System for controlling access to a plurality of target systems and applications

• US 10,708,274 B2
• Filed: 02/20/2018
• Issued: 07/07/2020
• Est. Priority Date: 02/20/2018
• Status: Active Grant

• Current Assignee: Accenture Global Solutions Limited (Accenture PLC)
• Original Assignee: Accenture Global Solutions Limited (Accenture PLC)
• Inventors: Thexton, Rexall E., Tandon, Gaurav, Shukla, Sanjeev, McCoy, Anthony, Mudiyanselage, Sidath, Poole, Andrew, Craddock, Hannah, Ain, Qurrat Ul, Connolly, Colleen, Kamiab, Farbod
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US15/900,475
• Publication Number:
  US 20190260752A1
• Time in Patent Office: 868 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: G06Q 10/1053 Employment or hiring
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method for controlling access to one or more of a plurality of target systems includes receiving profile data that defines one or more features associated with a plurality of individuals with one or more entitlements of those individuals. Each entitlement is indicative of target system access. The method further includes generating a model that relates the one or more features and the one or more entitlements of the plurality of individuals. Profile data that defines one or more features associated with a target individual is received from a first user management system. A listing that includes one or more entitlements associated with the target individual, and confidence values associated with the one or more entitlements is generated based on the profile data and the model. Each confidence value is indicative of whether the target individual should be granted a corresponding entitlement. For each entitlement having a corresponding confidence value higher than a predetermined threshold, an instruction is communicated to a target system associated with the entitlement to allow the target individual access to the target system.

Claims

1. A system for controlling access to one or more of a plurality of target systems and/or applications, the system comprising:

an input/output (IO) subsystem configured to receive profile data that defines one or more features associated with a target individual from a first user management system, and to communicate instructions to one or more target systems to facilitate access to the one or more target systems/applications by the target individual;

a storage device that includes a model that relates profile data that defines one or more features associated with a plurality of individuals with one or more entitlements of those individuals, each entitlement indicative of target system/application access;

a processor in communication with the IO subsystem and the storage device; and

non-transitory computer readable media in communication with the processor that stores instruction code which, when executed by the processor, causes the processor to;

control the IO subsystem to receive the profile data associated with a target individual;

determine a class of the plurality of individuals to which the target individual belongs according to a K-nearest neighbor algorithm;

determine one or more entitlements associated with the plurality of individuals of the class;

for each entitlement of the one or more entitlements, determine a number of members of the plurality of individuals of the class having the entitlement;

select entitlements associated with a number of members, N, that is above a predetermined threshold as entitlements to be granted to the target individual;

generate, based on the profile data and the model, a listing that includes one or more entitlements associated with the target individual, and confidence values associated with the one or more entitlements, each confidence value indicative of whether the target individual should be granted a corresponding entitlement; and

for each entitlement having a corresponding confidence value higher than a predetermined threshold, control the IO subsystem to communicate an instruction to a target system associated with the entitlement to allow the target individual access to the target system.

2. The system according to claim 1, wherein the model includes a plurality of probabilities, each being indicative of a probability that an individual of the plurality of individuals having a given feature of the one or more features has a given entitlement of the one or more entitlements, wherein the instruction code causes the processor to:

select a subset of probabilities of the model that are associated with the one or more features associated with the target individual;

determine, from the subset of probabilities, maximum probabilities associated with each entitlement that is itself associated with the subset of probabilities;

select entitlements associated with an N highest maximum probabilities as entitlements to be granted to the target individual.

3. The system according to claim 2, wherein the plurality of probabilities of the model includes probabilities indicative of a probability that an individual of the plurality of individuals having a given combination of features of the one or more features has a given entitlement of the one or more entitlements, and

wherein the selected subset of probabilities includes probabilities that are associated with combinations of the one or more features associated with the target individual.

4. The system according to claim 1, wherein the model defines a decision tree graph with nodes for each of the one or more features of the plurality of individuals, wherein the decision tree facilitates determining one or more entitlements to grant to the target individual based on features of the target individual.

5. The system according to claim 4, wherein the instruction code causes the processor to create the decision tree based on the profile data.

6. The system according to claim 1, wherein the profile data comprises employment role data of a person and entitlement data of other employees.

7. The system according to claim 1, wherein the target individual comprises a person.

8. The system according to claim 1, wherein the instruction code causes the processor to:

generate a plurality of classifiers based on different subsets of the plurality of individuals;

for each classifier, generate a confidence value for each possible entitlement to be granted to the target individual;

aggregate the confidence values for each possible entitlement from each classifier; and

select entitlements having aggregated confidence values above a predetermined threshold as entitlements to be granted to the target individual.

9. The system according to claim 1, wherein the instruction code causes the processor to:

receive usage information from one or more of the plurality of target systems, the usage information being indicative of how often individuals utilize each target system;

when the usage information associated with a given individual received from a given target system indicates a usage below a predetermined threshold;

communicate an instruction to the target system to revoke a corresponding entitlement associated with the target system from the individual; and

update the model to reflect that the individual no longer has the corresponding entitlement.

10. A method for controlling access to one or more of a plurality of target systems, the method comprising:

receiving profile data that defines one or more features associated with a plurality of individuals with one or more entitlements of those individuals, each entitlement indicative of target system access;

generating a model that relates the one or more features and the one or more entitlements of the plurality of individuals;

receiving profile data that defines one or more features associated with a target individual from a first user management system;

determining a class of the plurality of individuals to which the target individual belongs according to a K-nearest neighbor algorithm;

determining one or more entitlements associated with the plurality of individuals of the class;

for each entitlement of the one or more entitlements, determining a number of members of the plurality of individuals of the class having the entitlement;

selecting entitlements associated with a number of members, N, that is above a predetermined threshold as entitlements to be granted to the target individual;

generating, based on the profile data and the model, a listing that includes one or more entitlements associated with the target individual, and confidence values associated with the one or more entitlements, each confidence value indicative of whether the target individual should be granted a corresponding entitlement; and

for each entitlement having a corresponding confidence value higher than a predetermined threshold, communicating an instruction to a target system associated with the entitlement to allow the target individual access to the target system.

11. The method according to claim 10, wherein the model includes a plurality of probabilities, each being indicative of a probability that an individual of the plurality of individuals having a given feature of the one or more features has a given entitlement of the one or more entitlements, wherein the method further comprises:

selecting a subset of probabilities of the model that are associated with the one or more features associated with the target individual;

determining, from the subset of probabilities, maximum probabilities associated with each entitlement that is itself associated with the subset of probabilities;

selecting entitlements associated with an N highest maximum probabilities as entitlements to be granted to the target individual.

12. The method according to claim 11, wherein the plurality of probabilities of the model includes probabilities indicative of a probability that an individual of the plurality of individuals having a given combination of features of the one or more features has a given entitlement of the one or more entitlements, and

wherein the selected subset of probabilities includes probabilities that are associated with combinations of the one or more features associated with the target individual.

13. The method according to claim 10, wherein the model defines a decision tree graph with nodes for each of the one or more features of the plurality of individuals, wherein the decision tree facilitates determining one or more entitlements to grant to the target individual based on features of the target individual.

14. The method according to claim 10, further comprising:

generating a plurality of classifiers based on different subsets of the plurality of individuals;

for each classifier, generating a confidence value for each possible entitlement to be granted to the target individual;

aggregating the confidence values for each possible entitlement from each classifier; and

selecting entitlements having aggregated confidence values above a predetermined threshold as entitlements to be granted to the target individual.

15. The method according to claim 10, further comprising:

generating a report that includes the listing of the one or more entitlements associated with the target individual, and confidence values associated with the one or more entitlements.

16. The method according to claim 10, further comprising:

receiving usage information from one or more of the plurality of target systems, the usage information being indicative of how often individuals utilize each target system;

when the usage information associated with a given individual received from a given target system indicates a usage below a predetermined threshold;

communicating an instruction to the target system to revoke a corresponding entitlement associated with the target system from the individual; and

updating the model to reflect that the individual no longer has the corresponding entitlement.

17. Non-transitory computer readable media that stores instruction code for controlling access to one or more of a plurality of target systems, the instruction code being executable by a machine for causing the machine to perform acts comprising:

receiving profile data that defines one or more features associated with a plurality of individuals with one or more entitlements of those individuals, each entitlement indicative of target system access;

generating a model that relates the one or more features and the one or more entitlements of the plurality of individuals;

receiving profile data that defines one or more features associated with a target individual from a first user management system;

determining a class of the plurality of individuals to which the target individual belongs according to a K-nearest neighbor algorithm;

determining one or more entitlements associated with the plurality of individuals of the class;

for each entitlement of the one or more entitlements, determining a number of members of the plurality of individuals of the class having the entitlement;

selecting entitlements associated with a number of members, N, that is above a predetermined threshold as entitlements to be granted to the target individual;

generate, based on the profile data and the model, a listing that includes one or more entitlements associated with the target individual, and confidence values associated with the one or more entitlements, each confidence value indicative of whether the target individual should be granted a corresponding entitlement; and

for each entitlement having a corresponding confidence value higher than a predetermined threshold, communicating an instruction to a target system associated with the entitlement to allow the target individual access to the target system.

18. The non-transitory computer readable media according to claim 17, wherein the model includes a plurality of probabilities, each being indicative of a probability that an individual of the plurality of individuals having a given feature of the one or more features has a given entitlement of the one or more entitlements, wherein the instruction code is executable by the machine for causing the machine to perform additional acts comprising:

selecting a subset of probabilities of the model that are associated with the one or more features associated with the target individual;

determining, from the subset of probabilities, maximum probabilities associated with each entitlement that is itself associated with the subset of probabilities;

selecting entitlements associated with an N highest maximum probabilities as entitlements to be granted to the target individual.