US 11,606,391 B2Granted

Method for controlling and provisioning resource access

AssigneeJPMorgan Chase Bank, N.A.

InventorsRachel Greenebaum, Suryakantham Chinthapalli, David Laurance, Isaac Leonard Blum

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method for controlling an access to a resource is provided. The method includes receiving, from a first user, a first input that relates to a business criterion for a provision of the access to the resource; receiving, from a second user, a second input that relates to an application-specific criterion for the provision of the access to the resource; generating one or more one access-control rules based on the inputs; receiving an access request; and determining whether to grant the access request based on the rules, and any conditions that pertain to the access. The method effectively decouples the business-related criterion from the application-specific criterion for the access determination, thereby ensuring that business stakeholders and application owners each have an independent ability to provide inputs for generating access-control rules and policies.

Claims14

Dependent claims

A method for controlling an access to a resource, the method being implemented by at least one processor, the method comprising:

receiving, from a first user that has a business-related interest in the resource, a first input that relates to a business criterion for a provision of the access to the resource;
receiving, from a second user that has an application-specific interest in the resource, a second input that relates to an application-specific criterion for the provision of the access to the resource;
generating, based on the first input and the second input, at least one rule for the provision of the access of the resource;
receiving, from a third user, a resource access request that includes information that relates to an identification of the third user;
determining, based on the at least one rule and the information included in the resource access request, whether to grant the access to the resource, and at least one condition upon which the access grant is contingent;
transmitting, to the third user, a message that indicates a result of the determining;
storing, in a memory, information that relates to a record of the access grant;
and
adjusting the at least one rule based on the stored information,
wherein the business criterion includes at least one of an indication of an entity to which the access is to be granted and an indication of a condition upon which the access grant depends, and
wherein the first input includes access time information.

8 more elements

A computing apparatus for controlling an access to a resource, the computing apparatus comprising:

a processor;
a memory;
and
a communication interface coupled to each of the processor and the memory, wherein the processor is configured to:
receive, from a first user that has a business-related interest in the resource via the communication interface, a first input that relates to a business criterion for a provision of the access to the resource;
receive, from a second user that has an application-specific interest in the resource via the communication interface, a second input that relates to an application-specific criterion for the provision of the access to the resource;
generate, based on the first input and the second input, at least one rule for the provision of the access of the resource;
receive, from a third user via the communication interface, a resource access request that includes information that relates to an identification of the third user;
determine, based on the at least one rule and the information included in the resource access request, whether to grant the access to the resource, and at least one condition upon which the access grant is contingent;
transmit, to the third user via the communication interface, a message that indicates a result of the determinations;
store, in the memory, information that relates to a record of the access grant;
and
adjust the at least one rule based on the stored information,
wherein the application-specific criterion includes at least one of an indication of an entity to which the access is to be granted and an indication of a condition upon which the access grant depends, and
wherein the second input includes access time information.

12 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/804,881Filed 28 Feb 2020 · us provisional application
Priority: 28 Feb 2019
Published: US 2020/0280588 A13 Sep 2020
Granted: 14 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
G06F 21/30
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity: authentication, i.e.…
G06F 21/45
Authentication, i.e. establishing the identity or authorisation of security principals: structures or tools for the administration of authentication
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…