# US 7,467,414 B2 · Entitlement security and control for information system entitlement > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,467,414 B2 - Document ID: US7467414B2 - Status: Granted - Kind: B2 - Application number: 10/390,582 - Filed: 2003-03-17 - Published: 2004-09-23 - Granted: 2008-12-16 - Earliest claimed: 2003-03-17 - Assignees: Intel Corporation - Inventors: David Schlesinger - Web page: https://patentgrep.com/patent/US7467414B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system, apparatus, and method are provided for entitlement security and control. According to one embodiment, an entitlement request is received from a downstream access control system seeking entitlement permission on behalf of a user, a group of users, all users associated with the downstream access control system, or on behalf of the downstream access control system as a whole, the entitlement request is matched against entitlement rules and roles that are retrieved from a metadata repository, and the entitlement permission is granted if the entitlement request satisfies the entitlement rules and roles. ## Claims ### Claim 1 A method comprising: receiving an entitlement request from a downstream access control system seeking an entitlement permission; searching data relating to the downstream access control system and to a user associated with the request to provide details of the data in a customized format, wherein the searching of the data is performed in real-time via a search engine, retrieving the data, and matching the data with request information contained in the request; retrieving entitlement rules and roles from a metadata repository, the metadata repository includes metadata describing the entitlement rules and roles; matching the request information with the entitlement rules and roles and the metadata; granting the entitlement permission upon satisfaction of the entitlement rules and roles by the entitlement request; generating an audit trail of entitlement events by keeping track of the entitlement events relating to the granting of the entitlement permission, the audit trail having entitlement-related information, the tracking of the entitlement events including identifying missing information, the missing information is verified against the entitlement-related information being stored at a database, wherein the audit trail is further to perform one or more of track history of the user, identify the user, track updates to status of the user, and validate access-related information; tracking and maintaining data sources in real-time via an event tracker, wherein the data sources include the database; validating the granting of the entitlement request by accessing the audit trail; rejecting the entitlement permission upon dissatisfaction of the entitlement rules and roles by the entitlement request; and granting an exception to the downstream access control system, the exception comprises the downstream access control system submitting a second entitlement request to seek entitlement permission. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating an entitlement profile based on the entitlement request; generating entitlement requirements based on the entitlement rules and roles; matching the entitlement profile against the entitlement requirements; and granting the entitlement permission upon satisfaction of the entitlement requirements by the entitlement profile. ### Claim 3 (depends on 1) The method of claim 1, further comprising: tagging the metadata with the entitlement rules and roles; and placing the entitlement rules and roles in the metadata repository. ### Claim 4 (depends on 2) The method of claim 2, further comprising: tagging the metadata with the entitlement profile and the entitlement requirements; and placing the entitlement profile and the entitlement requirements in the metadata repository. ### Claim 5 (depends on 1) The method of claim 1, wherein the entitlement rules and roles comprise security classified entitlement rules and security classified entitlement roles. ### Claim 6 (depends on 5) The method of claim 5, wherein the security classified rules comprise one or more of laws, rules, regulations, policies, plans, and considerations. ### Claim 7 (depends on 1) The method of claim 1, wherein the entitlement permission comprises the downstream access control system to qualify to seek an access permission. ### Claim 8 (depends on 7) The method of claim 7, wherein the access permission comprises the downstream access control system to qualify to seek access to one or more of an upstream protected application, an upstream protected database, upstream protected system, and an upstream protected role. ### Claim 9 (depends on 2) The method of claim 2, wherein the entitlement profile comprises information based on the entitlement request and the entitlement rules and roles. ### Claim 10 (depends on 2) The method of claim 2, wherein the entitlement requirements comprise requirements based on the entitlement request and the entitlement rules and roles. ### Claim 11 A system comprising: an entitlement security and control unit having: a data classification unit to receive and classify data to form entitlement rules and roles; a metadata repository coupled with the classification unit, the metadata repository having the entitlement rules and roles and metadata describing the entitlement rules and roles; and an entitlement processing unit coupled with the metadata repository, the entitlement processing unit to process an entitlement request received from a downstream access control system seeking an entitlement permission to an upstream protected application by searching data relating to the downstream access control system and to a user associated with the request to provide details of the data in a customized format, wherein the searching of the data is performed in real-time via a search engine, retrieve the data, and match the data with request information contained in the request, and match the request information with the entitlement rules and roles and the metadata, grant the entitlement permission upon satisfaction of the entitlement rules and roles by the entitlement request, generate an audit trail of entitlement events by keeping track of the entitlement events relating to the granting of the entitlement permission, the audit trail having entitlement-related information, the tracking of the entitlement events including identifying missing information, the missing information is verified against the entitlement-related information being stored at a database, validate the granting of the entitlement request by accessing the audit trail, wherein the audit trail is further to perform one or more of track history of the user, identify the user, track updates to status of the user, and validate access-related information, and track and maintain data sources in real-time via an event tracker, wherein the data sources include the database, reject the entitlement permission upon dissatisfaction of the entitlement rules and roles by the entitlement request, and granting an exception to the downstream access control system, the exception comprises the downstream access control system submitting a second entitlement request to seek entitlement permission. ### Claim 12 (depends on 11) The system of claim 11, wherein the entitlement processing unit is further to retrieve the entitlement rules and roles from the metadata repository. ### Claim 13 (depends on 11) The system of claim 11, wherein the entitlement processing unit comprises an event tracker to track events relating to processing of the entitlement request. ### Claim 14 A tangible computer-readable storage medium comprising computer program which, when executed, cause a computer to: receive an entitlement request from a downstream access control system seeking an entitlement permission; search data relating to the downstream access control system and to a user associated with the request to provide details of the data in a customized format, wherein the searching of the data is performed in real-time via a search engine, retrieving the data, and matching the data with request information contained in the request; retrieve entitlement rules and roles from a metadata repository, the metadata repository includes metadata describing the entitlement rules and roles; match the request information with the entitlement rules and roles and the metadata; grant the entitlement permission upon satisfaction of the entitlement rules and roles by the entitlement request; generate an audit trail of entitlement events by keeping track of the entitlement events relating to the granting of the entitlement permission, the audit trail having entitlement-related information, the tracking of the entitlement events including identifying missing information, the missing information is verified against the entitlement-related information being stored at a database, wherein the audit trail is further to perform one or more of track history of the user, identify the user, track updates to status of the user, and validate access-related information; track and maintain data sources in real-time via an event tracker, wherein the data sources include the database; validate the granting of the entitlement request by accessing the audit trail; reject the entitlement permission upon dissatisfaction of the entitlement rules and roles by the entitlement request; and grant an exception to the downstream access control system, the exception comprises the downstream access control system submitting a second entitlement request to seek entitlement permission. ### Claim 15 (depends on 14) The tangible computer-readable storage medium of claim 14, wherein the computer program when executed, further cause the computer to: generate an entitlement profile based on the entitlement request; generate entitlement requirements based on the entitlement rules and roles; match the entitlement profile against the entitlement requirements; and grant the entitlement permission upon satisfaction of the entitlement requirements by the entitlement profile. ### Claim 16 (depends on 14) The tangible computer-readable storage medium of claim 14, wherein the computer program when executed, further cause the computer to: tag the metadata with the entitlement rules and roles; and place the entitlement rules and roles in the metadata repository. ### Claim 17 (depends on 15) The tangible computer-readable storage medium of claim 15, wherein the computer program when executed, further cause the computer to: tag the metadata with the entitlement profile and the entitlement requirements; and place the entitlement profile and the entitlement requirements in the metadata repository.