Centralized Entitlement Control for SoD Conflict Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise IT infrastructures face challenges in managing access permissions, leading to inconsistent entitlement structures, excessive permissions, and administrative burdens, which expose systems to security vulnerabilities.
Innovation Solution
A centralized, automated access control system that uses a uniform LDAP-based naming convention and a Separation of Duty (SoD) server to dynamically manage and monitor entitlements, detect conflicts, and enforce security policies in real-time, integrating with Identity Governance and Administration (IGA) for compliance and auditability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual access control methods are used, then administrative flexibility is maintained, but administrative burden and inconsistency increase
Solution Approach 1:
The system enables automated self-service through the TAC server that automatically creates, maps, and manages entitlements without requiring manual administrative intervention. The automated entitlement management system provisions access rights automatically based on user roles and IT asset requirements, eliminating the need for manual permission configuration while maintaining administrative control through centralized governance.
Solution Approach 2:
The patent replaces manual mechanical access control processes with an automated electronic system. The TAC server uses software-based entitlement management to substitute manual permission assignment, while the SoD server uses automated conflict detection algorithms to replace manual audit processes. This substitution eliminates repetitive manual tasks while maintaining security through electronic enforcement.
2Productivity
If excessive permissions are granted to ensure access, then operational efficiency improves, but security vulnerabilities increase
Solution Approach 1:
The system applies partial action by granting only the minimum necessary permissions through precise entitlement mapping. Instead of excessive broad permissions, the TAC server maps specific user roles to specific IT asset entitlements, providing just enough access for operational needs. The SoD server further refines this by detecting and preventing excessive or conflicting permissions that could create security vulnerabilities.
Solution Approach 2:
The SoD server implements continuous feedback by monitoring entitlement assignments in real-time and comparing them against defined conflict rules. When potential excessive permissions or conflicts are detected, the system provides feedback to administrators and automatically adjusts entitlements to eliminate security vulnerabilities while maintaining operational efficiency.
3Reliability
If centralized access control is implemented, then security and consistency improve, but system complexity increases
Solution Approach 1:
The patent segments the access control system into distinct functional components: the TAC server for entitlement creation and mapping, the SoD server for conflict detection and prevention, and the IGA system for governance and auditing. This segmentation allows each component to handle specific tasks independently, improving reliability through specialized functionality while managing overall system complexity through modular architecture.
Solution Approach 2:
The TAC server serves multiple functions including creating entitlements, mapping users to assets, enforcing policies, and integrating with IGA systems. This multi-functionality consolidates what would otherwise require multiple separate systems into a single unified platform, improving consistency across the enterprise while managing complexity through integration rather than proliferation of separate components.
4Productivity
If automated entitlement management is implemented, then administrative overhead is reduced, but initial system complexity increases
Solution Approach 1:
The system performs preliminary action by pre-defining conflict rules, entitlement templates, and mapping configurations before actual access control operations begin. The SoD server is pre-configured with conflict detection criteria, and the TAC server has pre-established entitlement frameworks. This preliminary setup eliminates the need for complex real-time decision-making during operations, reducing administrative overhead while managing initial complexity through pre-planned configurations.
Data Source
AI summary
Computer-implemented systems and methods monitor and control entitlements for IT assets in an enterprises system based on separation of duty conflict rules. The system may determine whether existing entitlements or a requested entitlement violates the conflict rules and perform an entitlement conflict remediation action. The entitlement conflict remediation action may include automatically revoking one or more entitlements or temporally approving one or more entitlements that violate the conflict rules.