# US 2019/0243984 A1 · Method to dynamically elevate permissions on the mainframe > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0243984 A1 - Document ID: US20190243984A1 - Status: Published application - Kind: A1 - Application number: 15/891,634 - Filed: 2018-02-08 - Published: 2019-08-08 - Earliest claimed: 2018-02-08 - Assignees: CA, Inc. - Applicants: Ca, Inc. - Inventors: FREDERIC DUMINY; LINWOOD HUGH OVERBY, JR.; KEVIN CUNNINGHAM; PAUL REICHL - Web page: https://patentgrep.com/patent/US20190243984A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/31: User authentication - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments of the present disclosure relate to automatically and dynamically elevating permissions on a mainframe system. Initially, a user may request an elevation class which corresponds to elevated class resources of the mainframe system. The elevation class may enable the user to perform actions to datasets, files, applications, or systems of the mainframe system the user may not otherwise be able to perform. If the user has permission to the elevation class, a user identification corresponding to the user and the elevation class is registered in an elevated permission structure. An access control environment element (ACEE) is dynamically created with the elevated permission structure and the elevated class resources of the elevation class are associated with the ACEE. The user can then be validated with access to the elevated class resources. At the expiration of a limited duration of time, the elevated class resources are automatically disassociated with the ACEE. ## Claims ### Claim 1 A method comprising: receiving, from a user device, a request from a user to an elevation class, the elevation class corresponding to elevated class resources of a mainframe system; determining, at the mainframe system, if the user has permission to the elevation class; based on the determining, registering a user identification corresponding to the user and the elevation class in an elevated permission structure; dynamically creating an access control environment element (ACEE) with the elevated permission structure; associating the elevated class resources of the elevation class with the ACEE; and validating the user with access to the elevated class resources. ### Claim 2 (depends on 1) The method of claim 1, wherein the elevated class resources enable the user to perform actions to datasets, files, applications, or systems corresponding to the elevation class. ### Claim 3 (depends on 1) The method of claim 1, further comprising logging actions performed by the user corresponding to the elevated class resources. ### Claim 4 (depends on 1) The method of claim 1, further comprising automatically disassociating the elevated class resources with the user ACEE at an expiration of a limited duration of time. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining each of the elevated class resources is not available for access; and revalidating the user with access to available elevated class resources. ### Claim 6 (depends on 1) The method of claim 1, wherein the ACEE is dynamically created with the elevated permission structure during user authentication. ### Claim 7 (depends on 1) The method of claim 1, wherein the ACEE is dynamically created with the elevated permission structure upon the user issuing a refresh command. ### Claim 8 (depends on 1) The method of claim 1, wherein the request is received without the user submitting a request to a security administrator. ### Claim 9 (depends on 1) The method of claim 1, wherein the request is received at an elevated permission manager of the mainframe system via a callable service. ### Claim 10 (depends on 1) The method of claim 1, wherein the elevation class is created by an administrator and provides temporary access to specified elevated class resources. ### Claim 11 (depends on 1) The method of claim 1, wherein the request is received during off-hours. ### Claim 12 (depends on 1) The method of claim 1, wherein the request is for a limited duration of time. ### Claim 13 A computer storage medium storing computer-useable instructions that, when used by at least one computing device, cause the at least one computing device to perform operations comprising: based on a user request from a user via a user device, dynamically creating, at a mainframe system, an access control environment element (ACEE) with an elevated permission structure; associating elevated class resources with the ACEE; validating the user with access to the elevated class resources; and logging actions performed by the user corresponding to the elevated class resources. ### Claim 14 (depends on 13) The computer storage medium of claim 13, further comprising receiving, from the user device, the request from the user to an elevation class, the elevation class corresponding to the elevated class resources of the mainframe system. ### Claim 15 (depends on 14) The computer storage medium of claim 14, further comprising determining, at the mainframe system, if the user has permission to the elevation class. ### Claim 16 (depends on 15) The computer storage medium of claim 15, further comprising based on the determining, registering a user identification corresponding to the user and the elevation class in the elevated permission structure. ### Claim 17 (depends on 13) The computer storage medium of claim 13, further comprising automatically disassociating the elevated class resources with the user ACEE at an expiration of a limited duration of time. ### Claim 18 A computerized system comprising: a processor; and a computer storage medium storing computer-useable instructions that, when used by the processor, cause the processor to: receive, from a user device, a request from a user to an elevation class, the elevation class corresponding to elevated class resources of a mainframe system; determine, at the mainframe system, if the user has permission to the elevation class; based on the determining, register a user identification corresponding to the user and the elevation class in an elevated permission structure; and dynamically create an access control environment element (ACEE) with the elevated permission structure. ### Claim 19 (depends on 18) The computerized system of claim 18, further comprising associating the elevated class resources with the ACEE. ### Claim 20 (depends on 19) The computerized system of claim 19, further comprising validating the user with access to the elevated class resources.