Dynamic community generator

• US 8,316,453 B2
• Filed: 07/24/2009
• Issued: 11/20/2012
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Richards, Phillip L., Andersen, David M., Renfro, Chadwick R., Higgins, Christopher P.
• Primary Examiner(s): Edwards, Linglan
• Application Number:
  US12/509,241
• Publication Number:
  US 20100281512A1
• Time in Patent Office: 1,215 Days
• Field of Search: 726/1, 726/2, 726 26- 28
• US Class Current: 726/26
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

Embodiments of the invention are directed to systems, methods, and computer program products configured to determine communities within an organization dynamically based on the distribution of entitlements within the organization.

Claims

1. A system comprising:

a memory device having stored therein information regarding a plurality of entitlement-eligible entities and information regarding one or more entitlements currently associated with each entitlement-eligible entity; and

a processing device in communication with the memory device, wherein the processing device;

determines different communities of entitlement-eligible entities based on a review of the one or more entitlements currently associated with at least some of the entitlement-eligible entities, wherein determining the different communities comprises;

selecting a plurality of combinations of two entitlement-eligible entities from the plurality of entitlement-eligible entities;

determining for each of the selected plurality of combinations of two entitlement-eligible entities a correlation number, wherein the correlation number indicates how well the entitlements associated with one entitlement-eligible entity of a combination of two entitlement-eligible entities correlate to the entitlements associated with the other entitlement-eligible entity of the combination of two entitlement-eligible entities, wherein the correlation number for the combination of two entitlement-eligible entities is computed as a function of a number of entitlements that the two entitlement-eligible entities have in common and a number of entitlements that the two entitlement-eligible entities do not have in common;

determines a community of entitlement-eligible entities based on the correlation number for the combination of two entitlement-eligible entities selected from the plurality of entitlement eligible-entities;

selects a community of entitlement-eligible entities from the different communities;

calculates a likelihood ratio for at least one of the entitlements currently associated with one or more entitlement-eligible entities within the selected community, wherein the likelihood ratio indicates whether the at least one of the entitlements requires validation or not; and

determines based on the likelihood ratio that the entitlement is uncommon if the likelihood ratio is below an uncommon entitlement threshold or the entitlement is normal if the likelihood ratio is equal to or above the uncommon entitlement threshold, wherein an uncommon entitlement is an entitlement requiring validation, and wherein a normal entitlement is an entitlement that does not require validation.

2. The system of claim 1, wherein the processing device is configured to determine a community of entitlement-eligible entities based on a review of the one or more entitlements that each entitlement-eligible entity has in common with other of the plurality of entitlement-eligible entities.

3. The system of claim 1, wherein the processing device is configured to compute the correlation number by multiplying the number of entitlements that the two entitlement-eligible entities have in common by two and then subtracting therefrom the number of entitlements that the two entitlement-eligible entities do not have in common.

4. The system of claim 1, wherein the processing device generates a correlation matrix showing entitlement correlations for each combination of a plurality of entitlement-eligible entities, and wherein the processing device uses the correlation matrix to generate a plurality of different communities of entitlement-eligible entities.

5. The system of claim 4, wherein the processing device is configured to generate a community of entitlement-eligible entities by selecting an entitlement-eligible entity and selecting all entitlement-eligible entities in the selected entitlement-eligible entity'"'"'s row in the correlation matrix that have a correlation above a defined correlation threshold.

6. The system of claim 1, wherein the processing device is configured to periodically re-determine different communities of entitlement-eligible entities based on a review of the one or more entitlements currently associated with each entitlement-eligible entity at the time of the periodic re-determination.

7. The system of claim 1, wherein the processing device is configured to mark an uncommon entitlement for a higher priority of review relative to other entitlements not determined to be uncommon entitlements.

8. A system comprising:

a memory comprising information stored therein about the distribution of entitlements to a plurality of entities within an organization; and

a processor uses the information stored in the memory to identify a portion of the plurality of entities based on the distribution of entitlements within the organization, wherein the processor is configured to store information in the memory identifying the portion of the plurality of entities as a community, wherein identifying the portion of the plurality of entities as the community comprises;

selecting a plurality of combinations of two entities from the plurality of entities within the organization;

determining for each of the selected plurality of combinations of two entities a correlation number, wherein the correlation number indicates how well entitlements associated with one entity of a combination of two entities correlates to the entitlements associated with the other entity of the combination of two entities, wherein the correlation number for the combination of two entities is computed as a function of a number of entitlements that the two entities have in common and a number of entitlements that the two entities do not have in common;

determining a community of entities based on the correlation number for the combination of two entities selected from the plurality of entities;

selecting a community of entities;

calculating a likelihood ratio for at least one of the entitlements currently associated with one or more entities within the selected community, wherein the likelihood ratio indicates whether the at least one of the entitlements requires validation or not; and

determining based on the likelihood ratio that the entitlement is uncommon if the likelihood ratio is below an uncommon entitlement threshold or the entitlement is normal if the likelihood ratio is equal to or above the uncommon entitlement threshold, wherein an uncommon entitlement is an entitlement requiring validation, and wherein a normal entitlement is an entitlement that does not require validation.

9. The system of claim 8, wherein the memory comprises information about a pseudo-entity having a combination of entitlements associated therewith, and wherein the processor is configured to identify the portion of the plurality of entities based on a review of the one or more entitlements that each entity of the plurality of entities has in common with the pseudo-entity.

10. The system of claim 9, wherein the combination of entitlements associated with the pseudo-entity is based on user input comprising user-selected entitlements.

11. The system of claim 9, wherein, for each combination of an entity of the plurality of entities and the pseudo-entity, the processor is configured to compute a correlation number representing how well the entitlements associated the entity of the plurality of entities correlate with the combination of entitlements associated with the pseudo-entity, and wherein the processor identifies the portion of the plurality of entities based on the correlation number.

12. The system of claim 8, wherein the information stored in the memory about the distribution of entitlements to the plurality of entities within an organization is updated in real time or near-real time.

13. The system of claim 8, wherein the processor is configured to mark an uncommon entitlement for a higher priority of review relative to other entitlements not determined to be uncommon entitlements.

14. The system of claim 8, wherein the memory comprises information about the entity type for each of the plurality of entities, and wherein the processor is configured to identify entity types requiring a higher priority review relative to other entity types in the community.

15. The system of claim 14, wherein the processor is configured to mark an entity type requiring a high priority review relative to other entities not determined to be requiring the high priority review in the community.

16. The system of claim 8, wherein the memory comprises information about the entity type for each of the plurality of entities, wherein the processor is configured to determine, for each entity type represented in the community, an indicator of the amount or likelihood of each entity type in the community based on a review of the one or more entity types currently represented within the community, and wherein the processor is configured to determine one or more uncommon entity types based on whether each entity type'"'"'s indicator is below an uncommon entity type threshold, wherein an uncommon entitlement is an entitlement requiring validation, and wherein a normal entitlement is an entitlement that does not require validation.

17. A computer-implemented method for managing the distribution of entitlements within an organization, said method comprising:

providing information regarding a plurality of members in the organization and the entitlements that are currently associated with each member;

providing a computer processor executing computer readable code structured to cause the computer to;

group members from the plurality of members to determine one or more communities based on a review of the one or more entitlements currently associated with at least some of the plurality of members, wherein determining the one or more communities comprises;

selecting a plurality of combination of two members in the organization;

determining for each of the selected plurality of combinations of two members a correlation number, wherein the correlation number indicates how well the entitlements associated with one member of a combination of two members correlate to the entitlements associated with the other member of the combination of two members, wherein the correlation number for the combination of two members is computed as a function of a number of entitlements that the two members have in common and a number of entitlements that the two members do not have in common;

store in a memory the one or more communities and information about which of the plurality of members are in each of the one or more communities; and

select a community of members from the one or more communities;

calculate a likelihood ratio for at least one of the entitlements currently associated with one or more members within the selected community, wherein the likelihood ratio indicates whether the at least one of the entitlements requires validation or not; and

determining based on the likelihood ratio that the entitlement is uncommon if the likelihood ratio is below an uncommon entitlement threshold or the entitlement is normal if the likelihood ratio is equal to or above the uncommon entitlement threshold, wherein an uncommon entitlement is an entitlement requiring validation, and wherein a normal entitlement is an entitlement that does not require validation.

18. The computer-implemented method of claim 17, further comprising computer processor executing computer readable code structured to cause the computer to:

creating a pseudo-member having a combination of entitlements associated therewith; and

grouping, using the processor, a portion of the plurality of members into a community based on a review of the one or more entitlements that each member of the plurality of members has in common with the pseudo-member.

19. The computer-implemented method of claim 18, further comprising computer processor executing computer readable code structured to cause the computer to:

using user input to select the combination of entitlements associated with the pseudo-member.

20. The computer-implemented method of claim 18, wherein, for each combination of a member of the plurality of members and the pseudo-member, the processor is configured to compute a correlation number representing how well the entitlements associated the member of the plurality of members correlate with the combination of entitlements associated with the pseudo-member, and wherein the method further comprises:

grouping a portion of the plurality of members into a community based on the correlation number.

21. The computer-implemented method of claim 17, further comprising computer processor executing computer readable code structured to cause the computer to:

providing information about the member type for each of the plurality of members;

determining an indicator of an amount or likelihood of each member type in a community based on a review of the one or more member types currently represented within the community;

determining one or more uncommon member types based on whether each member type'"'"'s indicator is below an uncommon member type threshold; and

marking a member in the community that is associated with the one or more uncommon member types, wherein an uncommon entitlement is an entitlement requiring validation, and wherein a normal entitlement is an entitlement that does not require validation.

22. The computer-implemented method of claim 17, further comprising computer processor executing computer readable code structured to cause the computer to:

selecting a community from the one or more communities;

analyzing the entitlements that are currently associated with the members of the selected community to determine, for each entitlement in the selected community, the number of members in the selected community that are currently associated with each entitlement;

determining whether the number of members in the selected community that are currently associated with each entitlement is below a certain threshold;

identifying the members in the selected community associated with entitlements below the threshold; and

determining whether the entitlements below the threshold associated with the identified members require validation or not prior to removing the entitlement.

23. The computer-implemented method of claim 17, further comprising computer processor executing computer readable code structured to cause the computer to:

selecting a community from the one or more communities;

analyzing the entitlements that are currently associated with the members of the selected community to determine, for each entitlement in the selected community, the number of members in the selected community that are currently associated with each entitlement;

determining whether the number of members in the selected community that are currently associated with each entitlement is above a certain threshold;

identifying the members in the selected community not associated with entitlements above the threshold; and

determining whether the entitlements above the threshold associated with the identified members require validation or not prior to providing the entitlement to the identified members.

24. The computer-implemented method of claim 23, further comprising computer processor executing computer readable code structured to cause the computer to:

automatically distributing entitlements in the community that are above the threshold to the members in the selected community that are not associated with the entitlements above the threshold.