# US 11,122,050 B2 · System and method for intelligent agents for decision support in network identity graph based identity management artificial intelligence systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,050 B2
- Document ID: US11122050B2
- Status: Granted
- Kind: B2
- Application number: 16/582,862
- Filed: 2019-09-25
- Published: 2020-08-27
- Granted: 2021-09-14
- Earliest claimed: 2019-02-26
- Assignees: Sailpoint Technologies, Inc.
- Applicants: SailPoint Technologies, Inc.
- Inventors: Mohamed M Badawy; Jostine Fei Ho; Rajat Kabra
- Web page: https://patentgrep.com/patent/US11122050B2

## CPC

- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/104: {Grouping of entities}
- G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour}
- G06F 21/45: Structures or tools for the administration of authentication
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- G06N 3/006: based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO]
- G06N 5/025: Extracting rules from data
- G06N 20/00: Machine learning
- H04L 41/16: using machine learning or artificial intelligence
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/102: {Entity profiles}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Systems and methods for embodiments of a graph based artificial intelligence systems for identity management are disclosed. Embodiments of the identity management systems disclosed herein may utilize a network graph approach to analyzing identities or entitlements of a distributed networked enterprise computing environment. Specifically, in certain embodiments, an artificial intelligence based identity governance systems may include an intelligent decision support agent to provide an approval or denial recommendation for an access request. To provide an approval or denial recommendation, the intelligent agent may utilize a classifier trained on historical certification data. The intelligent agent may utilize features which represent relevant signals to the approval or denial decision including features that may be associated with a network graph of the identities and entitlements of the enterprise computing environment.

## Claims

### Claim 1

An identity management system, comprising:
a processor; and
a non-transitory, computer-readable storage medium, including computer instructions for:
obtaining historical certification data for an enterprise, the historical certification data comprising a set of historical certification decisions, each historical certification decision comprising a historical access request including an identity and an entitlement, an approval or denial decision for the historical access request, and a value for a feature determined from an identity graph associated with the enterprise;
training a classifier with the historical certification data;
receiving an access request including an identity and an entitlement and a request for a decision for the access request;
enhancing the received access request with a value for the feature based on the identity or entitlement of the access request and the identity graph associated with the enterprise;
submitting the enhanced access request to the classifier;
receiving a decision for the enhanced access request from the classifier; and
returning the decision for the access request to a user of the identity management system.

### Claim 2 (depends on 1)

The system of claim 1, wherein the identity graph associated with the enterprise is generated by:
creating a node of the identity graph for each of a set of identities determined from identity management data of the enterprise, the identity management data comprising data on the set of identities and a set of entitlements associated with the set of identities utilized in identity management in the enterprise;
for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and
generating a similarity weight for each edge of the identity graph between each first node and second node based on a number of the set of entitlements shared between the first identity represented by the first node and the second identity represented by the second node.

### Claim 3 (depends on 1)

The system of claim 1, wherein the feature is a primary feature or a composite feature.

### Claim 4 (depends on 1)

The system of claim 1, wherein the identity graph used to determine the value for the feature of each historical certification decision is a version of the identity graph closest in time to the historical access request of that historical certification decision.

### Claim 5 (depends on 1)

The system of claim 1, wherein the historical certification data was determined using a rules based classification agent.

### Claim 6 (depends on 5)

The system of claim 5, wherein the rules based classification agent is utilized until the classifier meets a performance metric.

### Claim 7 (depends on 1)

The system of claim 1, wherein the instructions further comprise instructions for:
receiving a request for an interpretation of the decision for the access request;
determining a top set of features that resulted in the decision based on the classifier; and
returning the top set of features to the user.

### Claim 8 (depends on 7)

The system of claim 7, wherein determining the top set of features comprise querying an interpreter to determine the top set of features from a local model.

### Claim 9 (depends on 8)

The system of claim 8, wherein the local model was built by the interpreter by querying the classifier in a neighborhood of the access request.

### Claim 10 (depends on 9)

The system of claim 9, wherein the interpreter is independent from the training of the classifier.

### Claim 11

A method, comprising:
obtaining historical certification data for an enterprise, the historical certification data comprising a set of historical certification decisions, each historical certification decision comprising a historical access request including an identity and an entitlement, an approval or denial decision for the historical access request, and a value for a feature determined from an identity graph associated with the enterprise;
training a classifier with the historical certification data;
receiving an access request including an identity and an entitlement and a request for a decision for the access request;
enhancing the received access request with a value for the feature based on the identity or entitlement of the access request and the identity graph associated with the enterprise;
submitting the enhanced access request to the classifier;
receiving a decision for the enhanced access request from the classifier; and
returning the decision for the access request to a user of the identity management system.

### Claim 12 (depends on 11)

The method of claim 11, wherein the identity graph associated with the enterprise is generated by:
creating a node of the identity graph for each of a set of identities determined from identity management data of the enterprise, the identity management data comprising data on the set of identities and a set of entitlements associated with the set of identities utilized in identity management in the enterprise;
for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and
generating a similarity weight for each edge of the identity graph between each first node and second node based on a number of the set of entitlements shared between the first identity represented by the first node and the second identity represented by the second node.

### Claim 13 (depends on 11)

The method of claim 11, wherein the feature is a primary feature or a composite feature.

### Claim 14 (depends on 11)

The method of claim 11, wherein the identity graph used to determine the value for the feature of each historical certification decision is a version of the identity graph closest in time to the historical access request of that historical certification decision.

### Claim 15 (depends on 11)

The method of claim 11, wherein the historical certification data was determined using a rules based classification agent.

### Claim 16 (depends on 15)

The method of claim 15, wherein the rules based classification agent is utilized until the classifier meets a performance metric.

### Claim 17 (depends on 11)

The method of claim 11, wherein the instructions further comprise instructions for:
receiving a request for an interpretation of the decision for the access request;
determining a top set of features that resulted in the decision based on the classifier; and
returning the top set of features to the user.

### Claim 18 (depends on 17)

The method of claim 17, wherein determining the top set of features comprise querying an interpreter to determine the top set of features from a local model.

### Claim 19 (depends on 18)

The method of claim 18, wherein the local model was built by the interpreter by querying the classifier in a neighborhood of the access request.

### Claim 20 (depends on 19)

The method of claim 19, wherein the interpreter is independent from the training of the classifier.