Systems for network risk assessment including processing of user access rights associated with a network of devices

• US 9,467,455 B2
• Filed: 06/04/2015
• Issued: 10/11/2016
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Seiver, Miles, Rosenblum, Charles
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/731,312
• Publication Number:
  US 20160191532A1
• Time in Patent Office: 495 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

Claims

1. A computerized method comprising:

by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors, obtaining information describing network traffic between a plurality of network devices within a network;

determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and wherein each node is associated with one or more network devices;

associating indications of user access rights of users to respective nodes included in the network topology; and

generating user interface data associated with the network topology;

wherein an indication of user access rights of a particular user to a particular node comprises one or more of;

information indicating that the particular user is permitted access to a space which includes at least one network device associated with the particular node,

information indicating that a user account associated with the particular user can provide information to, or receive information from, at least one network device associated with the particular node, or

information indicating that the user account associated with the particular user is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

2. The computerized method of claim 1, further comprising:

obtaining access control lists associated with respective nodes, wherein each access control list identifies user accounts permitted to access one or more network devices associated with a node.

3. The computerized method of claim 1, further comprising:

obtaining access records associated with respective nodes, wherein each access record identifies actual access attempts by user accounts to one or more network devices associated with a node.

4. The computerized method of claim 1, wherein generating user interface data comprises generating a graph identifying the network topology.

5. The computerized method of claim 1, wherein each edge included in the network topology represents a communication path.

6. The computerized method of claim 1, further comprising:

receiving an identifier of a particular user;

obtaining indications of user access rights of the particular user that are associated with respective nodes included in the network topology; and

including information in the user interface data identifying the indications of user access rights.

7. A system comprising:

one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising;

obtaining information describing network traffic between a plurality of network devices within a network;

determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and wherein each node is associated with one or more network devices; and

associating indications of user access rights of users to respective nodes included in the network topology;

wherein an indication of user access rights of a particular user to a particular node comprises one or more of;

information indicating that the particular user is permitted access to a space which includes at least one network device associated with the particular node,

information indicating that a user account associated with the particular user can provide information to, or receive information from, at least one network device associated with the particular node, or

information indicating that the user account associated with the particular user is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

8. The system of claim 7, wherein the operations further comprise:

obtaining access control lists associated with respective nodes, wherein each access control list identifies user accounts permitted to access one or more network devices associated with a node.

9. The system of claim 7, wherein the operations further comprise:

obtaining access records associated with respective nodes, wherein each access record identifies actual access attempts by user accounts to one or more network devices associated with a node.

10. The system of claim 7, wherein the operations further comprise:

generating user interface data associated with the network topology.

11. The system of claim 10, wherein the operations further comprise:

receiving an identifier of a particular user;

obtaining indications of user access rights of the particular user that are associated with respective nodes included in the network topology; and

including information in the user interface data identifying the indications of user access rights.

12. The system of claim 10, wherein generating user interface data comprises generating a graph identifying the network topology.

13. The system of claim 7, wherein each edge included in the network topology represents a communication path.

14. A computer program product, encoded on one or more non-transitory computer storage media, comprising instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:

obtaining information describing network traffic between a plurality of network devices within a network;

determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and wherein each node is associated with one or more network devices;

associating indications of user access rights of users to respective nodes included in the network topology; and

generating user interface data associated with the network topology;

wherein an indication of user access rights of a particular user to a particular node comprises one or more of;

information indicating that the particular user is permitted access to a space which includes at least one network device associated with the particular node,

information indicating that a user account associated with the particular user can provide information to, or receive information from, at least one network device associated with the particular node, or

information indicating that the user account associated with the particular user is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

15. The computer program product of claim 14, wherein the operations further comprise:

obtaining access control lists associated with respective nodes, wherein each access control list identifies user accounts permitted to access one or more network devices associated with a node.

16. The computer program product of claim 14, wherein the operations further comprise:

obtaining access records associated with respective nodes, wherein each access record identifies actual access attempts by user accounts to one or more network devices associated with a node.

17. The computer program product of claim 14, wherein the operations further comprise:

receiving an identifier of a particular user;

obtaining indications of user access rights of the particular user that are associated with respective nodes included in the network topology; and

including information in the user interface data identifying the indications of user access rights.