US 10,476,952 B1Granted

System and method for peer group detection, visualization and analysis in identity management artificial intelligence systems using cluster based analysis of network identity graphs

AssigneeSailpoint Technologies, Inc.

InventorsMohamed M. Badawy, Jostine Fei Ho

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods for graph based artificial intelligence systems for identity management systems are disclosed. Embodiments of the identity management systems disclosed herein may utilize a network graph approach to peer grouping of identities of distributed networked enterprise computing environment. Specifically, in certain embodiments, data on the identities and the respective entitlements assigned to each identity as utilized in an enterprise computer environment may be obtained by an identity management system. A network identity graph may be constructed using the identity and entitlement data. The identity graph can then be clustered into peer groups of identities. The peer groups of identities may be used by the identity management system and users thereof in risk assessment or other identity management tasks.

Claims21

Dependent claims

An identity management system, comprising:

a graph data store;
a processor;
a non-transitory, computer-readable storage medium including computer instructions for:
obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment, the identity management data comprising data on a set of identities and a set of entitlements associated with the set of identities utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine the set of identities and a set of entitlements associated with the set of identities;
generating a first identity graph from the identity management data by:
creating a node of the first identity graph for each of the determined set of identities,
for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the first identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and
generating a similarity weight for each edge of the first identity graph between each first node and second node based on the set of entitlements associated with the first identity represented by the first node and the second identity represented by the second node;
storing the first identity graph in the graph data store;
pruning the set of edges of the first identity graph to generate a second identity graph;
storing the second identity graph in the graph data store;
clustering the set of identities represented by the nodes of the second identity graph into a set of peer groups based on the second identity graph, including the nodes of the second identity graph representing the set of identities and the edges of the second identity graph;
associating each of the set of identities with a corresponding peer group;
and
generating an interface based on the second identity graph and the association between each of the set of identities and the corresponding peer group.

13 more elements

A method, comprising:

obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment, the identity management data comprising data on a set of identities and a set of entitlements associated with the set of identities utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine the set of identities and a set of entitlements associated with the set of identities;
generating a first identity graph from the identity management data by:
creating a node of the first identity graph for each of the determined set of identities,
for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the first identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and
generating a similarity weight for each edge of the first identity graph between each first node and second node based on the set of entitlements associated with the first identity represented by the first node and the second identity represented by the second node;
storing the first identity graph in a graph data store;
pruning the set of edges of the first identity graph to generate a second identity graph;
storing the second identity graph in the graph data store;
clustering the set of identities represented by the nodes of the second identity graph into a set of peer groups based on the second identity graph, including the nodes of the second identity graph representing the set of identities and the edges of the second identity graph;
associating each of the set of identities with a corresponding peer group;
and
generating an interface based on the second identity graph and the association between each of the set of identities and the corresponding peer group.

10 more elements

A non-transitory computer readable medium, comprising instructions for:

obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment, the identity management data comprising data on a set of identities and a set of entitlements associated with the set of identities utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine the set of identities and a set of entitlements associated with the set of identities;
generating a first identity graph from the identity management data by:
creating a node of the first identity graph for each of the determined set of identities,
for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the first identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and
generating a similarity weight for each edge of the first identity graph between each first node and second node based on the set of entitlements associated with the first identity represented by the first node and the second identity represented by the second node;
storing the first identity graph in a graph data store;
pruning the set of edges of the first identity graph to generate a second identity graph;
storing the second identity graph in the graph data store;
clustering the set of identities represented by the nodes of the second identity graph into a set of peer groups based on the second identity graph, including the nodes of the second identity graph representing the set of identities and the edges of the second identity graph;
associating each of the set of identities with a corresponding peer group;
and
generating an interface based on the second identity graph and the association between each of the set of identities and the corresponding peer group.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/417,803Filed 21 May 2019 · continuation
Priority: 27 Nov 2018
Granted: 12 Nov 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification20 codes

H04L 67/1044
Peer-to-peer [P2P] networks: group management mechanisms
G06F 16/345
Browsing; Visualisation therefor: summarisation for human users
G06F 16/355
Clustering; Classification: creation or modification of classes or clusters
G06F 16/9024
Indexing; Data structures therefor; Storage structures: graphs; Linked lists