US 9,286,595 B2Granted

System and method for collecting and normalizing entitlement data within an enterprise

AssigneeEMC Corporation

InventorsDeepak Taneja, Prasad V. Bhamidipati, Bushan Yadav Byragani, Sanjay Nadimpalli, Joaquin Lull

Life of this patent

Estimating the term…

Loading patent…

Abstract

A compliance manager system automates monitoring, reporting, certification and remediation of user entitlements and roles, making it possible for organizations to easily establish a sustainable access governance model. The system enables organizations to gain enterprise-wide visibility into all user entitlements and roles and, in particular, to monitor who has access to what application, how they got access, and who approved such access. In one embodiment, a discovery and aggregation mechanism acquires identity, entitlement and role information together with associated metadata from enterprise infrastructure and applications. This information is normalized producing a unified view that is complete and correlated across users, entitlements, roles and resources.

Claims14

Dependent claims

Apparatus, comprising:

a processor;
computer memory holding computer program instructions that when executed by the processor manage user entitlements within an enterprise by:
receiving a data set collected from each of a set of applications within the enterprise, the set of applications running on a set of servers coupled to the apparatus over a network, wherein each data set is associated with a user's entitlements with respect to the application and represents the user's entitlements in an application-specific format that differs from application-specific formats of other data sets received from other applications, at least one data set including metadata that specifies rules for expressing the respective data set in a normalized format and rules for resolving conflicts in attributes;
transforming each data set that meets a requirement for data quality into a record structure associated with an enterprise entitlement model;
and
unifying the transformed data sets to create and store, in a data store, a unified view of the user's entitlements within the enterprise that is complete and correlated across users, entitlements, roles and resources in the normalized format, by the following sub-steps:
merging two or more data records from different ones of the set of applications in different application-specific formats in accordance with the rules specified in the metadata for the at least one data set;
resolving any conflict in an attribute associated with the merged data records using the metadata from the data set to unify join conditions, authoritative attributes defined by the metadata, and reference resolution rules, the authoritative attributes defined by the metadata specifying an application whose attribute takes precedence when corresponding attributes received from different applications differ;
resolving any conflict in an application reference associated with the merged data records;
identifying whether an error occurring during the unifying operation violates a unification verification rule;
and
accepting the unified view if the error occurring during the unifying operation does not violate the unification verification rule.

9 more elements

Apparatus, comprising:

a processor;
computer memory holding computer program instructions that when executed by the processor manage given data within an enterprise by:
receiving a data set collected from each of a set of applications within the enterprise, the set of applications running on a set of servers coupled to the apparatus over a network, wherein each data set is associated with the application and represents a user's entitlements in an application-specific format that differs from application-specific formats of other data sets received from other applications, at least one data set including metadata that specifies rules for expressing the respective data set in a normalized format and rules for resolving conflicts in attributes;
transforming each data set that meets a standard for data quality into a record structure associated with an enterprise model;
unifying the transformed data sets to create and store, in a data store, a unified view that is complete and correlated across users, entitlements, roles and resources in a normalized format, the unified view having a business-specific attribute associated therewith for a subset of users who share a specified risk profile, the unified view created by the following sub-steps:
merging two or more data records from different ones of the set of applications in different application-specific formats in accordance with the rules specified in the metadata for the at least one data set;
resolving any conflict in an attribute associated with the merged data records using the metadata from the data set to unify join conditions, authoritative attributes defined by the metadata, and reference resolution rules, the authoritative attributes defined by the metadata specifying an application whose attribute takes precedence when corresponding attributes received from different applications differ;
resolving any conflict in an application reference associated with the merged data records;
and
processing any un-resolved application reference according to a configuration action;
and
performing a compliance analysis on the unified view;
wherein the given data is one of identity data, entitlement data and activity data.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/833,012Filed 2 Aug 2007 · us provisional application
Priority: 2 Aug 2006
Published: US 2008/0052102 A128 Feb 2008
Granted: 15 Mar 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06Q 10/10
Administration; Management: office automation; Time management
G06Q 10/063
Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling: operations research,…
G06Q 10/103
Office automation; Time management: workflow collaboration or project management
H04L 9/40
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: network security protocols