Patent US2219897A successfully refreshed from Google Patents.
Patent US6141778A successfully refreshed from Google Patents.
US6141778A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for automating security functions in a computer system
Assignee: Verizon Patent and Licensing Inc
•
Filing: 1998-06-29
•
Granted: 2000-10-31
•
Expires: 2018-06-29
Abstract
Abstract A computer security system automatically updates an access status and a level of access privilege for each user based on outside feeds related to current status of the user with respect to an organization, such as a business or school and the membership of the user in a group or department within the organization. A unique user identifier is assigned to each user across all computing systems. The computing system retains the relationship between the user and the user identifier even after the user's access to the computing system is terminated. The user may be reassigned the same user identifier should the user again be granted access to the system resources. The computing security system may be implemented as an overlay to an existing resource allocation system, such as the RACF system commonly found on many mainframe computers and may allow decentralization of certain security functions.
Inventors
- 👤 Kevin J. Kane
- 👤 Garrett K. Kolb
- 👤 Nora May
- 👤 Daniel E. Myer
- 👤 Jay B. Rutherford
- 👤 Denise B. Shive
- 👤 Eleanor P. Weedon
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 11:28
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/604
Claims Analysis
Total Claims: 51
Claim 1
Independent Claim
109 words
A method for providing security in a computing system, the computing system having a plurality of accounts, each account having a level of access privilege associated therewith, the plurality of accounts being respectively assigned to a plurality of users, the method comprising: for one of the plurality of accounts, obtaining a department identifier from a human resources database, the department identifier corresponding to a department to which the user assigned to the account is assigned; and automatically assigning a level of access privilege to the account, the level of access privilege corresponding to a default level of access privilege associated with the department to which the department identifier corresponds.
Claim 2
Independent Claim
109 words
A method for providing security in a computing system, the computing system having a plurality of accounts, each account having a level of access privilege associated therewith, the plurality of accounts being respectively assigned to a plurality of users, the method comprising: for one of the plurality of accounts, obtaining a department identifier from a human resources database, the department identifier corresponding to a department to which the user assigned to the account is assigned; and automatically assigning a level of access privilege to the account, the level of access privilege corresponding to a default level of access privilege associated with the department to which the department identifier corresponds.
Claim 3
Dependent Claim
57 words
The method of claim 1, further comprising: periodically automatically checking the human resources database for an employment status value corresponding to an employment status of the user to which the account is assigned; and updating an access privilege for the account if the employment status value for the user that the account is assigned to has changed.
Claim 4
Dependent Claim
78 words
The method of claim 1, further comprising: periodically automatically checking the human resources database for an employment status value corresponding to an employment status of the user to which the account is assigned; updating an access privilege for the account if the employment status value for the user that the account is assigned to has changed; and automatically providing a notice of a change in the access privilege prior to performing the step of updating the access privilege.
Claim 5
Dependent Claim
57 words
The method of claim 1, further comprising: periodically automatically checking the human resources database for the department identifier corresponding to the department to which the user assigned to the account is assigned; and updating the level of access privilege for the account if the department identifier for the user to which the account is assigned has changed.
Claim 6
Dependent Claim
82 words
The method of claim 1, further comprising: periodically automatically checking the human resources database for the department identifier corresponding to the department to which the user assigned to the account is assigned; updating the level of access privilege for the account if the department identifier for the user to which the account is assigned has changed; and automatically providing a notice of a change in the level of access privilege prior to performing the step of updating the level of access privilege.
Claim 7
Dependent Claim
44 words
The method of claim 1 wherein the one of the plurality of users is a contractor having a contract termination date, and further comprising: automatically providing a notice of a termination in access privilege at a defined period prior to the contract termination date.
Claim 8
Dependent Claim
32 words
The method of claim 1, further comprising: assigning a unique user identifier to each of the plurality of users; and associating the assigned user identifier with the account assigned to the user.
Claim 9
Dependent Claim
54 words
The method of claim 1, further comprising: assigning a unique user identifier to each of the plurality of users; associating the assigned user identifier with the account assigned to the user; and maintaining the assignment between the user identifier and the user after terminating the association between the assigned user identifier and the account.
Claim 10
Dependent Claim
67 words
The method of claim 1, further comprising: assigning a unique user identifier to each of the plurality of users; associating the assigned user identifier with the account assigned to the user; maintaining the assignment between the user identifier and the user after terminating the association between the assigned user identifier and the account; and associating the assigned user identifier with a new account assigned to the user.
Claim 11
Dependent Claim
17 words
The method of claim 1, further comprising: associating a password with each of the plurality of accounts.
Claim 12
Dependent Claim
16 words
The method of claim 1 wherein the one of the plurality of users comprises an individual.
Claim 13
Dependent Claim
18 words
The method of claim 1 wherein the one of the plurality of users comprises a group of individuals.
Claim 14
Dependent Claim
24 words
The method of claim 1 wherein the one of the plurality of users comprises a unit defined for accounting purposes based on user function.
Claim 15
Independent Claim
78 words
A method for automatically providing security in a computing system, the computing system having a plurality of accounts, the method comprising: assigning a key to one of the plurality of accounts in the computing system; obtaining a group identifier from a database based on the key; and automatically assigning a level of access privilege to the one of the plurality of accounts that corresponds to a default level of access privilege that is associated with the group identifier.
Claim 16
Independent Claim
78 words
A method for automatically providing security in a computing system, the computing system having a plurality of accounts, the method comprising: assigning a key to one of the plurality of accounts in the computing system; obtaining a group identifier from a database based on the key; and automatically assigning a level of access privilege to the one of the plurality of accounts that corresponds to a default level of access privilege that is associated with the group identifier.
Claim 17
Dependent Claim
50 words
The method of claim 14 wherein the key corresponds to a user and the step of obtaining a group identifier from a database based on the key comprises: receiving a department identifier from a human resources database, the department identifier corresponding to a department to which the user is assigned.
Claim 18
Dependent Claim
50 words
The method of claim 14, further comprising: periodically automatically checking the database for a change in the group identifier corresponding to the key; and updating the level of access privilege of the one of the plurality of accounts corresponding to the key based on the change in the group identifier.
Claim 19
Dependent Claim
63 words
The method of claim 14 wherein the key corresponds to a user, and further comprising: periodically checking a human resources database for a department identifier that corresponds to a department to which the user is assigned; and updating the level of access privilege of the one of the plurality of accounts corresponding to the key based on the change in the group identifier.
Claim 20
Dependent Claim
56 words
The method of claim 14, further comprising: periodically checking the database for a change in an access variable that corresponds to an access status for the key assigned to the account; and updating the access status of the one of the plurality of accounts corresponding to the key based on the change in the access variable.
Claim 21
Dependent Claim
54 words
The method of claim 14, further comprising: periodically automatically checking the database for an access variable that corresponds to an access status for the key assigned to the account; and reassigning the key from the one of the plurality of accounts to a holding account if the access status corresponds to a terminated condition.
Claim 22
Dependent Claim
70 words
The method of claim 14 wherein the key corresponds to a user, the access status corresponds to an employment status, and further comprising: periodically automatically checking a human resources database for an employment status variable that corresponds to an employment status of the user; and reassigning the key from the one of the plurality of accounts to a holding account if the employment status variable corresponds to a terminated condition.
Claim 23
Dependent Claim
65 words
The method of claim 14 wherein the key corresponds to a user, the access status corresponds to a status, and her comprising: periodically automatically checking a database for a access status variable that corresponds to a status of the user; and reassigning the key from the one of the plurality of accounts to a holding account if the status variable corresponds to an unassigned condition.
Claim 24
Dependent Claim
19 words
The method of claim 14, further comprising: associating a unique user identifier with each of the plurality of accounts.
Claim 25
Dependent Claim
17 words
The method of claim 14, further comprising: associating a password with each of the plurality of accounts.
Claim 26
Dependent Claim
18 words
The method of claim 14 wherein the one of the plurality of accounts is associated with an individual.
Claim 27
Dependent Claim
20 words
The method of claim 14 wherein the one of the plurality of accounts is associated with a group of individuals.
Claim 28
Independent Claim
164 words
A method of providing security in a computing system accessed by a plurality of users, the computing system having a plurality of accounts, the method comprising: assigning each user a unique user identifier; maintaining a database associating each of the plurality of users with a respective one of the assigned user identifiers; associating the user identifier with a one of the plurality of accounts; automatically terminating the association between the user identifier and the one of the plurality of accounts when an access variable corresponding to the user to whom the user identifier is assigned is equal to a first condition; continually maintaining a relationship between the user identifier and the terminated user identifier in the database after the association between the one and user identifier has been automatically terminated; and automatically reestablishing the association between the account and the user identifier if the access variable corresponding to the user that the user identifier has been assigned to is equal to a second condition.
Claim 29
Independent Claim
164 words
A method of providing security in a computing system accessed by a plurality of users, the computing system having a plurality of accounts, the method comprising: assigning each user a unique user identifier; maintaining a database associating each of the plurality of users with a respective one of the assigned user identifiers; associating the user identifier with a one of the plurality of accounts; automatically terminating the association between the user identifier and the one of the plurality of accounts when an access variable corresponding to the user to whom the user identifier is assigned is equal to a first condition; continually maintaining a relationship between the user identifier and the terminated user identifier in the database after the association between the one and user identifier has been automatically terminated; and automatically reestablishing the association between the account and the user identifier if the access variable corresponding to the user that the user identifier has been assigned to is equal to a second condition.
Claim 30
Dependent Claim
40 words
The method of claim 26 wherein the step of assigning each user a unique user identifier comprises: searching the database for the user; and assigning the user identifier previously assigned to the user if the user exists in the database.
Claim 31
Dependent Claim
47 words
The method of claim 26 wherein the step of assigning each user a unique user identifier comprises: selecting a new user identifier that is unique relative to the user identifiers in the database if the database does not contain a previously assigned user identifier for the user.
Claim 32
Independent Claim
214 words
A method of providing security in a first computing system and a second computing system, the first computing system being accessed by a first plurality of users and the second computing system accessed by a second plurality of users, each of the users in the first and the second plurality of users being respectively identified by a user key, each of the first and the second computing systems having a plurality of accounts, the method comprising: assigning each of the first plurality of users a unique user identifier; automatically maintaining a database associating each of the user keys with the corresponding assigned user identifier; for each user of the first plurality of users, associating the user identifier assigned with one of the plurality of accounts on the first computing system to provide access to the first computing system; and for each user of the second plurality of users, automatically searching the database for the user key identifying the user and associating a previously assigned user identifier with an account on the second computing system if the user key exists in the database, and associating a new user identifier with the account on the second computing system if the user key does not exist in the database, to provide access to the second computing system.
Claim 33
Independent Claim
214 words
A method of providing security in a first computing system and a second computing system, the first computing system being accessed by a first plurality of users and the second computing system accessed by a second plurality of users, each of the users in the first and the second plurality of users being respectively identified by a user key, each of the first and the second computing systems having a plurality of accounts, the method comprising: assigning each of the first plurality of users a unique user identifier; automatically maintaining a database associating each of the user keys with the corresponding assigned user identifier; for each user of the first plurality of users, associating the user identifier assigned with one of the plurality of accounts on the first computing system to provide access to the first computing system; and for each user of the second plurality of users, automatically searching the database for the user key identifying the user and associating a previously assigned user identifier with an account on the second computing system if the user key exists in the database, and associating a new user identifier with the account on the second computing system if the user key does not exist in the database, to provide access to the second computing system.
Claim 34
Dependent Claim
17 words
The method of claim 29 wherein the user key comprises a social security number of the user.
Claim 35
Dependent Claim
15 words
The method of claim 29 wherein the user key comprises a name of the user.
Claim 36
Dependent Claim
47 words
The method of claim 29 wherein the step of assigning each user a unique user identifier comprises: automatically maintaining the association between the user key and the assigned user identifier after the association between the user identifier and the account on the first computing system is terminated.
Claim 37
Dependent Claim
47 words
The method of claim 29 wherein the step of assigning each user a unique user identifier comprises: automatically maintaining the association between the user key and the assigned user identifier after the association between the user identifier and the account on the second computing system is terminated.
Claim 38
Dependent Claim
60 words
The method of claim 29 wherein the step of assigning each user a unique user identifier comprises: automatically maintaining the association between the user key and the assigned user identifier after the associations between the user identifier and the account on the first computing system, and between the user identifier and the account on the second computing system are terminated.
Claim 39
Dependent Claim
73 words
The method of claim 34 wherein the step of assigning each user a unique user identifier further comprises: searching the database for the user key; assigning the user identifier previously assigned to the user if the user exists in the database; and selecting a new user identifier that is unique relative to the user identifiers in the database if the database does not contain a previously assigned user identifier for the user key.
Claim 40
Dependent Claim
32 words
The method of claim 32 wherein the step of assigning each user a unique user identifier comprises: reestablishing the association between the user identifier and the account on the first computing system.
Claim 41
Dependent Claim
32 words
The method of claim 33 wherein the step of assigning each user a unique user identifier comprises: reestablishing the association between the user identifier and the account on the second computing system.
Claim 42
Dependent Claim
72 words
A computer-readable medium having stored therein a computer readable program used by a computing system in providing a number of different levels of access to an account on the computing system, the computer readable program comprising the steps of: assigning a user identifier to an account; associating the user identifier with a user; associating the user with a predefined group; and associating the predefined group with a default level of access privilege.
Claim 43
Dependent Claim
72 words
A computer-readable medium having stored therein a computer readable program used by a computing system in providing a number of different levels of access to an account on the computing system, the computer readable program comprising the steps of: assigning a user identifier to an account; associating the user identifier with a user; associating the user with a predefined group; and associating the predefined group with a default level of access privilege.
Claim 44
Dependent Claim
24 words
The computer-readable medium of claim 38, further comprising: updating the level of access each time the user is associated with a different predefined group.
Claim 45
Dependent Claim
40 words
The computer-readable medium of claim 38 wherein the predefined group comprises a department and associating the user with a predefined group comprises accessing a human resources relational database containing associations between a number of users and a number of departments.
Claim 46
Dependent Claim
41 words
The computer-readable medium of claim 38, further comprising: associating the user with an access variable corresponding to an access status; and terminating the association between the user identifier and the account when the access status is equal to a terminated condition.
Claim 47
Dependent Claim
103 words
In a computer system having at least one data center, an apparatus comprising: a first data structure interrelating a user identifier and a user account; a second data structure interrelating a user and the user identifier; a third data structure interrelating the user and an assigned department; a fourth data structure interrelating department and a default level of security privilege; and a computer coupled to the first, the second, the third and the fourth data structures and being programmed for assigning a default level of access privilege corresponding to the department to which the user associated with the user identifier has been assigned.
Claim 48
Dependent Claim
103 words
In a computer system having at least one data center, an apparatus comprising: a first data structure interrelating a user identifier and a user account; a second data structure interrelating a user and the user identifier; a third data structure interrelating the user and an assigned department; a fourth data structure interrelating department and a default level of security privilege; and a computer coupled to the first, the second, the third and the fourth data structures and being programmed for assigning a default level of access privilege corresponding to the department to which the user associated with the user identifier has been assigned.
Claim 49
Independent Claim
155 words
A method for automatically providing security in a computing system comprising a RACF database, the method comprising: receiving a set of account data from the RACF database into a security database, the account data comprising a user identifier and a group identifier for each of a plurality of accounts on the computing system; receiving a set of user data into the security database, the set of user data comprising a user identifier and a group identifier for each of a plurality of users on the computing system; and for at least one of the user identifiers, comparing the group identifier of the account data with the group identifier of the user data and issuing a command against the RACF database to update a group identifier in the RACF database with the group identifier of the user data when the group identifier of the account data is different from the group identifier of the user data.
Claim 50
Independent Claim
155 words
A method for automatically providing security in a computing system comprising a RACF database, the method comprising: receiving a set of account data from the RACF database into a security database, the account data comprising a user identifier and a group identifier for each of a plurality of accounts on the computing system; receiving a set of user data into the security database, the set of user data comprising a user identifier and a group identifier for each of a plurality of users on the computing system; and for at least one of the user identifiers, comparing the group identifier of the account data with the group identifier of the user data and issuing a command against the RACF database to update a group identifier in the RACF database with the group identifier of the user data when the group identifier of the account data is different from the group identifier of the user data.
Claim 51
Dependent Claim
92 words
The method of claim 43 wherein the account data further comprises an access status and wherein the user data further comprises an access status, the method further comprising: for each user identifier, comparing the access status of the account data with the access status of the user data, and issuing a RACF command against the RACF database to update an access status in the RACF database with the access status of the user data when the access status of the account data is different from the access status of the user data.
References Cited (Backward Citations)
US5263157A
Cited
US5475833A
Cited
US5627967A
Cited
US5611048A
Cited
US5469576A
Cited
US5581764A
Cited
US5774879A
Cited
US5765140A
Cited
US5765153A
Cited
US5881225A
Cited
US6000033A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-10-31 | 2004-05-01 | 2004-10-31 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-10-31 | 2008-05-01 | 2008-10-31 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-10-31 | 2012-05-01 | 2012-10-31 | $7700.00 | Window Closed / Lapsed |