US 10,944,759 B2Granted

Reducing risks associated with recertification of dormant accounts

AssigneeInternational Business Machines Corporation

InventorsJean Elizabeth Hidden, Gee Ngoo Chia, Brian Robert Matthiesen, Stephen J. Turcol

Life of this patent

Estimating the term…

Loading patent…

Abstract

An identity management system is augmented to provide for automated suspension of all dormant accounts before launching a re-certification campaign (pass). In one implementation, prior to receiving a recertification notice from the system, the affected user's account is already suspended and thus cannot be accessed. Once the recertification succeeds, however, the account is restored. Preferably, the technique is exposed to an IAM system administrator through a simple interface, e.g., a one-click “suspend and re-certify” button in an administrative menu. When the administrator initiates the re-certification process, he or she may select the button for a particular account or user.

Claims18

Dependent claims

A method to improve an identity and access management (IAM) system, comprising:

selecting accounts for recertification in accordance with a recertification policy;
determining which of the selected accounts are dormant accounts;
for at least one of the determined dormant accounts, automatically and temporarily suspending access to the at least one determined dormant account prior to initiating a recertification of the suspended dormant account;
while the suspended dormant account is temporarily suspended, and prior to the initiation of the recertification of the suspended dormant account, issuing a notification to an entity associated with the suspended dormant account to determine whether the entity has a continued need to access the suspended dormant account, wherein the suspending access to the suspended dormant account prior to the initiation of the recertification of the suspended dormant account ensures the suspended dormant account is unable to be accessed by the entity and the notification is not used by the entity as an attack vector;
and
responsive to a receipt of an indication that the entity has the continued need, removing the temporary suspension of the suspended dormant account.

3 more elements

An apparatus, comprising:

a processor;
computer memory holding computer program instructions executed by the processor to improve an identity and access management (IAM) system, the computer program instructions comprising:
program code operative to select accounts for recertification in accordance with a recertification policy;
program code operative to determine which of the selected accounts are dormant accounts;
program code operative for at least one of the determined dormant accounts to automatically and temporarily suspend access to the at least one determined dormant account prior to initiating a recertification of the suspended dormant account;
program code operative while the suspended dormant account is temporarily suspended, and prior to initiation of the recertification of the suspended dormant account, to issue a notification to an entity associated with the suspended dormant account to determine whether the entity has a continued need to access the suspended dormant account, wherein the suspending access to the suspended dormant account prior to the initiation of the recertification of the suspended dormant account ensures the suspended dormant account is unable to be accessed by the entity and the notification is not used by the entity as an attack vector;
and
program code operative in response to a receipt of an indication that the entity has the continued need to remove the suspension of the suspended dormant account.

5 more elements

A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, to improve an identity and access management (IAM) system, the computer program instructions comprising:

program code operative to select accounts for recertification in accordance with a recertification policy;
program code operative to determine which of the selected accounts are dormant accounts;
program code operative for at least one of the determined dormant accounts to automatically and temporarily suspend access to the at least one determined dormant account prior to initiating a recertification of the suspended dormant account;
program code operative while the suspended dormant account is temporarily suspended, and prior to initiation of the recertification of the suspended dormant account, to issue a notification to an entity associated with the suspended dormant account to determine whether the entity has a continued need to access the suspended dormant account, wherein the suspending access to the suspended dormant account prior to the initiation of the recertification of the suspended dormant account ensures the suspended dormant account is unable to be accessed by the entity and the notification is not used by the entity as an attack vector;
and
program code operative in response to a receipt of an indication that the entity has the continued need to remove the suspension of the suspended dormant account.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/594,412Filed 7 Oct 2019 · continuation
Priority: 2 Sep 2015
Published: US 2020/0145427 A17 May 2020
Granted: 9 Mar 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/105
For controlling access to devices or network resources: multiple levels of security
H04L 63/102
For controlling access to devices or network resources: entity profiles
H04L 63/108
For controlling access to devices or network resources: when the policy decisions are valid for a limited amount of time
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general

Family

Application14/842,889Parent of this continuation · filed 2 Sep 2015
US 10,440,029 B2Parent of this continuation · filed 8 Oct 2019
US 2020/0145427 A1Pre-grant publication · published 7 May 2020
US 2017/0063873 A1Published application
US 10,944,759 B2This patent

From the US filing history. Foreign family members aren’t listed.