Separations-of-duties analysis tool for object-oriented integrated enterprise wide computing applications
AssigneeInternational Business Machines Corporation
InventorsMichael E. Anderson, Deborah A. Dattilio
Life of this patent
Estimating the term…
Abstract
A method and structure for an independent programming tool for analyzing business separations-of-duties conflicts for users and profiles in an object-oriented application, the tool including a database containing a matrix of transactions, descriptions, object authorization values, and transactional separations-of-duties conflicts; an analysis engine adapted to use data from the object-oriented application in conjunction with the matrix to analyze business conflicts and produce separations-of-duties conflict reports about the object-oriented application; and a user interface adapted to control the tool.
Claims28
An independent programming tool for analyzing business separations-of-duties conflicts for users and profiles in an object-oriented application, wherein said tool comprises:
- a database containing a matrix of transactions, descriptions, object authorization values, and transactional separations-of-duties conflicts;
- an analysis engine adapted to use data from said object-oriented application in conjunction with said matrix to analyze business conflicts and produce separations-of-duties conflict reports about said object-oriented application;
- and
- a user interface adapted to control said tool.
A tool for identifying conflicts in an object-oriented application, said tool comprising:
- a user interface adapted to allow an operator to control said tool;
- a data input adapted to retrieve data tables from said object-oriented application, wherein a first data table of said data tables includes profiles identifying transactions and objects assignable to users, a second data table of said data tables includes a listing of said users and assigned profiles, a third data table of said data tables indicates which of said transactions are available, and a fourth data table of said data tables that includes a listing of said objects appropriate for said transactions, wherein said data input retrieves a separations of duties (SOD) matrix containing restrictions relating to said users, said profiles, said objects, and said transactions;
- and
- an analysis engine adapted to:
- determine what authority said users have based on said SOD matrix and said second data table,
- determine, within each of said profiles, whether said transactions are appropriate based on said SOD matrix and said third data table;
- and
- determine, within each of said profiles, whether said transactions are properly associated with said objects based on said SOD matrix and said fourth data table.
A method of identifying conflicts in an object-oriented application, said method comprising:
- retrieving data tables from said application, wherein a first data table of said data tables includes profiles that identify which transactions and objects can be assigned to users, a second data table of said data tables includes a listing of said users and their assigned profiles, a third data table of said data tables indicates whether said transactions are appropriate for said object-oriented application and a fourth data table of said data tables includes a listing of which of said objects are appropriate for said transactions;
- retrieving a separations of duties (SOD) matrix containing restrictions relating to said users, said objects and said transactions;
- determining if said users have authority to activate said conflicts based on said SOD matrix and said second data table;
- determining, within each of said profiles, whether said transactions are appropriate based on said SOD matrix and said third data table;
- and
- determining, within each of said profiles, whether said transactions are properly associated with said objects based on said SOD matrix and said fourth data table.
A program storage device readable by machine, tangibly embodying a program of instructions executable by said machine to perform a method of identifying conflicts in an object-oriented application, said method comprising:
- retrieving data tables from said application, wherein a first data table of said data tables includes profiles that identify which transactions and objects can be assigned to users, a second data table of said data tables includes a listing of said users and their assigned profiles, a third data table of said data tables indicates whether said transactions are appropriate for said object-oriented application and a fourth data table of said data tables includes a listing of which of said objects are appropriate for said transactions;
- retrieving a separations of duties (SOD) matrix containing restrictions relating to said users, said objects and said transactions;
- determining if said users have authority to activate said conflicts based on said SOD matrix and said second data table;
- determining, within each of said profiles, whether said transactions are appropriate based on said SOD matrix and said third data table;
- and
- determining, within each of said profiles, whether said transactions are properly associated with said objects based on said SOD matrix and said fourth data table.
Dependencies are inferred from the claim text.