Bank of America Corporation

Radu Marian

Abdulkader Omar Barbir

Cynthia Ann Frick

Rakesh Radhakrishnan

Rajat P Badhwar

John H Kling

Gregory Sito

Paul J Castillo

Michael Simon

Ronald Wayne Ritchey

Abbie Barbir

Dominique Nguyen

A data model for managing identity and access management (IAM) data implemented at an electronic database may include a set of logical resource elements, a set of physical resource elements, and a set of access requests elements that respectively model logical resources, physical resources, and access requests received at an access request manager of an enterprise. The physical resource elements may be respectively associated with the logical resource elements such that access rights for the physical resources may be obtained based on a logical resource specified in the access request. A system for managing IAM may include a mapping module configured to transform heterogeneous IAM data provided by a plurality of IAM data sources into homogeneous IAM data formatted according to the common IAM data format. A data store may implement the IAM data model such that the data store is configured to store the homogeneous IAM data.

Common data model for identity access management data

A system for managing dictionaries, such as an application dictionary and a domain dictionary, and for adding entries to a data log is described herein. The system may, in response to a determination that an event occurs at an application, determine that the application uses a first concept name from the application dictionary to describe the event. An entry for the event may be added to a data log for the application. The entry may also include the first concept name from the application dictionary. A mapping of the first concept name from the application dictionary to a second concept name from the domain dictionary may be generated. In some aspects, the data log may be sent to a data log analysis system capable of accessing the domain dictionary.

Semantic application logging and analytics

According to one embodiment, an apparatus may store a first and second subject token that indicate a first authentication method performed by the user and a second authentication method performed by the user respectively. The apparatus may detect at least one new subject token indicating at least one different authentication method performed by the user. The apparatus may then determine that a particular combination of subject tokens in the first subject token, second subject token, and the at least one new subject token indicates a privilege should be granted to the user, and facilitate the granting of the privilege to the user.

Method and apparatus for token-based combining of authentication methods

According to one embodiment, an apparatus may store a plurality of tokens indicating a user is accessing a resource over a network. The plurality of tokens may include a risk token indicating a risk associated with access by the user to the resource. The apparatus may detect a token indicating a change associated with accessing the resource, and determine that the change triggers a risk update. The apparatus may then generate a dataset token that represents the risk token and the token indicating the change, and communicate the dataset token to a token provider to perform the risk update. The apparatus may then receive a recomputed risk token representing an updated risk. The updated risk may indicate the risk associated with continuing access to the resource with the change.

Method and apparatus for token-based real-time risk updating

Methods, computer-readable media, and apparatuses are disclosed for storing and utilizing state information for service providers. In one aspect of the invention, the methods, processes, or apparatus may include one or more of the following steps: 1) storing state information on a vault; 2) requesting state information on the vault from a receiving party and a device and providing identification to the vault; 3) authenticating and certifying the request from the receiving party; 4) providing the state information to the receiving party; 5) using the state information on the device; and 6) returning the state information to the vault. An additional aspect of the invention provides a method and/or process for storing and utilizing web-based cookies on a cloud environment for service providers.

Methods and processes for storing and utilizing state information for service providers

Aspects of the present disclosure are directed to methods and systems dynamic trust federation. In one aspect, a computer implemented method may include a security token that enables sign-on into a group applications based on applicable trust criteria. In one aspect, when a user interacts with one application in the group, the trust is elevated through the application internal authentication application program interface (API). The trust may be included in the security token to make available to other applications in the group. Applications can be in multiple groups with variable level of authentication based on location and other transactions variables.

Dynamic trust federation

A system for managing an enterprise concept dictionary may include an electronic master dictionary and electronic local dictionaries. The master dictionary may include concept entries respectively associated with concept identifiers and with one or more concept definitions. The local dictionaries may include one or more of the concept identifiers of the master dictionary. A dictionary management module may be in signal communication with the master dictionary and the local dictionaries. The dictionary management module may be configured to query the master dictionary for a concept entry that corresponds to a concept associated with a modeling component. If a concept entry is found, the concept identifier may be provided. If a concept entry is not found, a new concept entry may be added to the master dictionary. A notification module may be in signal communication with the master dictionary and automatically provide notification when a concept entry is added or updated.

Enterprise concept definition management

According to one embodiment, an apparatus may store: a hard token representing identification information of the device, a network token representing the status of a network, and a resource token representing information associated with a resource. The apparatus may further store secured copies of the hard token, network token, and resource token. The apparatus may receive a suspect token indicating a risk that at least one of the device, the network, and the resource has been tampered, and in response, determine to inspect at least one of the hard token, network token, and resource token. The apparatus may then compare the at least one of the hard token, network token, and resource token with its corresponding secured copy. If at least one of those tokens does not match its corresponding secured copy, the apparatus may communicate a revalidation token indicating at least one token has been tampered.

Method and apparatus for token-based tamper detection

According to one embodiment, an apparatus may store a plurality of tokens. The plurality of tokens may include a plurality of risk tokens. Each risk token may represent a risk rating. The risk rating may be a numerical value indicating a risk associated with granting a particular user access to a particular resource. The apparatus may identify a set of related risk tokens in the plurality of risk tokens, and generate a composite risk token that represents an arithmetic combination of the risk ratings represented by the set of related risk tokens. The apparatus may then use the composite risk token to facilitate the making of an access decision.

Method and apparatus for token-based combining of risk ratings

According to one embodiment, an apparatus may store a plurality of tokens indicating that a user is attempting to access a resource. The apparatus may determine an authorization level for the user based at least in part upon the plurality of tokens. The authorization level may indicate whether the user is authorized to access the resource. The apparatus may then determine a related resource that shares a relationship with the resource, and determine that the authorization level indicates that the user is authorized to access the related resource. The apparatus may then communicate a decision token indicating that the user is authorized to access the resource and the related resource.

Method and apparatus for token-based access of related resources

According to one embodiment, an apparatus may monitor a session that facilitates the processing of a transaction. The transaction may represent an action taken against a resource during the session. The apparatus may determine that the transaction qualifies for additional monitoring, and in response, generate a tag. The tag may be unique to the transaction. The apparatus may then associate the tag with the transaction to facilitate tracing of the transaction. The apparatus may then trace the transaction during the processing of the transaction by following the tag, and communicate a message to transfer the transaction to an isolated processing unit. The isolated processing unit processes the transaction in isolation.

Method and apparatus for token-based transaction tagging

According to one embodiment, an apparatus may store a plurality of tokens indicating a user is requesting access to a resource over a network. The apparatus may determine a condition associated with accessing the resource based on the plurality of tokens. The condition may be determined in addition to a determination to grant or deny access to the resource. The condition may include an obligation to be fulfilled and a message providing instruction regarding how to fulfill the obligation. The apparatus may generate a decision token representing the condition, and communicate the decision token to a resource provider to facilitate enforcement of the condition.

Method and apparatus for token-based conditioning

According to one embodiment, an apparatus may monitor a session that facilitates a user's access to a resource. The user may be granted a privilege associated with accessing the resource. The apparatus may detect a change associated with the privilege granted to the user in at least one token of a plurality of tokens. The apparatus may then communicate a token that represents the change, and receive a risk token associated with the token. The apparatus may then determine to revoke the privilege based on the risk token, and generate a second token that represents the determination to revoke the privilege. The apparatus may then communicate the second token to facilitate the revoking of the privilege.

Method and apparatus for token-based reassignment of privileges

According to one embodiment, an apparatus may receive a hard token that identifies a device and a subject token indicating that a user is a high priority user. The subject token may include a user identifier associated with the high priority user. The apparatus may apply a token-based rule that facilitates packet prioritization in response to receiving the subject token. In response to applying the token-based rule, the apparatus may communicate a notification token to at least one network component. The notification token may include the user identifier associated with the high priority user, the device identifier associated with the device, and instructions to prioritize any packet communications associated with the user identifier or the device identifier. The apparatus may then communicate at least one token to facilitate the provisioning of a container to the device associated with the high priority user.

Growing community of inventors

Indian Trail, NC, United States of America

Radu Marian