Method and system for managing identity changes to shared accounts

Patent metadata

Field	Value
Publication number	US-9268917-B1
Application number	US-201314014669-A
Country	US
Kind code	B1
Filing date	Aug 30, 2013
Priority date	Aug 30, 2013
Publication date	Feb 23, 2016
Grant date	Feb 23, 2016

Abstract

A method includes detecting an identity change instruction. The method also includes identifying a target account associated with the identity change instruction. The method also includes determining whether the target account is checked out. The method also includes passing the identity change instruction to a kernel in response to determining that the target account is checked out. The method also includes blocking the identity change instruction in response to determining that the target account is not checked out.

First claim

What is claimed is:

1. A method comprising:
detecting, using a processor, an identity change instruction, the identity change instruction instructing a system to change a user's identity from a first identity to a second identity;
identifying a target account associated with the identity change instruction;
determining, using the processor, whether the target account is checked out;
in response to determining that the target account is checked out:
passing the identity change instruction from the system to a kernel of an operating system to be executed; and
changing the user's identity from the first identity to the second identity; and

in response to determining that the target account is not checked out, blocking the identity change instruction.

2. The method of claim 1 , wherein changing the user's identity from the first identity to the second identity comprises passing the identity change instruction to a user interface, the user interface configured to pass the identity change instruction to a kernel.

3. The method of claim 1 , wherein instructing the system to change the user's identity from the first identity to the second identity comprises at least one of:
an instruction to switch to the target account, and an instruction to perform an action using one or more privileges of the target account,
wherein the target account comprises a shared account.

4. The method of claim 1 , further comprising, in response to determining that the target account is checked out:
identifying a user providing the identity change instruction; and
determining whether the user checked out the target account,
wherein changing the user's identity from the first identity to the second identity comprises passing the identity change instruction to a kernel in response to determining that the user checked out the target account.

5. The method of claim 1 , further comprising, in response to determining that the target account is not checked out:
retrieving authentication information;
determining whether the user is authorized to access the target account using the authentication information;
wherein changing the user's identity from the first identity to the second identity comprises passing the identity change instruction to a kernel in response to determining that the user is authorized to access the target account.

6. The method of claim 1 , further comprising, in response to determining that the target account is not checked out:
requesting permission to access the account from an owner of the target account; and
receiving the permission to access the target account,
wherein changing the user's identity from the first identity to the second identity comprises passing the identity change instruction to a kernel in response to receiving the permission to access the target account.

7. The method of claim 1 , further comprising, in response to determining that the target account is not checked out, sending an alert to an owner of the target account, the alert comprising at least one of:
a name corresponding to a user providing the identity change instruction; and
a time that the user is providing the identity change instruction.

8. A system comprising:
a detecting device configured to detect an identity change instruction, the identity change instruction instructing the system to change a user's identity from a first identity to a second identity;
an account identifying device configured to identify a target account associated with the identity change instruction;
a first determining device configured to determine whether the target account is checked out;
a passing device configured to, in response to determining that the target account is checked out, pass the identity change instruction from the system to a kernel of an operating system to be executed;
a changing device configured to, in response to determining that the target account is checked out, change the user's identity from the first identity to the second identity; and
a blocking device configured to block the identity change instruction in response to determining that the target account is not checked out.

9. The system according to claim 8 , wherein the passing device is configured to pass the identity change instruction to a user interface, the user interface configured to pass the identity change instruction to the kernel.

10. The system of claim 8 , wherein the identity change instruction comprises at least one of: an instruction to switch to the target account, and an instruction to perform an action using one or more privileges of the target account,
wherein the target account comprises a shared account.

11. The system of claim 8 , further comprising:
an user identifying device configured to identify a user providing the identity change instruction in response to determining that the target account is checked out;
a second determining device configured to determine whether the user checked out the target account;
wherein the passing device is configured to pass the identity change instruction to the kernel in response to determining that the user checked out the target account.

12. The system of claim 8 , further comprising:
a retrieving device configured to retrieve authentication information in response to determining that the target account is not checked out;
a third determining device configured to determine whether the user is authorized to access the target account using the authentication information;
wherein the passing device is configured to pass the identity change instruction to the kernel in response to determining that the user is authorized to access the target account.

13. The system of claim 8 , further comprising:
a requesting device configured to request permission to access the target account from an owner of the target account in response to determining that the target account is not checked out; and
a permission receiving device configured to receive the permission to access the target account,
wherein the passing device is configured to pass the identity change instruction to the kernel in response to receiving the permission to access the target account.

14. The system of claim 8 , further comprising:
a sending device configured to send an alert to an owner of the target account, the alert comprising at least one of:
a name corresponding to a user providing the identity change request; and
a time that the user is providing the identity change request.

15. A computer program product comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to detect an identity change instruction, the identity change instruction instructing a system to change a user's identity from a first identity to a second identity;
computer readable program code configured to identify a target account associated with the identity change instruction;
computer readable program code configured to determine whether the target account is checked out;
computer readable program code configured to, in response to determining that the target account is checked out:
pass the identity change instruction from the system to a kernel of an operating system to be executed; and
change the user's identity from the first identity to the second identity; and

computer readable program code configured to block the identity change instruction in response to determining that the target account is not checked out.

16. The computer program product

Assignees

• Barak Nir
• Gross Miron
• Jerbi Amir
• Perlmuter Ron
• Ca Inc

Inventors

• Barak Nir
• Gross Miron
• Jerbi Amir
• Perlmuter Ron

Classifications

• G06F21/00 Primary

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• G06F21/31 Primary

  User authentication · CPC title