Chris Hockings

This disclosure describes a method of and system for provisioning of shared account credentials to provide authorized access to shared or delegated accounts. Preferably, an enterprise single sign-on (E-SSO) system is used to manage the shared account or control delegation of account access, and preferably the shared or delegated account credential is not exposed to the end user. The described technique enables temporary delegation of account privileges to a member of a shared role. Using the… Show more

This disclosure describes a method of and system for provisioning of shared account credentials to provide authorized access to shared or delegated accounts. Preferably, an enterprise single sign-on (E-SSO) system is used to manage the shared account or control delegation of account access, and preferably the shared or delegated account credential is not exposed to the end user. The described technique enables temporary delegation of account privileges to a member of a shared role. Using the described approach, an information technology (IT) account may be shared so that a user who needs to perform a shared duty can do so in the context of a shared role and without having control over the account itself. The approach facilitates delegating the use of a single account to one of a member of the shared role.
Show less

A role and entitlements mining system uses network intelligence
to facilitate role definition. The system records traffic
on a network. The traffic is analyzed to identify the user and
application involved. The matched data is then provided to an
analytics engine, which analyzes that data to attempt to derive
an initial set of one or more roles and the application entitlements
for each role. Each role derived by the analytics engine
identifies one or more users who are… Show more

A role and entitlements mining system uses network intelligence
to facilitate role definition. The system records traffic
on a network. The traffic is analyzed to identify the user and
application involved. The matched data is then provided to an
analytics engine, which analyzes that data to attempt to derive
an initial set of one or more roles and the application entitlements
for each role. Each role derived by the analytics engine
identifies one or more users who are identified as belonging to
the role, as well as one or more application entitlements.
Preferably, one or more directory services are then interrogated
for known group and user relationships to detect
whether the roles identified by the analytics engine can be
modified or enriched. Evaluation of the known group and user
relationships provides a way to identify a more granular set of
role definitions. A role-based access control policy is then
generated. Show less

An authorization method is implemented in an authorization engine external to an authorization server. The authorization server includes a cache. The external authorization engine comprises an authorization decision engine, and a policy analytics engine. The method begins when the authorization decision engine receives a request for an authorization decision. The request is generated (at the authorization server) following receipt of a client request for which an authorization decision is not… Show more

An authorization method is implemented in an authorization engine external to an authorization server. The authorization server includes a cache. The external authorization engine comprises an authorization decision engine, and a policy analytics engine. The method begins when the authorization decision engine receives a request for an authorization decision. The request is generated (at the authorization server) following receipt of a client request for which an authorization decision is not then available at the server. The authorization decision engine determines an authorization policy to apply to the client request, applies the policy, and generates an authorization decision. The authorization decision is then provided to the policy analytics engine, which stores previously-generated potential cache directives that may be applied to the authorization decision. Preferably, the cache directives are generated in an off-line manner (e.g., during initialization) by examining each security policy and extracting one or more cache dimensions associated with each such policy. The policy analytics engine determines an applicable cache directive, and the decision is augmented to include that cache directive. The decision (including the cache directive) is then returned to the authorization server, where the decision is applied to process the client request. The cache directive is then cached for re-use at the authorization server. Show less