Characterizing user behavior via intelligent identity analytics

A method, comprising:

• collecting identity lifecycle data associated with at least one identity credential, wherein the identity lifecycle data includes a definition of at least one use behavior associated with the at least one identity credential;
• determining an anticipated use behavior based on the collected identity lifecycle data;
• and
• determining a variation between the anticipated use behavior and a detected unanticipated use behavior, wherein the detected unanticipated use behavior includes a use behavior of the identity lifecycle data that is outside a threshold of the anticipated use behavior.

A trust framework situated between a subscriber having an identity credential and a relying party that provides one or more computing resources to the subscriber based on identity authorization verifications received from the trust framework, the trust framework comprising:

• an identity and intelligence engine that automatically performs the following:
• (i) maintains a canonical data model for identity credential lifecycle data related to the subscriber;
• (ii) receives event information related to at least one of actions and inactions of the subscriber and catalogs the event information;
• (iii) compares the received event information with the canonical data model to determine whether or not the subscriber is acting in conformance with the canonical data model;
• and
• (iv) in the event that the subscriber is determined to be acting out of conformance with the canonical data model, notifies the relying party thereby enabling the relying party to deny or restrict the subscriber's access to the one or more computing resources.