Informed Control Inc.

Microsoft Technology Licensing, LLC

Sun Microsystems, Inc.

Informod Control Inc.

Mark Wahl

Efim Hudis

Craig Henry Wittenberg

Moshe Israel

Ben Kliger

Jeffrey Alexander Staiman

Steven Jay Lieberman

David Gregory Gadbois

Alex Weinert

Phil Stradling

Matthew Penarczyk

Dave Shute

An access configuration for an access control manager is generated. Access data including users, resources, and actions the users performed on the resources is received into a matrix. Clusters of the matrix are formed to produce ranges of the users and ranges of the resources having selected permission levels based on the actions. Administrator-modifiable security groups are created based on the ranges of users and administrator-modifiable resources groups based on the ranges of resources.

Access control manager

An orchestrated access system is described herein that provides an access control decision function that is augmented by interfacing with a real-time collaborative communication system that maintains a state of various users' availability to communicate. The orchestrated access system provides real-time approvals for access control scenarios where the policy would not otherwise grant access. The system provides an experience for the requesting user to select an appropriate approver among multiple potential approvers based on the relationship of the potential approver to the requesting user, the relationship of the potential approver to the resource, and the availability of the potential approver for real-time communication. The system can provide a record of approver and request parameters in a database to optimize further interactions. Thus, the orchestrated access system provides an improved experience for granting access to resources within an organization for both the requesting user and the approver(s).

Orchestrated interaction in access control evaluation

A data model in which a set provides an abstraction that isolates the computation of membership from the details of how an enforcement point determines access (e.g., based on claims, based on security group membership etc). Set operations (e.g., intersection, union, inverse) can then be used across the sets. The architecture utilizes workflow on set transitions such that when an object such as a user enters the scope of one of these sets, notification can occur, such that inadvertent changes which lead to separation-of-duties violations can be detected quickly. The sets can also be used to define entitlements for enforcement of claims-based access control in a cross-organization deployment (e.g., to a cloud-hosted application).

Separation of duties checks from entitlement sets

A secure collaboration mechanism between two organizations may be created based on a set of security system definitions provided by a receiving organization to a providing organization. The providing organization may create a shared portal that has a federated access between both organizations and has access and other security functions. The data collection process may be automated using digitally signed forms or other documents to analyze the security practices of the receiving organization and create a shared portal that has increased or decreased security provisions compared to the providing organization's standard procedures. The collaboration mechanism may be implemented in a bilateral arrangement, a hub and spoke arrangement, and a multilateral arrangement.

Automated security analysis for federated relationship

An entitlement management system is described herein that models each entitlement as a resource within a resource management system. In a resource management system that applies policy to all requests to create, update, and delete a resource, this approach allows rich application of policy to the creation, delegation, renewal, expiration, and deletion of entitlements. A resource management system that can synchronize data to connected systems can thereby grant or revoke these permissions in those systems. This approach also facilitates role mining, attestation, and compliance reporting. Entitlements stored as resources may also include properties, such as workflows and policies related to the entitlements. Thus, the entitlement management system provides a more formal and automated facility for managing entitlements in organizations.

Entitlement lifecycle management in a resource management system

An information processing system in a computer network comprising an edge system, an identity provider, a relying party and a tracing service, in which the tracing service relays a queue of information of authorized user activity from a relying party to an identity provider, which then can provide that activity information to the user.

System and method for validating requests in an identity metasystem

An information processing system for remote access comprising a network access server and an authentication server is augmented with the ability to provide a simulated authentication process for authentication requests from attackers which do not correspond to authorized user names. Attackers whose requests form a password guessing attack for a user identity selected from a set of reject user names are redirected to a honeypot server.

System and method for remote authentication security management

A distributed information processing system in an enterprise computer network comprising a collection of servers providing a directory service and a directory-enabled access control system is augmented with the ability to detect user accounts in the directory service for users who have not recently authenticated to an application that uses the directory-enabled access control system.

System and method for detecting unused accounts in a distributed directory service

An information processing system for a computing network in which the access log of a directory server is analyzed to detect anomalous client access requests.

System and method for anomalous directory client activity detection

An information processing system containing middleware and backend server software components is augmented with the ability to validate the behavior of the middleware system when one or more backend servers are unavailable, based on dynamic reconfiguration of the network layer protocol software component in the operating system underlying the middleware software component.

System and method for validation of middleware failover behavior

An access control system is augmented with the ability to categorize access requests as anomalous, by correlating the time and location of the requesting user with information provided by the requesting user's calendar entries. These entries provide the dates and times that a user is anticipated to be located in a particular geographic region.

System and method for calendar-based anomalous access detection

A system including a client configured to obtain a target domain name and an Internet service configured to translate the target domain name into a target identifier and compare the target identifier to a domain name table to obtain a similarity list.

Detection for deceptively similar domain names

An information processing system comprising a translation from a directory or individuals input source to a state database containing resource description triples, a mapping of the triples in the state database from one ontology class to another, and a translation from the triples in the state database to a directory or individuals output sink.

System and method for ontology-based translation between directory schemas

A registry service is described which uses a partitioned publisher assertion recording and accessing scheme. A publisher assertion regarding a relationship between entities (e.g., business or other types of entities) is encoded within a directory information tree in a memory. The publisher assertion includes publisher assertion part nodes corresponding to entity nodes in the directory information tree. The publisher assertion is complete if all publisher assertion parts corresponding to entities in the relationship are present in the directory information tree. The service may include a network including directory servers and registry servers. The publisher assertions are manipulated by authorized publishers and accessed by users using a variety of techniques, the operations of which are performed by such parties and/or are encoded upon computer-readable media.

Growing community of inventors

Austin, TX, United States of America

Mark Wahl