Oracle International Corporation

Juniper Networks, Inc.

Chi-Cheng Lee

Richard Sinn

Thomas B Remahl

Andy Tsang

Joan C Teng

Arvind Gopalan

Stan Yuen

Andy M Tsang

A method for managing access to network resources by a first network device may include establishing a communication session with the first network device. The method may also include receiving information from the first network device during the communication session, the information indicating that the first network device is not in compliance with at least one security-related rule. The method may further include determining whether to modify access by the first network device to at least one of the network resources based on the received information.

Dynamic access management for network security

Technology is disclosed for controlling access to data store information among multiple entities. A corresponding wrapper is created for information that may be subject to simultaneous access attempts. The wrapper includes an attribute that identifies the accessibility of the information&#x2014;indicating whether the information is locked from further access, shareable among multiple entities, or not restricted at all. Before accessing information in the data store, an entity looks at the wrapper associated with the information to determine the type of access allowed, if any. An Identity, Access, or integrated Identity/Access System may maintain the wrappers as objects in the data store, with each wrapper object controlling another object containing information. Wrappers can be utilized when multiple provisioning applications are employed to provision resources. Each user and their corresponding resources are represented as objects with corresponding wrappers. Each provisioning application employs the wrappers to ensure that it has exclusive ownership of selected user and resource objects when provisioning resources to the selected user.

Employing wrapper profiles

Technology is disclosed for supporting multiple data stores. The set of data stores can be of a uniform type, or the various data stores can be different types (e.g. Lightweight Directory Access Protocol (LDAP), Structured Query Language (SQL), etc.). One implementation of the disclosed technology is with an Identity System. Another implementation is with an integrated Identity System and Access System. Various embodiments of the present invention utilize different means to separate the business logic of a system from the data access logic so that different types of data stores can be used without changing the business logic.

Support for multiple data stores

The present invention is directed to technology for using a proxy in an Identity System. When a first entity is on vacation, on a business trip or otherwise unavailable to perform certain actions on an Identity System, a second entity can act as a proxy for the first entity. The Identity System will provide the second entity, acting as a proxy, with the privileges, access and rights of the first entity. In one embodiment, Identity System is part of an integrated Identity and Access System, and the second entity is a proxy in the Identity System but not in the Access System.

Growing community of inventors

Cupertino, CA, United States of America

Chi-Cheng Lee