Patent ID: 9087148
Filing Date: 2015-07-21
Classification: G06F,H04L

Abstract:
1. In association with a computer system wherein a specified role controls user access, the specified role comprises one or more users and one or more permissions, and a set of prespecified rules pertains to the specified role, a computer program product comprising computer executable instructions stored in a non-transitory computer recordable storage medium for execution by a computer, the computer executable instructions comprising: instructions for recording access data pertaining to each of a succession of access events in an access log, wherein each event comprises an instance of the computer system being accessed by a particular user; instructions for analyzing recorded data contained in the access log at selected time intervals, in order to detect one of a plurality of prespecified conditions; instructions responsive to analyzing specified access data contained in the access log that pertains to a specified permission granted by the specified role, for detecting a condition that the time since the last use of the specified permission, in association with the specified role, is greater than a predetermined time limit, whereupon the specified permission is removed from the specified role; instructions responsive to detecting the prespecified condition, for selectively determining whether any change to the users or to the permissions of the specified role is needed, wherein the specified permission is granted by one or more roles that are each superior to the specified role, the specified access data is used to compute, for each superior role, the time since the last use of the specified permission granted by that superior role, and it is determined that the computed times for all of the superior roles are respectively greater than the predetermined time limit; and instructions for implementing each needed change to the users or to the permissions.