System and method for peer group detection, visualization and analysis in identity management artificial intelligence systems using cluster based analysis of network identity graphs

• US 10,476,953 B1
• Filed: 07/01/2019
• Issued: 11/12/2019
• Est. Priority Date: 11/27/2018
• Status: Active Grant

• Current Assignee: SailPoint Technologies, Inc. (SailPoint Technologies Holdings, Inc.)
• Original Assignee: SailPoint Technologies, Inc. (SailPoint Technologies Holdings, Inc.)
• Inventors: Badawy, Mohamed M., Ho, Jostine Fei
• Primary Examiner(s): Higa, Brendan Y
• Application Number:
  US16/459,104
• Time in Patent Office: 134 Days
• CPC Class Codes: G06F 16/345 Summarisation for human users
• CPC Class Codes: G06F 16/355 Class or cluster creation or modification
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/906 Clustering; Classification
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1044 Group management mechanisms management of multicast group membership H04L12/185; reconfiguring of node membership in a computing system to eliminate errors G06F11/1425
• CPC Class Codes: H04L 67/1074 for supporting data block transmission mechanisms file transfer H04L67/06

Abstract

Systems and methods for graph based artificial intelligence systems for identity management systems are disclosed. Embodiments of the identity management systems disclosed herein may utilize a network graph approach to peer grouping of identities of distributed networked enterprise computing environment. Specifically, in certain embodiments, data on the identities and the respective entitlements assigned to each identity as utilized in an enterprise computer environment may be obtained by an identity management system. A network identity graph may be constructed using the identity and entitlement data. The identity graph can then be clustered into peer groups of identities. The peer groups of identities may be used by the identity management system and users thereof in risk assessment or other identity management tasks.

Claims

1. An identity management system, comprising:

a memory;

a processor;

a non-transitory, computer-readable storage medium including computer instructions for;

obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment;

evaluating the identity management data to determine a set of identities and a set of entitlements associated with the set of identities, the set of identities and the set of entitlements utilized in identity management of the distributed enterprise computing environment;

generating a first identity graph from the identity management data by;

creating a node of the first identity graph for each of the determined set of identities,

for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the first identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and

generating a weight for each edge of the first identity graph between each first node and second node based on the at least one entitlement shared between the first identity represented by the first node and the second identity represented by the second node;

storing the first identity graph in the graph data store;

pruning the set of edges of the first identity graph to generate a second identity graph;

storing the second identity graph in the graph data store;

clustering the set of identities or set of entitlements represented by the second identity graph into a set of peer groups based on the second identity graph, including the nodes of the second identity graph representing the set of identities and the edges of the second identity graph; and

storing the set of peer groups, including an identification of the set of identities or set of entitlements.

2. The system of claim 1, wherein the weight generated for each edge of the first identity graph between each first node and second node is a similarity weight.

3. The system of claim 2, wherein the similarity weight is an approximate weight based on the at least one entitlement shared between the first identity represented by the first node and the second identity represented by the second node.

4. The system of claim 2, wherein the similarity weight is an actual weight calculated based on a number of the set of entitlements shared between the first identity represented by the first node and the second identity represented by the second node.

5. The system of claim 3, wherein the pruning of the set of edges of the first identity graph to generate a second identity graph is based on these similarity weights.

6. The system of claim 1, wherein the memory is a SQL data store.

7. The system of claim 1, wherein storing the set of peer groups comprises representing the set of peer groups as nodes in the second identity graph.

8. A method, comprising:

obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment;

evaluating the identity management data to determine a set of identities and a set of entitlements associated with the set of identities, the set of identities and the set of entitlements utilized in identity management of the distributed enterprise computing environment;

generating a first identity graph from the identity management data by;

creating a node of the first identity graph for each of the determined set of identities,

for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the first identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and

generating a weight for each edge of the first identity graph between each first node and second node based on the at least one entitlement shared between the first identity represented by the first node and the second identity represented by the second node;

storing the first identity graph in the graph data store;

pruning the set of edges of the first identity graph to generate a second identity graph;

storing the second identity graph in the graph data store;

clustering the set of identities or set of entitlements represented by the second identity graph into a set of peer groups based on the second identity graph, including the nodes of the second identity graph representing the set of identities and the edges of the second identity graph; and

storing the set of peer groups, including an identification of the set of identities or set of entitlements.

9. The method of claim 8, wherein the weight generated for each edge of the first identity graph between each first node and second node is a similarity weight.

10. The method of claim 9, wherein the similarity weight is an approximate weight based on the at least one entitlement shared between the first identity represented by the first node and the second identity represented by the second node.

11. The method of claim 9, wherein the similarity weight is an actual weight calculated based on a number of the set of entitlements shared between the first identity represented by the first node and the second identity represented by the second node.

12. The method of claim 10, wherein the pruning of the set of edges of the first identity graph to generate a second identity graph is based on these similarity weights.

13. The method of claim 8, wherein the memory is a SQL data store.

14. The method of claim 8, wherein storing the set of peer groups comprises representing the set of peer groups as nodes in the second identity graph.

15. A non-transitory computer readable medium, comprising instructions for:

obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment;

evaluating the identity management data to determine a set of identities and a set of entitlements associated with the set of identities, the set of identities and the set of entitlements utilized in identity management of the distributed enterprise computing environment;

generating a first identity graph from the identity management data by;

creating a node of the first identity graph for each of the determined set of identities,

for each first identity and second identity that share at least one entitlement of the set of entitlements, creating an edge of the first identity graph between a first node representing the first identity and a second node of the identity graph representing the second identity, and

generating a weight for each edge of the first identity graph between each first node and second node based on the at least one entitlement shared between the first identity represented by the first node and the second identity represented by the second node;

storing the first identity graph in the graph data store;

pruning the set of edges of the first identity graph to generate a second identity graph;

storing the second identity graph in the graph data store;

clustering the set of identities or set of entitlements represented by the second identity graph into a set of peer groups based on the second identity graph, including the nodes of the second identity graph representing the set of identities and the edges of the second identity graph; and

storing the set of peer groups, including an identification of the set of identities or set of entitlements.

16. The non-transitory computer readable medium of claim 15, wherein the weight generated for each edge of the first identity graph between each first node and second node is a similarity weight.

17. The non-transitory computer readable medium of claim 16, wherein the similarity weight is an approximate weight based on the at least one entitlement shared between the first identity represented by the first node and the second identity represented by the second node.

18. The non-transitory computer readable medium of claim 16, wherein the similarity weight is an actual weight calculated based on a number of the set of entitlements shared between the first identity represented by the first node and the second identity represented by the second node.

19. The non-transitory computer readable medium of claim 17, wherein the pruning of the set of edges of the first identity graph to generate a second identity graph is based on these similarity weights.

20. The non-transitory computer readable medium of claim 15, wherein the memory is a SQL data store.

21. The non-transitory computer readable medium of claim 15, wherein storing the set of peer groups comprises representing the set of peer groups as nodes in the second identity graph.