Bank of America Corporation

Bryan Thompson

John H Kling

Ward Green

Systems and methods are provided for provisioning access rights to physical computing resources using an IAM system implementing an IAM data model. The IAM data model may identify logical and physical computing resources. An access request handler may receive an access request and identify a set of logical permissions based on the access request. The access request handler may derive a set of logical entitlements based on the set of logical permissions. An entitlement translator may translate the set of logical entitlements to a physical entitlement specification based on a set of physical permission specifications associated with the set of logical permissions. A physical permission specification may be obtained by mapping a logical permission to one or more physical permissions. An access control manager may then provision access rights to at least one physical computing resource indicated in the physical entitlement specification.

Access requests at IAM system implementing IAM data model

Systems and methods of conducting access reviews of access rights to logical computing resources are provided. An access reviewer may receive a selection indicating a user having access to one or more logical computing resources of a computer system. The access reviewer may identify a set of current logical computing resources that the user has access to and a set of current logical entitlements associated with the user. The access reviewer may generate an access review summary based on a comparison of the current logical computing resources to one or more of the current logical entitlements.

Access reviews at IAM system implementing IAM data model

Systems and methods for reconciling access rights provisioned for physical computing resources of a computer system are provided. A reconciler may identify current physical computing resources accessible to a user account of the computer system and a physical entitlement specification associated with the user account. The reconciler may determine whether adjustment of access rights is needed based on a comparison of the current physical computing resources to the physical entitlement specification. Access rights to at least one physical computing resource may be adjusted in response to a determination that adjustment of access rights is needed.

Reconciling access rights at IAM system implementing IAM data model

Systems and methods of verifying separation-of-duties (SoD) for requested access rights to physical computing resources are provided. An SoD verifier may receive and access request and obtain a set of current permissions associated with a requestee specified in the access request. The SoD verifier may also obtain a set of new permissions to provision for the requestee based on the access request. The SoD verifier may determine whether one of the current permissions is incompatible with one of the new permissions. The SoD verifier may provide an indication of whether the access request represents an SoD violation.

Growing community of inventors

Frisco, TX, United States of America

Bryan Thompson