Verifying Separation-of-Duties at IAM System Implementing IAM Data Model
AssigneeBank of America Corporation
InventorsJohn Kling, Bryan Thompson, Ward Green
Life of this patent
Estimating the term…
Abstract
Systems and methods of verifying separation-of-duties (SoD) for requested access rights to physical computing resources are provided. An SoD verifier may receive and access request and obtain a set of current permissions associated with a requestee specified in the access request. The SoD verifier may also obtain a set of new permissions to provision for the requestee based on the access request. The SoD verifier may determine whether one of the current permissions is incompatible with one of the new permissions. The SoD verifier may provide an indication of whether the access request represents an SoD violation.
Claims20
A computer-implemented method of verifying separation-of-duties for requested access rights to physical computing resources comprising:
- receiving an access request at a separation-of-duties verifier;
- identifying, at the separation-of-duties verifier, a set of current permissions associated with a requestee specified in the access request;
- identifying, at the separation-of-duties verifier, a set of new permissions to provision for the requestee based on the access request;
- determining, by the separation-of-duties verifier, whether one of the current permissions in the set of current permissions is incompatible with one of the new permissions in the set of new permissions;
- responsive to a determination that one of the current permissions is incompatible with one of the new permissions, providing an indication that the access request represents a separation-of-duties violation;
- and
- responsive to a determination that none of the current permissions are incompatible with any of the new permissions, providing an indication that the access request does not represent a separation-of-duties violation.
A system for verifying separation-of-duties for requested access rights to physical computing resources comprising:
- a processor;
- a data store that implements an identity access management (IAM) data model and associates logical computing resource records at the data store with one or more physical computing resource records at the data store;
- an access request handler that, in operation, receives an access request;
- and
- a separation-of-duties verifier that, in operation,
- receives the access request from the access request handler,
- determines whether the access request represents a separation-of-duties violation based, at least in part, on a set of current permissions associated with a requestee specified in the access request and a set of new permissions to provision for the requestee,
- provides a notification that the access request represents a separation-of-duties violation responsive to a determination that one of the current permissions is incompatible with one of the new permissions, and
- provides a notification that the access request does not represent a separation of duties violation responsive to a determination that none of the current permissions are incompatible with any of the new permissions.
A non-transitory computer-readable medium having instructions stored thereon that, when executed by a processor, cause the processor to perform steps for verifying separation-of-duties for requested access rights to physical computing resources, the steps comprising:
- receiving an access request at a separation-of-duties verifier;
- identifying, at the separation-of-duties verifier, a set of current permissions associated with a requestee specified in the access request;
- identifying, at the separation-of-duties verifier, a set of new permissions to provision for the requestee based on the access request;
- determining, by the separation-of-duties verifier, whether one of the current permissions in the set of current permissions is incompatible with one of the new permissions in the set of new permissions;
- responsive to a determination that one of the current permissions is incompatible with one of the new permissions, denying the access request;
- and
- responsive to a determination that none of the current permissions are incompatible with any of the new permissions, initiating, by the access request handler, an adjustment of access rights to at least one physical computing resource of a computer system based on the access request.
Dependencies are inferred from the claim text.