US 8,555,333 B2Granted

Identifying and resolving separation of duties conflicts in a multi-application environment

AssigneeInternational Business Machines Corporation

InventorsJurij M. Deputat, Steven J. Ponessa

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method and system for identifying and resolving separation of duties (SOD) conflicts in a multi-application environment. An SOD conflict based on a person being granted a first authorization and a second authorization in violation of a policy is identified. The first and second authorizations are permissions allowing the person to perform, respectively, a first action provided by a first application and a second action provided by a second application. An optimal recommended action that resolves the SOD conflict is retrieved from a first database table that includes an association between the identified SOD conflict and the optimal recommended action. After the optimal recommended action is displayed on a display device, a user's acceptance of the optimal recommended action is received. In response, the optimal recommended action is performed by automatically deleting from a second database table an association between the person and the first or second authorization.

Claims19

Dependent claims

A computer-implemented method of identifying and resolving a separation of duties (SOD) conflict, the method comprising the steps of:

based on predefined rules specifying combinations of permissions causing SOD conflicts, a computing system identifying the SOD conflict for a person granted (a) a first permission to perform a first action provided by a first application, and (b) a second permission to perform a second action provided by a second application, the first application having a different function than the second application;
in response to the computing system identifying the SOD conflict and based on predefined correlations in a database between the SOD conflicts and recommended actions, the computing system correlating the SOD conflict with a recommended action to resolve the SOD conflict, the recommended action to delete the first permission for the person or delete the second permission for the person, and initiating display of the recommended action on a display device;
and
subsequent to the computing system initiating display of the recommended action, the computing system receiving an acceptance of one of the recommended actions from a user, and in response, the computing system deleting the first or second permission for the person according to the accepted recommended action,
wherein the database includes another permission that allows the person to perform another action provided by the first application, the second application or another application, and the one recommended action does not include deleting the other permission.

2 more elements

A computer system for identifying and resolving a separation of duties (SOD) conflicts, the computer system comprising:

a CPU;
a computer-readable memory;
a computer-readable, tangible storage device;
based on predefined rules specifying combinations of permissions causing SOD conflicts, first program instructions to identify the SOD conflict for a person granted (a) a first permission to perform a first action provided by a first application, and (b) a second permission to perform a second action provided by a second application, the first application having a different function than the second application;
in response to identifying the SOD conflict by the first program instructions and based on predefined correlations in a database between the SOD conflicts and recommended actions, second program instructions to correlate the SOD conflict with a recommended action to resolve the SOD conflict, the recommended action to delete the first permission for the person or delete the second permission for the person, third program instructions to initiate display of the recommended action on a display device;
and
subsequent to initiating display of the recommended action by the third program instructions, fourth program instructions to receive an acceptance of one of the recommended actions from a user, and in response, fifth program instructions to delete the first or second permission for the person according to the accepted recommended action,
wherein the database includes another permission that allows the person to perform another action provided by the first application, the second application or another application, and the one recommended action does not include deleting the other permission,
wherein the first, second, third, fourth and fifth program instructions are stored on the computer-readable, tangible storage device for execution by the CPU via the computer-readable memory.

6 more elements

A computer program product for identifying and resolving a separation of duties (SOD) conflict, the computer program product comprising:

one or more computer-readable, tangible storage devices;
and
program instructions stored on the one or more computer-readable, tangible storage devices, the program instructions when executed by a CPU of a computer system:
based on predefined rules specifying combinations of permissions causing SOD conflicts, identify the SOD conflict for a person granted (a) a first permission to perform a first action provided by a first application, and (b) a second permission to perform a second action provided by a second application, the first application having a different function than the second application;
in response to identifying the SOD conflict by an execution of the program instructions and based on predefined correlations in a database between the SOD conflicts and recommended actions, correlate the SOD conflict with a recommended action to resolve the SOD conflict, the recommended action to delete the first permission for the person or delete the second permission for the person, and initiate display of the recommended action on a display device;
and
subsequent to initiating display of the recommended action by the execution of the program instructions, receive an acceptance of one of the recommended actions from a user, and
in response, delete the first or second permission for the person according to the accepted recommended action,
wherein the database includes another permission that allows the person to perform another action provided by the first application, the second application or another application, and the one recommended action does not include deleting the other permission.

6 more elements

Dependencies are inferred from the claim text.