Context-dependent transactional management for separation of duties

Patent metadata

Field	Value
Publication number	US-9747581-B2
Application number	US-201213539995-A
Country	US
Kind code	B2
Filing date	Jul 2, 2012
Priority date	Jul 2, 2012
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

Context-dependent transactional management of services within a cloud environment for an organization using business rules includes generating a partitioned graph representing the organization and the business rule, where the business rules include one or more separation of duties requirements. Upon receiving an access request from an end user of the cloud service, a determination is made if the access request to the cloud service violates any of the one or more separation of duties requirements. Based on determining that the access request to the cloud service does not violate any of the one or more separation of duties requirements, transaction with the cloud service is granted to the end user. Based on determining that the access request to the cloud service violates one of the one or more separation of duties requirements, access to the cloud service is denied to the end user.

First claim

What is claimed is:

1. A computer readable non-transitory article of manufacture tangibly embodying computer readable instructions which, when executed, cause a computer device to carry out the steps of a method comprising:
receiving a request to create a business rule for controlling a transaction with a cloud computing environment for an organization;
providing an instance of the cloud computing environment for provisioning the business rule by generating a partitioned graph representing the organization and the business rule, wherein the business rule includes one or more separation of duties requirements and wherein the partitioned graph representing the organization comprises:
a plurality of nodes that each represent a resource of the organization; and
a plurality of linkages that each connect two of the plurality of nodes, wherein each of the plurality of linkages includes a threshold confidence level, which is a minimum confidence level required such that request access between the plurality of nodes does not violate the one or more separation of duties requirements;
determining a use context associated with the partitioned graph based on the one or more separation of duties requirements;
responsive to a blocking action, determining one or more confidence levels associated with the blocking action related to the use context, wherein the blocking action is indicative that the use context violates one of the one or more separation of duties requirements, wherein determining includes comparing the one or more confidence levels associated with the blocking action to the threshold confidence level associated with one or more of the plurality of linkages that correspond to the use context;
creating a context-dependent firewall based on the one or more confidence levels associated with the blocking action;
monitoring one or more new blocking actions;
determining one or more confidence levels associated with the one or more new blocking actions related to the use context, wherein the one or more new blocking actions are indicative that the use context violates one of the one or more separation of duties requirements, wherein determining includes comparing the one or more confidence levels associated with the one or more new blocking actions to the threshold confidence level associated with the one or more of the plurality of linkages that correspond to the use context; and
responsive to the determination of one or more confidence levels associated with the one or more new blocking actions related to the use context, updating the context-dependent firewall.

2. The computer readable non-transitory article of manufacture of claim 1 , wherein the resources of the organization comprise:
people;
applications; and
data.

3. The computer readable non-transitory article of manufacture of claim 1 , wherein the access request includes an identification of one or more of the plurality of nodes associated with the end user of the cloud service.

4. The computer readable non-transitory article of manufacture of claim 1 , wherein based on determining that the access request to the cloud service violates one of the one or more separation of duties requirements, performing a confidence-increasing action.

5. The computer readable non-transitory article of manufacture of claim 4 , wherein the confidence-increasing action includes at least one of:
requesting additional information regarding the access request; and
increasing a monitoring level during transaction with the cloud service.

6. A computer readable non-transitory article of manufacture tangibly embodying computer readable instructions which, when executed, cause a computer device to carry out the steps of a method comprising:
creating a partitioned graph representing an organization and one or more business rules, wherein each of the business rules includes one or more separation of duties requirements and wherein the partitioned graph representing the organization comprises:
a plurality of nodes that each represent a resource of the organization; and
a plurality of linkages that each connect two of the plurality of nodes, wherein each of the plurality of linkages includes a threshold confidence level, which is a minimum confidence level required such that request access between the plurality of nodes does not violate the one or more separation of duties requirements;
determining a use context associated with the partitioned graph based on the one or more separation of duties requirements;
responsive to a blocking action, determining one or more confidence levels associated with the blocking action related to the use context, wherein the blocking action is indicative that the use context violates one of the one or more separation of duties requirements, wherein determining includes comparing the one or more confidence levels associated with the blocking action to the threshold confidence level associated with one or more of the plurality of linkages that correspond to the use context;
creating a context-dependent firewall based on the one or more confidence levels associated with the blocking action;
monitoring one or more new blocking actions;
determining one or more confidence levels associated with the one or more new blocking actions related to the use context, wherein the one or more new blocking actions are indicative that the use context violates one of the one or more separation of duties requirements, wherein determining includes comparing the one or more confidence levels associated with the one or more new blocking actions to the threshold confidence level associated with the one or more of the plurality of linkages that correspond to the use context; and
responsive to the determination of one or more confidence levels associated with the one or more new blocking actions related to the use context, updating the context-dependent firewall.

7. The computer readable non-transitory article of manufacture of claim 6 , wherein the use context includes an identification of one or more of the plurality of nodes and the one or more plurality of linkages associated with the business rule.

8. The computer readable non-transitory article of manufacture of claim 6 , wherein the method further comprises:
monitoring an activity of a user of the context-dependent firewall for a period of time;
based on the activity of the user during the period of time, modifying the one or more confidence levels associated with the blocking action;
determining if the modification to the one or more confidence levels will require the context-dependent firewall to be changed; and
based on determining that the context-dependent firewall is required to be changed, modifying the context-dependent firewall.

9. The computer readable non-transitory article of manufacture of claim 8 , wherein determining if the modification to the one or more confidence levels will require the context-dependent firewall to be changed includes:
comparing one or more modified confidence levels to the threshold confidence level;
based on determining that that the one or more modified confidence levels has been increased to exceed the threshold confidence level, indicating that the context-dependent firewall is required to be changed; and
based on determining that the one or more modified confidence levels has been decreased below the threshold confidence level, indicating that the context-dependent firewall is required to be changed.

10. The computer readable non-transitory article of manufacture of claim 6 , wherein the method further comprises:
receiving an access request from an end user;
determining that the access request violates the one or more separation of duties requirements;
requ

Assignees

• Doran James R
• Kozloski James R
• Pickover Clifford A
• Vridhachalam Murali
• IBM

Inventors

• Doran James R
• Kozloski James R
• Pickover Clifford A
• Vridhachalam Murali

Classifications

• G06Q10/10 Primary

  Office automation; Time management · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title