Back to results
US 10,862,928 B1Granted
System and method for role validation in identity management artificial intelligence systems using analysis of network identity graphs
AssigneeSailpoint Technologies, Inc.
InventorsMohamed M. Badawy, Jostine Fei Ho, Rajat Kabra
Life of this patent
Estimating the term…
Abstract
Systems and methods for embodiments of a graph based artificial intelligence systems for identity management are disclosed. Embodiments of the identity management systems disclosed herein may utilize a network graph approach to analyzing roles of a distributed networked enterprise computing environment. Specifically, in certain embodiments, an artificial intelligence based identity management systems may utilize role graphs to assess the role structure of a distributed enterprise computing environment.
Claims21
An identity management system, comprising:
- a data store;
- a processor;
- a non-transitory, computer-readable storage medium, including computer instructions, when executed by the processor, cause the system to perform the steps of:
- obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment, the identity management data comprising data on a set of roles, a set of entitlements, and a set of identities, wherein the set of roles, set of entitlements and set of identities are utilized in identity management in the distributed enterprise computing environment;
- evaluating the identity management data to determine the set or roles, identities of the set of identities associated with each of the set of roles and entitlements of the set of entitlements associated with the set of roles;
- generating a first role graph from the identity management data by:
- creating a node of the first role graph for each of the determined set of roles;
- for each first identity and second identity that share at least one entitlement of the set of entitlements or at least one identity of the set of identities, creating an edge of the first role graph between a first node representing a first role and a second node of the first role graph representing a second role;
- and
- generating a weight for each edge of the first role graph between each first node representing the first role and second node representing the second role based on the at least one entitlement or the at least one identity shared between the first role represented by the first node and the second role represented by the second node;
- storing the first role graph in the data store;
- obtaining a pruning threshold associated with the first role graph;
- pruning the set of edges of the first role graph based on the pruning threshold and the weight for each of the set of edges to generate a second role graph;
- storing the second role graph in the data store;
- determining a health metric for the set of roles associated with the distributed enterprise computing environment based on a structure of the second role graph;
- and
- presenting the health metric and the second role graph to a user through a user interface.
14 more elements
A method for managing roles, comprising the steps of:
- obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment via one or more of computer network connections, the identity management data comprising data on a set of roles, a set of entitlements, and a set of identities, wherein the set of roles, set of entitlements and set of identities are utilized in identity management in the distributed enterprise computing environment;
- evaluating the identity management data to determine the set or roles, identities of the set of identities associated with each of the set of roles and entitlements of the set of entitlements associated with the set of roles;
- generating a first role graph from the identity management data by:
- creating a node of the first role graph for each of the determined set of roles;
- for each first identity and second identity that share at least one entitlement of the set of entitlements or at least one identity of the set of identities, creating an edge of the first role graph between a first node representing a first role and a second node of the first role graph representing a second role;
- and
- generating a weight for each edge of the first role graph between each first node representing the first role and second node representing the second role based on the at least one entitlement or the at least one identity shared between the first role represented by the first node and the second role represented by the second node;
- storing the first role graph in the data store;
- obtaining a pruning threshold associated with the first role graph;
- pruning the set of edges of the first role graph based on the pruning threshold and the weight for each of the set of edges to generate a second role graph;
- storing the second role graph;
- determining a health metric for the set of roles associated with the distributed enterprise computing environment based on a structure of the second role graph;
- and
- presenting the health metric and the second role graph to a user through a user interface.
11 more elements
A non-transitory computer readable medium, comprising computer instructions, when executed by a computer processor, cause the computer process to perform the steps of:
- obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment, the identity management data comprising data on a set of roles, a set of entitlements, and a set of identities, wherein the set of roles, set of entitlements and set of identities are utilized in identity management in the distributed enterprise computing environment;
- evaluating the identity management data to determine the set or roles, identities of the set of identities associated with each of the set of roles and entitlements of the set of entitlements associated with the set of roles;
- generating a first role graph from the identity management data by:
- creating a node of the first role graph for each of the determined set of roles, for each first identity and second identity that share at least one entitlement of the set of entitlements or at least one identity of the set of identities, creating an edge of the first role graph between a first node representing a first role and a second node of the first role graph representing a second role;
- and
- generating a weight for each edge of the first role graph between each first node representing the first role and second node representing the second role based on the at least one entitlement or the at least one identity shared between the first role represented by the first node and the second role represented by the second node;
- storing the first role graph in the data store;
- obtaining a pruning threshold associated with the first role graph;
- pruning the set of edges of the first role graph based on the pruning threshold and the weight for each of the set of edges to generate a second role graph;
- storing the second role graph;
- determining a health metric for the set of roles associated with the distributed enterprise computing environment based on a structure of the second role graph;
- and
- presenting the health metric and the second role graph to a user through a user interface.
10 more elements
Dependencies are inferred from the claim text.