Graphical user interface for unified identity management across internal and shared computing applications

• US 8,751,941 B1
• Filed: 12/12/2012
• Issued: 06/10/2014
• Est. Priority Date: 07/15/2012
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Identropy Corporation
• Inventors: Kaushik, Nishant, Villavicencio, Francisco, Motiwala, Ashraf, Hydak, Christopher, Chowdhury, Mubdiu Reza
• Primary Examiner(s): Pitaro, Ryan
• Assistant Examiner(s): Pan, Yongjia
• Application Number:
  US13/712,755
• Time in Patent Office: 545 Days
• Field of Search: None
• US Class Current: 715/745
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication

Abstract

A single user interface for a user of an identity management module is presented. The single user interface includes options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. The user interface is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine.

Claims

1. A method, comprising,

using one or more processors to perform presenting a user interface to a user of an identity management module, wherein

the identity management module comprises one or more tools for allowing a user to create and manage one or more accounts on each of a shared computing system application and a customer internal application, and

the presenting comprises:

presenting a single user interface including options for

transmitting an access management instruction for creating or managing one of the one or more accounts to the customer internal application via an on-premise proxy, and

transmitting another access management instruction for creating or managing one of the one or more accounts to the shared computing system application via a multi-customer gateway on the shared computing system; and

adaptively adjusting the user interface to highlight suggested access entitlement operations for creating or managing one of the one or more accounts based at least in part upon expected access entitlements derived from a learning based prediction engine, wherein

the adaptively adjusting the user interface to highlight suggested access entitlement operations comprises suggesting an access entitlement operation based at least in part on auditing one or more existing identities in an identity management database to detect access anomalies based on comparing existing access entitlements of a selected identity to existing access entitlements of others of the existing identities, and

the adaptively adjusting the user interface to highlight suggested access entitlement operations further comprises suggesting an access entitlement operation based at least in part on a hybrid prediction approach combining collaborative filtering and content based filtering.

2. The method of claim 1, wherein the adaptively adjusting the user interface to highlight suggested access entitlement operations further comprises adaptively adjusting the user interface based at least in part upon user identity and past behavior.

3. The method of claim 1, wherein the adaptively adjusting the user interface to highlight suggested access entitlement operations further comprises adaptively adjusting the user interface such that, when the user clicks on suggestions, in the access request interface, the recommendation engine determines, based on the end user'"'"'s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user may want to request access.

4. The method of claim 1, wherein the presenting the single user interface including the options for transmitting the access management instruction to the customer internal application via the on-premise proxy, and the transmitting the another access management instruction to the shared computing system application via the multi-customer gateway on the shared computing system further comprise presenting the user interface in a platform-agnostic fashion such that user controls do not a user of the single user interface as to whether a particular option invokes transmission to a shared computing system or a customer internal application.

5. The method of claim 1, wherein the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprises adaptively adjusting the user interface to highlight suggested access entitlement operations based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns.

6. The method of claim 1, wherein the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprises presenting a next selected operation based on patterns in identity management access database discerned by a learning-based prediction engine.

7. The method of claim 1, wherein the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprises presenting a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface.

8. A system, comprising:

at least one processor; and

a memory comprising program instructions, wherein the program instructions are executable by the at least one processor to;

present a user interface to a user of an identity management module, wherein

the identity management module comprises one or more tools for allowing a user to create and manage one or more accounts on each of a shared computing system application and a customer internal application, and

the program instructions executable by the at least one processor to present the user interface comprise;

program instructions executable by the at least one processor to present a single user interface including options for

transmitting an access management instruction for creating or managing one of the one or more accounts to the customer internal application via an on-premise proxy, and

transmitting another access management instruction for creating or managing one of the one or more accounts to the shared computing system application via a multi-customer gateway on the shared computing system; and

program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations for creating or managing one of the one or more accounts based at least in part upon expected access entitlements derived from a prediction engine, wherein

the program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations comprise program instructions executable by the at least one processor to suggest an access entitlement operation based at least in part on auditing one or more existing identities in an identity management database to detect access anomalies based on comparing existing access entitlements of a selected identity to existing access entitlements of others of the existing identities, and

program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations further comprise program instructions executable by the at least one processor to suggest an access entitlement operation based at least in part on a hybrid prediction approach combining collaborative filtering and content based filtering.

9. The system of claim 8, wherein the program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations further comprise program instructions executable by the at least one processor to adaptively adjust the user interface based at least in part upon user identity and past behavior.

10. The system of claim 8, wherein the program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations further comprise program instructions executable by the at least one processor to adaptively adjust the user interface such that, when the user clicks on suggestions, in the access request interface, the recommendation engine determines, based on the end user'"'"'s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user may want to request access.

11. The system of claim 8, wherein the program instructions executable by the at least one processor to present the single user interface including the options for transmitting the access management instruction to the customer internal application via the on-premise proxy, and transmit the another access management instruction to the shared computing system application via the multi-customer gateway on the shared computing system further comprise program instructions executable by the at least one processor to present the user interface in a platform-agnostic fashion such that user controls do not alert a user of the single user interface as to whether a particular option invokes transmission to a shared computing system or a customer internal application.

12. The system of claim 8, wherein the program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprise program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns.

13. The system of claim 8, wherein the program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprise program instructions executable by the at least one processor to present a next selected operation based on patterns in identity management access database discerned by a learning-based prediction engine.

14. The system of claim 8, wherein the program instructions executable by the at least one processor to adaptively adjust the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprise program instructions executable by the at least one processor to present a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface.

15. A non-transitory computer-readable storage medium storing program instructions, wherein the program instructions are computer-executable to implement:

presenting a user interface to a user of an identity management module, wherein

the identity management module comprises one or more tools for allowing a user to create and manage one or more accounts on each of a shared computing system application and a customer internal application, and

the presenting comprises;

presenting a single user interface including options for

transmitting an access management instruction for creating or managing one of the one or more accounts to the customer internal application via an on-premise proxy, and

transmitting another access management instruction for creating or managing one of the one or more accounts to the shared computing system application via a multi-customer gateway on the shared computing system; and

adaptively adjusting the user interface to highlight suggested access entitlement operations for creating or managing one of the one or more accounts based at least in part upon expected access entitlements derived from a prediction engine, wherein

the adaptively adjusting the user interface to highlight suggested access entitlement operations comprises suggesting an access entitlement operation based at least in part on auditing one or more existing identities in an identity management database to detect access anomalies based on comparing existing access entitlements of a selected identity to existing access entitlements of others of the existing identities, and

the adaptively adjusting the user interface to highlight suggested access entitlement operations further comprises suggesting an access entitlement operation based at least in part on a hybrid prediction approach combining collaborative filtering and content based filtering.

16. The non-transitory computer-readable storage medium of claim 15, wherein the program instructions computer-executable to implement adaptively adjusting the user interface to highlight suggested access entitlement operations further comprise program instructions computer-executable to implement adaptively adjusting the user interface based at least in part upon user identity and past behavior.

17. The non-transitory computer-readable storage medium of claim 15, wherein the program instructions computer-executable to implement adaptively adjusting the user interface to highlight suggested access entitlement operations further comprise program instructions computer-executable to implement adaptively adjusting the user interface such that, when the user clicks on suggestions, in the access request interface, the recommendation engine determines, based on the end user'"'"'s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user may want to request access.

18. The non-transitory computer-readable storage medium of claim 15, wherein the program instructions computer-executable to implement presenting the single user interface including the options for transmitting the access management instruction to the customer internal application via the on-premise proxy, and the transmitting the another access management instruction to the shared computing system application via the multi-customer gateway on the shared computing system further comprise program instructions computer-executable to implement presenting the user interface in a platform-agnostic fashion such that user controls do not a user of the single user interface as to whether a particular option invokes transmission to a shared computing system or a customer internal application.

19. The non-transitory computer-readable storage medium of claim 15, wherein the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprise program instructions computer-executable to implement adaptively adjusting the user interface to highlight suggested access entitlement operations based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns.

20. The non-transitory computer-readable storage medium of claim 15, wherein the program instructions computer-executable to implement adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprise program instructions computer-executable to implement presenting a next selected operation based on patterns in identity management access database discerned by a learning-based prediction engine.

21. The non-transitory computer-readable storage medium of claim 15, wherein the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further comprise program instructions computer-executable to implement presenting a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface.