Patent ID: 9083720
Filing Date: 2015-07-14
Classification: G06F,H04L

Abstract:
1. A method for managing, in a computer system network, access by a user to a resource, comprising: performing access path analysis within the computer system network in response to receipt of a message indicating that the user is requesting an access, with a requested access level, to the resource, where the access path analysis identifies all different sequences of different types of security objects usable by the user to access the resource, and where each different sequence of security objects: identifying, during the access path analysis, a plurality of different concurrent access paths within the computer system network, the plurality of different concurrent access paths comprising all different concurrent access path security object sequences usable to authorize the user to access the resource with the requested access level; setting a flag of each security object of each identified different concurrent access path of the identified plurality of different concurrent access paths to a first value, where a change from the first value represents a use of the security object in authorizing access to the resource; receiving another security object comprising the flag, where the other security object comprises one of a user group security object and a resource group security object; making a decision with respect to whether the received other security object was used within one of the identified plurality of different concurrent access paths as a function of its flag value; and making a decision to delete the received other security object if a timestamp set in its flag is older than a predefined date.