US 12,598,187 B2Granted

System and method for managing privileged account access

AssigneeSaudi Arabian Oil Company

InventorsAbdullah T. Al-Essa, Khalid H. Qahtani, Taher A. Alwusaibie, Anthony Graham Murdoch, Tariq S. Alshlash, Osamah A. Bugeaey

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A system and method is described that reduces a likelihood that a privileged account at a system (e.g., device, network, and/or application) for a user is compromised. For example, the privileged account for the user at the system is disabled in response to being created. The user can provide a request for at least one elevated right at the system corresponding to a request to use the privileged account at the system. An identity of the user is authenticated in response to receiving the request to confirm that the user is requesting the privileged account at the system. The privileged account for the user is enabled at the system to allow the user to perform at least one action that the user was not previously allowed to perform.

Claims18

Dependent claims

A computer-implemented method comprising:

disabling a privileged account for a user to disable the user from performing an action at a first and second system;
receiving a request for at least one elevated right at the first system corresponding to a request to be enabled to perform the action at the first system;
authenticating the user to confirm an identity of the user in response to receiving the request at a first device;
enabling the privileged account for the user in response to authenticating the user;
causing existing rights for the user at the first system to be elevated to allow the user to perform the action at the first system in response to enabling the privileged account for the user, wherein the user is disabled from performing the action at the second system;
generating notification data indicating that the privileged account for the user has been enabled at the first system;
transmitting the notification data to a second device;
and
receiving second user data from the second device indicating the privileged account for the user is to be revoked to disable the user from performing the action at the first system, the second user data being generated at the second device based on the notification data.

6 more elements

A system comprising:

memory to store machine-readable instructions;
one or more processors to access the memory and execute the machine-readable instructions, the machine-readable instructions configured to implement:
an account privilege manager programmed to:
create a privileged account for a user for a given system, wherein the privileged account is disabled following creating the privileged account;
receive a request for one or more elevated rights for a user at the given system;
generate an authentication request to authenticate that the user has requested the one or more elevated rights at the given system, the authentication request including one of a random number or a one-time password (OTP);
provide the authentication request to a mobile device of the user;
receive user data inputted by the user at a user device, the user data including the random number or the OTP that was communicated to the mobile device;
enable the one or more elevated rights for the user at the given system corresponding to enable the privileged account that was previously disabled based at least on the user data, wherein the user is disabled at another system;
receiving notification data indicating that the privileged account for the user has been enabled at the given system;
providing a command indicating the privileged account for the user is to be revoked to disable the user from performing the action at the first system, the command being generated based on the notification data.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/821,085Filed 19 Aug 2022
Published: US 2024/0064148 A122 Feb 2024
Granted: 7 Apr 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/102
For controlling access to devices or network resources: entity profiles
H04L 9/0869
Generation of secret information including derivation or calculation of cryptographic keys or passwords: involving random numbers or seeds
H04L 9/3228
Using a predetermined code, e.g. password, passphrase or PIN: one-time or temporary data, i.e. information which is sent for every authentication…
H04L 63/067
For supporting key management in a packet data network: using one-time keys