US 12,597,027 B2Granted

Systems for describing unknown access management events using identity tags and related transaction chains

AssigneeT-Mobile USA, Inc.

InventorsMirmd Rashedul Hasan, Pablo Medeiros Dominguez, Nilay Srivastava

Life of this patent

Estimating the term…

Loading patent…

Abstract

The technology includes a system to describe access management events. The system monitors transactions performed by layers of an Identity Provider service (IDP). Each layer corresponds to an Application Programming Interface (API). The system captures output from the layers in a dynamic record. The output includes timestamps, names of layers, and principals responsible for calling layers. The system determines related transactions by tagging output with identity tags based on principals, and grouping transactions based on common identity tags. The system chains related transactions into lists by comparing identity tags and timestamps and determining orders based on proximate timestamps. The system determines access management events based on names of layers from lists of chained transactions. The system generates descriptions of these events for display to auditors by using language models which have been provided input from the dynamic record.

Claims20

Dependent claims

A non-transitory, computer-readable storage medium comprising instructions recorded thereon, wherein the instructions, when executed by at least one data processor of a system, cause the system to:

receive, at a telecommunications network, an indication of an unknown access management event performed by a user equipment (UE);
record, to a dynamic record, output that are associated with transactions of an Identity Provider (IDP) service of the telecommunications network that are performed by layers of the IDP service in response to the indication of the unknown access management event,
wherein each layer corresponds to a separate Application Programming Interface (API) with its own distinct functionality in the IDP service of the telecommunications network;
wherein the output includes timestamps of the transactions, names of layers that performed the transactions, and principals responsible for calling the layers;
and
wherein the dynamic record comprises multiple recorded outputs that are associated with transactions of the IDP service in response to multiple unknown access management events;
determine related transactions in the dynamic record by tagging the output for the transactions with identity tags based on the principals, and grouping the transactions based on common identity tags;
concatenate the related transactions into a list of concatenated transactions by comparing identity tags and timestamps and determining an order for the list of concatenated transactions based on proximate timestamps;
determine an access management event based on the names of the layers of the transactions of the list of concatenated transactions;
generate a description of the access management event using a large language model (LLM) that is trained to generate descriptions based on concatenated transactions;
and
cause a display of the description for display to an auditor in a single comprehensive view of the IDP,
wherein the single comprehensive view is updated as new output is streamed to the dynamic record of transactions, and
wherein the description provides context for the access management event by identifying a user based on the identity tags and a result based on the access management event.

11 more elements

A system comprising:

at least one hardware processor;
and
at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, cause the system to:
receive, at a telecommunications network, an indication of an unknown access event performed by a mobile device;
record, in a dynamic record, output that are associated with transactions performed by separate Application Program Interfaces (APIs),
wherein the output includes timestamps, names of APIs that performed the transactions, and principals responsible for calling the APIs;
determine related transactions by tagging the output with identity tags based on the principals, and grouping the transactions into the related transactions based on common identity tags;
concatenate the related transactions into a list of concatenated chained transactions by comparing the timestamps and determining an order for the list of concatenated transactions based on proximate timestamps;
identify an access event based on the names of the APIs that performed the transactions of the list of concatenated transactions;
compose a description of the access event using an artificial intelligence model trained to output descriptions based on concatenated transactions as input;
and
generate the description for display to an auditor in a comprehensive view of the transactions,
wherein the description identifies a user and a result based on the access event.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/592,315Filed 29 Feb 2024
Published: US 2025/0278721 A14 Sep 2025
Granted: 7 Apr 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

G06Q 20/389
Payment protocols; Details thereof: keeping log of transactions for guaranteeing non-repudiation of a transaction
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/102
For controlling access to devices or network resources: entity profiles