an application area and a distributed access control facility, comprising the steps of:

attempting through a user to access the application in the application area;

requesting through the application area information regarding the user;

sending through the application area an authorization request;

comparing the information received from the application area and the application to information created in the distributed access control facility in an access repository, wherein said comparing includes a separation of duties check using a separation of duties matrix which is defined prior to entitlements being made available for access requests so that separation of duty check can be automatically performed and involved in checking cross-entitlements to identify a conflict before the separation of duties matrix can be used for an entitlement request approval process;

sending the results of such comparison to the application; and

having the application grant access to the application based on the results of such comparison.

6. The method of claim 5 wherein the step of sending the results of such comparison also comprises providing the level of access the user has to such application.

7. The method of claim 5 wherein the information created in the distributed access control facility comprises a user entitlement for the application and the step of comparing determines the user entitlement for the application.

8. The method of claim 7 wherein the information created in the distributed access control facility comprises the separation of duties matrix formed using a plurality of user entitlements and applications.

9. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for controlling access to an application in a distributed computer networked environment, the networked environment comprising an application area and a distributed access control facility, the method comprising the steps of:

attempting through a user to access the application in the application area;

requesting through the application area information regarding the user;

sending through the application area an authorization request;

comparing the information received from the application area and the application to information created in the distributed access control facility in an access repository, wherein said comparing includes a separation of duties check using a separation of duties matrix;

sending the results of such comparison to the application which is defined prior to entitlements being made available for access requests so that separation of duty check can be automatically performed and involved in checking cross-entitlements to identify a conflict before the separation of duties matrix can be used for an entitlement request approval process; and

having the application grant access to the application based on the results of such comparison.

10. The method of claim 9 wherein the step of sending the results of such comparison also comprises providing the level of access the user has to such application.

11. The method of claim 9 wherein the information created in the distributed access control facility comprises a user entitlement for the application and the step of comparing determines the user entitlement for the application.

12. The method of claim 11 wherein the information created in the distributed access control facility comprises the separation of duties matrix formed using a plurality of user entitlements and applications.