International Business Machines Corporation

Mark J Braksator

Bruce Arland Rich

Soke-Wan Chau

Bassam Hassoun

Soke-Wan Chua

Daniel Biskar

A method, apparatus, and computer program product uses a SELECT FOR UPDATE, to pick up events from a TARGET_EVENT table. Selected events are reserved for processing by a cluster node which triggers a query. PICKUP_TIME and SERVER_ID values are inserted for each of the events picked from the TARGET_EVENT table. The events are grouped by TARGET and UID while preserving a relative order in an overall event sequence. A group of events is then submitted for processing.

Method to efficiently and reliably process ordered user account events in a cluster

An identity management system is augmented to provide for automated provisioning of user accounts. A user account is autoprovisioned based on detected attribute patterns. A set of existing account information is retrieved. A software module resident in a computer memory performs pattern matching on the retrieved set of existing account information to extract attribute information in the retrieved set of existing account information and on the extracted attribute information to discover a first attribute pattern. Next, an account template is generated according to the discovered attribute patterns. Using the generated account template, a new account on the first target is created giving the first user access to the target.

Automatically provisioning new accounts on managed targets by pattern recognition of existing account attributes

Automatically discovering attribute permissions is provided. A profile indicating a set of attributes that can be converted into permissions for a new target instance is provided. In response to detecting that the new target instance is being added, a convertible set of attributes for the new target instance is searched for based on the profile. Search results for the convertible set of attributes are displayed. Ones of the convertible set of attributes are selected as a set of attribute permissions for the new target instance for access control to the new target instance.

Automatically discovering attribute permissions

A set of existing account information belonging to respective user accounts of a first set of users is retrieved. Pattern matching is performed by an attribute pattern discovery component on the retrieved set of existing account information to discover attribute patterns in the retrieved set of existing account information. A first pattern matching process extracts user attribute information in the retrieved set of existing account information and a second pattern matching process discovers at least a first attribute pattern within the extracted user attribute information. An account template is generated according to the first discovered attribute pattern. The generated account template is used to create a new account on the first target for a first user where the first user is not a member of the first set of users. The first user is granted access to the first target using the created new account.

An identity management system is augmented to provide for automated provisioning of user accounts in an IAM system. A user account is autoprovisioned based on detected attribute patterns. Responsive to a user request from a requesting user for access to a first target, it is determined that access will require a creation of a new account on the first target. A set of existing account information is retrieved. The retrieved set of existing account information is analyzed to discover attribute patterns in the existing account information. Next, an account template is generated according to the discovered attribute patterns. Using the generated account template, a new account on the first target is created giving the user access to the target.

Mechanisms are provided for calculating state of cryptographic objects and generating search filters for querying cryptographic objects based on the given state or on the given combination of unique states. The mechanism to calculate a state of a cryptographic object allows an application or system to resolve the current state of any cryptographic object with the following set of state altering date values: initial date, activation date, deactivation date, compromise date, and destroy date. A processing module may retrieve the state meta-data and calculate the current state of a given cryptographic object. The current state may be, for example, one of the following: unknown, pre-active, active, deactivated, compromised, destroyed, and destroyed-compromised. The mechanism to generate a search filter may generate a search query language (SQL) search filter to query for cryptographic objects using the state altering date values stored for each object.

Growing community of inventors

Riverside, CA, United States of America

Mark J Braksator