International Business Machines Corporation

David Gerard Kuehr-McLaren

Govindaraj Sampathkumar

Timothy G Shoriak

Mark Charles Davis

John Ryan McGarvey

Calvin Stacy Powers

Pratik Gupta

Kwabena A Mireku

Linwood H Overby, Jr

Hari Shankar

Martin J Presler-Marshall

Magesh Rajamani

Oriana Jeannette Love

Jeffrey Tobias Robke

David Walsh Palmieri

John H Walczyk, Iii

Gordon Kent Arnold

Vincent C Williams

Sumit Taank

Ranjan Kumar

Luis B Casco-Arias Sanchez

Todd D Jordan

Chrystian L Plachco

Sharon L Cutcher

Brian A Stube

Anthony Joseph Nadalin

Timothy James Hahn

John Michael Garrison

Michael E Baskey

Dilip Dinkar Kandlur

Mark William Hubbard

Xiaoyan Y Zhang

Mandar U Jog

Luis Benici Casco-Arias

Edward Joseph Dobner

Janette Siu Jong Wong

Andrew David Record

Reid L Sayre

James Darwin

Janette S Wong

Ian A Morrison

Steve D Gray

Gabriel C Rebane

David Edwards

John Charles Bihlmeyer

An identity governance system that automates launching of identity campaigns (e.g., attestation, certification, etc.) is augmented to provide for the more efficient generation of datasets that are to be evaluated in a particular campaign review. To this end, at least one data model supported in the system is extended to support user- or system-defined metadata that, once populated with data, enable the system to generate campaign datasets from various data sources in an automated, efficient manner. Metadata includes, for example, application properties, entitlement properties, and the like. In lieu of maintaining a list of entitlements manually, an administrator defines metadata that should be associated with various datasets, e.g., for each application, entitlement, organization unit, etc. When time to generate a campaign dataset, the system examines the underlying data sources (that are extended via the metadata) to enable automated generation of a campaign dataset that includes the relevant metadata information.

Metadata driven selection of entitlements in an identity governance system

A technique for identity governance (IG) data exchange includes receiving, by a first adapter, an identity governance message from a first identity governance resource for transmission of the identity governance message to a second identity governance resource. The first adapter analyzes the message and, based on the analysis, selects a routing policy to apply to the message. Based on the routing policy, the adapter determines a select input queue from a plurality of input queues to receive the message and writes the message to the select input queue. The message is then routed from the select input queue to an output queue, and then a second adapter transfers the message from the output queue to the second identity governance resource.

System and method to exchange identity governance data across multiple identity repositories

A method, program product and apparatus for controlling access to profile information, multi-media resources or social network functions of a first user by a second user not listed on a friend or group listing of the first user. An application retrieves a threshold criteria for access control and social network statistics in response to an attempted access by an entity without an appropriate privilege. The application compares the statistics to the threshold. Then, if the statistics meet the threshold criteria, the application allows access.

Using social networking thresholds in access control decisions

The Custom Access Controller adds a custom security hierarchy to the organizational data in the View Processor of WEBSPHERE Virtual Member Manager. Whenever an entity or application attempts to access a resources the access control engine starts the View Processor to identify the organizational data and assigned security policy for the resource. The assigned security policy is applied to a delegated administration path which is part of the delegated administration hierarchy but includes the appropriate path and security policy for the resource. The delegated administration path is sent to an access control engine that grants or denies access to the resource. A View Processor Interface allows network administrators to create and modify custom security hierarchies.

Method and apparatus for creating custom access control hierarchies

Mechanisms are provided for performing a role engineering project for applying security roles to access operations targeting resources. A plurality of data objects representing one or more user identities, permissions, and resources of an organization computing system are received. One or more filter criteria for filtering the plurality of data objects to generate a subset of data objects for consideration during the role engineering project are received. The one or more filter criteria specify a scope of the role engineering project. The one or more filter criteria are applied to generate the subset of data objects. Role engineering project operations are performed on the subset of data objects to generate one or more security roles. The one or more security roles are deployed to the organization computing system to control access operations targeting resources of the organization computing system.

Role engineering scoping and management

Embodiments of the present invention address deficiencies of the art in respect to security enforcement point operability in a TLS secured communications path and provide a novel and non-obvious method, system and computer program product for the secure sharing of TLS session keys with trusted enforcement points. In one embodiment of the invention, a method for securely sharing TLS session keys with trusted enforcement points can be provided. The method can include conducting a TLS handshake with a TLS client to extract and decrypt a session key for a TLS session with the TLS client traversing at least one security enforcement point. The method further can include providing the session key to a communicatively coupled key server for distribution to the at least one security enforcement point. Finally, the method can include engaging in secure communications with the TLS client over the TLS session.

Secure sharing of transport layer security session keys with trusted enforcement points

Parties involved in transacting business in an E-marketplace (E-marketplace participants) each identify and submit to the E-marketplace their P3P policy and/or other relevant characteristics related to their privacy policy needs (those that they adhere to, referred to as 'privacy policies'; those that they require, referred to as 'privacy preferences', or both). Submitted with the privacy policy is a digital signature that is tied to the owner of the web objects to which the privacy policy pertains. Using a digital signature assures the integrity of the privacy policy since it travels with the privacy policy and thus refers back to the original sender of the policy rather than the middleman (the E-marketplace), and if the document (the privacy policy) to which it is attached has been tampered with, the digital signature will be invalidated.

Method, system, and computer program product for digital verification of collected privacy policies in electronic transactions

Policies defining the entitlements to be assigned to a new identity joining a role are automatically generated. An automatic policy assigns a new identity the entitlements commonly owned by a predetermined number of identities in the role, which may be all of the role identities. A conditional policy recommends that a new identity be assigned the non-commonly-owned entitlements associated with the role identity whose non-entitlement attributes most closely match the non-entitlement attributes of the new identity. This may be automatically determined by iterating through a vector that maps the non-commonly-owned entitlements with the non-entitlement attributes of each role identity, comparing the non-entitlement attributes of the new identity to find the closest match. The non-commonly-owned entitlements of that identity are then recommended to be assigned to the new identity, upon approval.

Automatic policy generation based on role entitlements and identity attributes

Parties involved in a transaction in an E-marketplace identify characteristics of a transaction that they are willing to accept and/or that they can provide. To do this, an attribute certificate is created for each party that contains the attributes of a buyer, seller, or third-party participant who will be transacting business in the particular E-marketplace. The attributes pertain to specifics of the transaction. The party submitting the attribute also identifies alternative conditions which, if they exist would be acceptable for conducting the transaction. Once these criteria, in the form of the attribute certificates, are received by the E-marketplace, the E-marketplace verifies the attributes. A server in the E-marketplace is configured to determine various combinations of participants that can match the deal criteria. In this manner, the E-marketplace 'choreographs' the transaction to meet the needs of all.

Method, system and computer program product for selective data disclosure and contract negotiation in an E-marketplace based on predetermined preferences

An abstraction layer associates a party-focused object, a security-focused object, or both, with an abstraction object. The party-focused or security focused object has one or more properties. The properties are presented in the abstraction object defined by the mapping schema. The abstraction layer converts a set of repository objects to at least one abstraction object.

Method and apparatus for presentation of a security-focused repository with a party-focused repository

A client is impersonalized to a plurality of servers using a middle-tier server. A common nonce associated with each of the plurality of servers is obtained and the common nonce is provided to the client. The common nonce signed by the client is received at the middle-tier server and provided as a signature for transactions from the client to the plurality of servers so as to authenticate the client to the plurality of servers.

Secure delegation using public key authentication

Growing community of inventors

Apex, NC, United States of America

David Gerard Kuehr-McLaren