International Business Machines Corporation

Brian Robert Matthiesen

Gee Ngoo Chia

Dennis Raymond Doll

Bassam Hassoun

Ariel Farkash

Patrick Ryan Wardrop

Ilgen Banu Yuceer

Igor Gokhman

Matthew Elsner

David G Druker

Jean Elizabeth Hidden

Stephen James Turcol

Britton G Thrasher

John Leslie Harter

David Walsh Palmieri

Jeffrey Tobias Robke

Jedd Samuel Weise

John B Young

Alexander Phillip Amies

Fernando Barcelo

The example embodiments are directed to a system and method for managing blockchain transaction processing. In an example, the method includes one or more of receiving a message transmitted from a client device, the message including a predefined structural format for processing by a service providing computing system, determining a type of the message and detecting one or more sensitive fields within the message based on the determined type of the message, anonymizing values of the one or more sensitive fields within the message while leaving the predefined structural format intact, and transmitting the anonymized message including the one or more anonymized values with the predefined structural format remaining intact to the service providing computing system. The system can anonymize data from a private network before it is transmitted to a public service.

Data sanitization system for public host platform

An identity management system is augmented to provide for automated suspension of all dormant accounts before launching a re-certification campaign (pass). In one implementation, prior to receiving a recertification notice from the system, the affected user's account is already suspended and thus cannot be accessed. Once the recertification succeeds, however, the account is restored. Preferably, the technique is exposed to an IAM system administrator through a simple interface, e.g., a one-click 'suspend and re-certify' button in an administrative menu. When the administrator initiates the re-certification process, he or she may select the button for a particular account or user.

Reducing risks associated with recertification of dormant accounts

An identity and access management IAM system is augmented to provide for supervised, iterative machine learning (ML), preferably with a user-generated training set for classification. The training set may include various types of data, including characteristics or attributes of the account types, the users, or the like. A goal of the initial ML training, which may include one or multiple passes, is to enable the machine to identify specific characteristics or attributes that provide a good classification result, with the resulting classifications then applied within the IAM system. In particular, the output of the ML system may be used by the IAM system for enforcing rights associated with the identified accounts, managing accounts, and so forth.

Using classification data as training set for auto-classification of admin rights

An identity management system is augmented to provide a methodology to generate an objective measure of administrative effectiveness with respect to account certification. In the approach, erroneous account information is intentionally inserted into a recertification campaign. The erroneous account information is tracked through the recertification process and used as a measurement to evaluate whether a particular manager/administrator whose accounts are impacted is successful in recognizing the erroneous account information (e.g., as a percentage of erroneous account records located). The dummy information is tracked and used to generate a quantitative measure of the effectiveness of a particular recertification campaign or a particular manager who is responsible for recertifying accounts. The results can also be used to drive other enterprise metrics and compliance systems.

Quantitatively measuring recertification campaign effectiveness

A mechanism is provided for selective password synchronization. An indication is received that a password is to be changed for an account in a plurality of accounts associated with an individual, where the indication includes a new password. Responsive to receiving the indication of the password change, the account is grouped with one or more other accounts in the plurality of accounts thereby forming a first subset of accounts, where grouping the account with the one or more other accounts in the plurality of accounts excludes at least one account in the plurality of accounts thereby forming a second subset of accounts. The new password is propagated to the first subset of accounts according to a first policy. The new password is propagated to a second subset of accounts of the plurality of accounts according to a second policy, where the second policy is different from the first policy.

Selective password synchronization

An identity management system is augmented to enable a manager to associate 'risk' metadata with different types of access requests representing computer system accounts that can be requested by authorized users. When an authorized user then requests access to a particular account, any 'risk' associated with that access is shown to the user, typically in the form of a visual &#x201c;badge&#x201d; or other such indicator. The badge includes an appropriate informational display (e.g., &#x201c;High Risk&#x201d; or &#x201c;Regulated&#x201d;) that provides an appropriate risk warning. The risk metadata badge information preferably also is displayed for risk-based access request approval routing; in such context, the risk metadata may also determine the risk approval workflow itself. Thus, for example, if the risk metadata is present when the authorized user requests access, an approval workflow may be modified so that the request approval is routed appropriately.

Visual display of risk-identifying metadata for identity management access requests

A computer implemented method, data processing system, and computer program product is provided for using compliance violation risk data about an entity to enable an identity management system to dynamically adjust the frequency in which the identity management system performs a reconciliation and compliance check of an identity account associated with the entity. Data associated with an identity account is collected, wherein the data comprises at least one of compliance data, prior compliance violations, or personal data about an entity associated with the identity account. One or more risk factors for the identity account based on the collected data are determined. A risk score of the identity account is calculated based on the determined risk factors. The identity account is then audited with a frequency according to the risk score assigned to the identity account.

Managing and monitoring continuous improvement in detection of compliance violations

Embodiments of the invention provide a method, a system and a computer program product for analyzing the effect of a software maintenance patch on configuration items of a CMDB. One embodiment, directed to a method, is associated with a CMDB containing information that relates to configuration items (CIs) included in one or more managed configurable systems. The method includes the step of generating a manifest that defines a target system, and contains a description of a maintenance patch disposed to update one or more specified software components. The method further includes using information contained in the manifest to search the CMDB, in order to detect each configurable system in the CMDB that corresponds to the definition of the target system, and contains at least one CI that includes at least one of the specified software components. For a given CI that includes at least one of the specified software components, an identification is made of every other CI in the CMDB that would be affected, if the maintenance patch was used to update each specified software component of the given CI.

Analysis of effects of a software maintenance patch on configuration items of a CMDB

An identity management system provides for a computationally efficient approach to monitor group changes, or events, on a directory service. Group events are monitored by use of a domain crawler process launched by an event monitoring process of the identity management system that gathers group event data and reports the collected and consolidated changes to the identity management system.

System for notification of group membership changes in directory service

A system for synchronizing account names from a plurality of source security systems. In response to coupling a conversion system between the plurality of source security systems and a target security system, identity data from a human resource system and account data from the plurality of local source security systems is loaded into the conversion system. A name resolution rule set is retrieved and a unique account name identification is generated for a set of account names associated with an identity using the name resolution rule set. The set of account names associated with the identity is converted to the unique account name identification to produce a synchronized set of account names associated with the identity. Then, the synchronized set of account names associated with the identity is stored in the target security system.

Growing community of inventors

Rancho Santa Margarita, CA, United States of America

Brian Robert Matthiesen