Reconciliation of access rights in a computing system

• US 9,830,455 B2
• Filed: 04/11/2016
• Issued: 11/28/2017
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Moloian, Armen, Ritchey, Ronald W.
• Primary Examiner(s): Cao, Phuong Thao
• Application Number:
  US15/095,611
• Publication Number:
  US 20160224772A1
• Time in Patent Office: 596 Days
• Field of Search: 707600
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 10/08 Logistics, e.g. warehousing, loading or distribution; Inventory or stock management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Systems and methods are provide for reconciling access rights of a computing system are described. Access right information that respectively corresponds to access rights of a computing system may be obtained and evaluated. Reconciliation tasks may be performed using the access right information, and a reconciliation report may be generated during performance of at least one of the reconciliation tasks. The reconciliation report may indicate that one or more of the access rights should either be provisioned or revoked at the computing system.

Claims

1. A system for reconciling access rights of a computing system comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the system to generate a reconciliation report that indicates at least one access right of a computing system should either be provisioned or revoked wherein the reconciliation report is generated by performing one or more reconciliation tasks using access right information that corresponds to one or more access rights of a computing system and

wherein each of the one or more reconciliation tasks is associated with instructions stored at the memory that, when executed by the at least one processor, cause the system to;

determine, from the access right information, a plurality of users that are each associated with an access right of the one or more access rights,

obtain attribute information corresponding to one or more attributes of the plurality of users,

select one of the users of the plurality of users, and

generate the reconciliation report based on a comparison between a first portion of the attribute information that is associated with the selected user and a second portion of the attribute information that is respectively associated with a plurality of other users of the plurality of users; and

wherein the one or more reconciliation tasks include a first reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to;

determine, from the attribute information and for each of the plurality of users, an attribute of the user wherein the attribute comprises one of a role, a job code, a job title, a geographic location, a line-of-business, or a business division,

determine a percentage of the plurality of other users having the same attribute as the selected user, and

configure the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined percentage threshold.

2. The system of claim 1, wherein:

the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to;

calculate an attribute deviation score based on the comparison between the first portion of the attribute information associated with the selected user and the second portion of the attribute information respectively associated with the plurality of other users,

configure the reconciliation report to indicate that the selected user is an outlier based on a comparison of the attribute deviation score to a predetermined attribute deviation threshold.

3. The system of claim 1, wherein:

the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to;

determine, from the attribute information, a first plurality of attributes of the selected user,

determine, from the attribute information and for each of the plurality of other users, a second plurality of attributes of the other user,

obtain a plurality of attribute deviation scores based on a comparison of each of the first plurality of attributes of the selected user to, for each of the plurality of other users, a corresponding one of the second plurality of attributes of the other user,

aggregate the plurality of attribute deviation scores to obtain an aggregated attribute deviation score, and

configure the reconciliation report to indicate that the selected user is an outlier based on a comparison of the aggregated attribute deviation score to predetermined aggregated attribute deviation threshold.

4. The system of claim 1, wherein:

the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to;

determine, from the access right information, that the access right associated with the plurality of users is a common role assigned to each of the plurality of users,

determine, from the attribute information and for each of the plurality of users, a job code assigned to the user,

determine a percentage of the plurality of other users having the same job code as the selected user, and

configure the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.

5. The system of claim 1, wherein:

the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to;

determine, from the access right information, the access right associated with the plurality of users is an entitlement to access a computing resource of the computing system,

determine, from the attribute information and for each of the plurality of users, a geographic location of the user,

determine a percentage of the plurality of other users having the same geographic location as the selected user, and

configure the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.

6. The system of claim 1, wherein:

the instructions, when executed by the at least one processor, further cause the system to provide the reconciliation report to an administrator of the computing system.

7. A computer-implemented method for reconciling access rights of a computing system comprising:

generating, by a computing device, a reconciliation report that indicates at least one access right of a computing system should either be provisioned or revoked wherein the reconciliation report is generated by performing one or more reconciliation tasks using access right information that corresponds to one or more access rights of a computing system and wherein each of the one or more reconciliation tasks comprises;

determining, by the computing device from the access right information, a plurality of users that are each associated with an access right of the one or more access rights,

obtaining, by the computing device, attribute information corresponding to one or more attributes of the plurality of users,

selecting, by the computing device, one of the users of the plurality of users, and

generating, by the computing device, the reconciliation report based on a comparison between a first portion of the attribute information that is associated with the selected user and a second portion of the attribute information that is respectively associated with plurality of other of the plurality of users; and

wherein the one or more reconciliation tasks include a first reconciliation task further comprising;

determining, by the computing device from the attribute information and for each of the plurality of users, an attribute of the user wherein the attribute comprises one of a role, a job code, a job title, a geographic location, a line-of-business, or a business division,

determining, by the computing device, a percentage of the plurality of other users having the same attribute as the user, and

configuring, by the computing device, the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined percentage threshold.

8. The computer-implemented method of claim 7, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

calculating, by the computing device, an attribute deviation score based on the comparison between the first portion of the attribute information associated with the selected user and the second portion of the attribute information respectively associated with the plurality of other users,

configuring, by the computing device, the reconciliation report to indicate that the selected user is an outlier based on a comparison of the attribute deviation score to a predetermined attribute deviation threshold.

9. The computer-implemented method of claim 7, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

determining, by the computing device from the attribute information, a first plurality of attributes of the selected user,

determining, by the computing device from the attribute information and for each of the plurality of other users, a second plurality of attributes of the other user,

obtaining, by the computing device, a plurality of attribute deviation scores based on a comparison of each of the first plurality of attributes of the selected user to, for each of the plurality of other users, a corresponding one of the second plurality of attributes of the other user,

aggregating, by the computing device, the plurality of attribute deviation scores to obtain an aggregated attribute deviation score, and

configuring, by the computing device, the reconciliation report to indicate that the selected user is an outlier based on a comparison of the aggregated attribute deviation score to a predetermined aggregated attribute deviation threshold.

10. The computer-implemented method of claim 7, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

determining, by the computing device from the access right information, that the access right associated with the plurality of users is a common role assigned to each of the plurality of users,

determining, by the computing device from the attribute information and for each of the plurality of users, a job code assigned to the user,

determining, by the computing device, a percentage of the plurality of other users having the same job code as the selected user, and

configuring, by the computing device, the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.

11. The computer-implemented method of claim 7, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

determining, by the computing device from the access right information, the access right associated with the plurality if users is an entitlement to access a computing resource of the computing system,

determining, by the computing device from the attribute information and for each of the plurality of users, a geographic location of the user,

determining, by the computing device, a percentage of the plurality of other users having the same geographic location as the selected user, and

configuring, by the computing device, the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.

12. The computer-implemented method of claim 7, further comprising:

providing the reconciliation report to an administrator of the computing system.

13. Non-transitory computer-readable media comprising instructions that, when executed by a processor of a computing device, cause the computing device to perform steps for reconciling access rights of a computing system, the steps comprising:

generating a reconciliation report that indicates at least one access right of a computing system should either be provisioned or revoked wherein the reconciliation report is generated by performing one or more reconciliation tasks using access right information that corresponds to one or more access rights of a computing system and wherein each of the one or more reconciliation tasks comprises;

determining, from the access right information, a plurality of users that ate each associated with an access right of the one or more access rights,

obtaining attribute information corresponding to one or more attributes of the plurality of users,

selecting one of the users of the plurality of users, and

generating the reconciliation report based on a comparison between a first portion of the attribute information that is associated with the selected user and a second portion of the attribute information that is respectively associated with plurality of other users of the plurality of users; and

wherein the one or more reconciliation tasks include a first reconciliation task further comprising;

determining, from the attribute information and for each of the plurality of users, an attribute of the user wherein the attribute comprises one of a role, a job code, a job title, a geographic location, a line-of-business, or a business division,

determining a percentage of the plurality of other users having the same attribute as the selected user, and

configuring the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined percentage threshold.

14. The non-transitory computer-readable media of claim 13, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

calculating an attribute deviation score based on the comparison between the first portion of the attribute information associated with the selected user and the second portion of the attribute information respectively associated with the plurality of other users,

configuring the reconciliation report to indicate that the selected user is an outlier based on a comparison of the attribute deviation score to a predetermined attribute deviation threshold.

15. The non-transitory computer-readable media of claim 13, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

determining, from the attribute information, a first plurality of attributes of the selected user,

determining, from the attribute information and for each of the plurality of other users, a second plurality of attributes of the other user,

obtaining a plurality of attribute deviation scores based on a comparison of each of the first plurality of attributes of the selected user to, for each of the plurality of other users, a corresponding one of the second plurality of attributes of the other user,

aggregating the plurality of attribute deviation scores to obtain an aggregated attribute deviation score, and

configuring the reconciliation report to indicate that the selected user is an outlier based on a comparison of the aggregated attribute deviation score to a predetermined aggregated attribute deviation threshold.

16. The non-transitory computer-readable media of claim 13, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

determining, from the access right information, that the access right associated with the plurality of users is a common role assigned to each of the plurality of users,

determining, from the attribute information and for each of the plurality of users, a job code assigned to the user,

determining a percentage of the plurality of other users having the same job code as the selected user, and

configuring the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.

17. The non-transitory computer-readable media of claim 13, wherein:

the one or more reconciliation tasks include a second reconciliation task further comprising;

determining, from the access right information, the access right associated with the plurality of users is an entitlement to access a computing resource of the computing system,

determining, from the attribute information and for each of the plurality of users, a geographic location of the user,

determining a percentage of the plurality of other users having the same geographic location as the selected user, and

configuring the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.