Access requests at IAM system implementing IAM data model

• US 9,558,334 B2
• Filed: 10/09/2015
• Issued: 01/31/2017
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Kling, John, Thompson, Bryan, Green, Ward
• Primary Examiner(s): LE, THU NGUYET T
• Application Number:
  US14/879,488
• Publication Number:
  US 20160036827A1
• Time in Patent Office: 480 Days
• Field of Search: 707/781, 707/783
• US Class Current: 1/1
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods are provided for provisioning access rights to physical computing resources using an IAM system implementing an IAM data model. The IAM data model may identify logical and physical computing resources. An access request handler may receive an access request and identify a set of logical permissions based on the access request. The access request handler may derive a set of logical entitlements based on the set of logical permissions. An entitlement translator may translate the set of logical entitlements to a physical entitlement specification based on a set of physical permission specifications associated with the set of logical permissions. A physical permission specification may be obtained by mapping a logical permission to one or more physical permissions. An access control manager may then provision access rights to at least one physical computing resource indicated in the physical entitlement specification.

Claims

1. A computer-implemented method of provisioning access rights to physical computing resources comprising:

receiving, at a computing device, a request to provision one or more access rights for a user account wherein the request specifies a business activity;

identifying, by the computing device, a set of logical permissions based, at least in part, on the request by obtaining a set of business tasks associated with the business activity and identifying, as the set of logical permissions, one or more logical permissions respectively associated with individual business tasks in the set of business tasks;

deriving, by the computing device, a set of logical entitlements based, at least in part, on the set of logical permissions;

translating, by the computing device, the set of logical entitlements to a physical entitlement specification based, at least in part, on a set of physical permission specifications wherein each one of the physical permission specifications in the set of physical permission specifications is associated with one of the logical permissions in the set of logical permissions; and

provisioning, by the computing device, access rights for the user account to at least one physical computing resource indicated in the physical entitlement specification.

2. The computer-implemented method of claim 1, further comprising:

receiving, at the computing device, a second request to provision one or more access rights for a second user account wherein the second request specifies a business role; and

identifying a second set of logical permissions based, at least in part on the second request by

obtaining a set of business activities associated with the business role,

obtaining a second set of business tasks respectively associated with individual business activities in the set of business activities, and

identifying, as the second set of logical permissions, one or more logical permissions respectively associated with individual business tasks in the second set of business tasks.

3. The computer-implemented method of claim 1 further comprising:

receiving, at the computing device, a second request to provision one or more access rights for a second user account wherein the second request specifies a business task; and

identifying a second set of logical permissions that includes at least one logical permission associated with the business task.

4. The computer-implemented method of claim 1 further comprising:

receiving, at the computing device, a second request to provision one or more access rights for a second user account where the second request specifies a logical permission; and

identifying a second set of logical permissions that includes the logical permission specified in the second request.

5. The computer-implemented method of claim 1 further comprising:

receiving, at the computing device, a second request to provision one or more access rights for a second user account wherein the second request specifies a business unit;

identifying a second set of logical permissions that includes one or more logical permissions associated with the business unit;

identifying, by the computing device, a set of users associated with the business unit; and

provisioning, by the computing device based on the second set of logical permissions, access rights to at least one physical computing device for individual user accounts respectively associated with individual users in the set of users.

6. The computer-implemented method of claim 5, wherein the second request specifies a recursion direction and a recursion level, and further comprising:

identifying, by the computing device, a related business unit associated with the business unit based on the recursion direction and the recursion level;

identifying, by the computing device, a set of additional users associated with the related business unit; and

provisioning, by the computing device, access rights to the at least one physical computing device for individual user accounts respectively associated with individual additional users in the set of additional users.

7. The computer-implemented method of claim 1, further comprising:

receiving, at the computing device, a second request that specifies a physical permission specification; and

provisioning, by the computing device, access rights to each physical computing resource identified in the physical permission specification.