Mitigating risk in business networks in a privacy preserving manner

Patent metadata

Field	Value
Publication number	US-11943357-B2
Application number	US-202017121380-A
Country	US
Kind code	B2
Filing date	Dec 14, 2020
Priority date	Dec 14, 2020
Publication date	Mar 26, 2024
Grant date	Mar 26, 2024

Abstract

Aspects of the present invention disclose a method for calculating a risk resulting from a network of networks that includes unknown relationships in a privacy preserving manner. The method includes one or more processors determining a set of conditions corresponding to a user of a network. The method further includes transmitting a compliance request corresponding to the set of conditions to one or more members of the network utilizing a privacy preserving algorithm. The method further includes determining a respective risk factor of one or more members of the network, wherein the respective risk factor corresponds to a response of each of the one or more members to the compliance request. The method further includes determining an overall risk of the network based at least in part on the risk factors of the one or more members.

First claim

What is claimed is:

1. A method comprising:
determining, by one or more processors, a set of network conditions of a network, wherein the network includes a root computing node, a plurality of primary child computing nodes connected to the root computing node, and a plurality of secondary child computing nodes connected to respective primary child computing nodes, wherein at least one secondary child computing node is unknown to the root computing node;
transmitting, by one or more processors, a compliance request corresponding to the set of network conditions of the network to the plurality of primary and secondary child computing nodes;
determining, by one or more processors, and using a first multi-party computation (MPC) protocol, respective first risk factors of the secondary child computing nodes derived from responses to the compliance request by the secondary child computing nodes; and
determining, by one or more processors, and using a second MPC protocol, an overall risk of the network based, at least in part, on: (i) respective second risk factors of the primary child computing nodes derived from responses to the compliance request by the primary child computing nodes, and (ii) the respective first risk factors of the secondary child computing nodes determined using the first MPC protocol.

2. The method of claim 1 , further comprising:
performing, by one or more processors, a mitigation action corresponding to the overall risk of the network.

3. The method of claim 2 , wherein performing the mitigation action corresponding to the overall risk of the network, further comprises:
in response to determining that the respective risk factor of at least one of a primary or secondary child computing node indicates noncompliance with the compliance request, identifying, by one or more processors, one or more relationships of the network to satisfy a condition corresponding to the compliance request.

4. The method of claim 3 , further comprising:
identifying, by one or more processors, a cost associated with the identified one or more relationships, wherein an identified relationship includes adding a primary child computing node or a secondary child computing node to the network; and
determining, by one or more processors, a risk factor corresponding to the identified relationship of the added primary or secondary child computing node.

5. The method of claim 1 , further comprising:
identifying, by one or more processors, a triggering event in the network, wherein the triggering event is selected from a group consisting of: regulation change of the network, onboarding a new primary or secondary child computing node, and a primary or second child computing node reporting a change in the network.

6. The method of claim 1 , wherein determining the respective first and second risk factors of the primary and secondary child computing nodes further comprises:
extracting, by one or more processors, respective risk values from the responses to the compliance request by the primary and second child computing nodes.

7. A computer program product comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to determine a set of network conditions of a network, wherein the network includes a root computing node, a plurality of primary child computing nodes connected to the root computing node, and a plurality of secondary child computing nodes connected to respective primary child computing nodes, wherein at least one secondary child computing node is unknown to the root computing node;
program instructions to transmit a compliance request corresponding to the set of network conditions of the network to the plurality of primary and secondary child computing nodes;
program instructions to determine, and using a first multi-party computation (MPC) protocol, respective first risk factors of the secondary child computing nodes derived from responses to the compliance request by the secondary child computing nodes; and
program instructions to determine, and using a second MPC protocol, an overall risk of the network based, at least in part, on: (i) respective second risk factors of the primary child computing nodes derived from responses to the compliance request by the primary child computing nodes, and (ii) the respective first risk factors of the secondary child computing nodes determined using the first MPC protocol.

8. The computer program product of claim 7 , further comprising program instructions, stored on the one or more computer readable storage media, to:
perform a mitigation action corresponding to the overall risk of the network.

9. The computer program product of claim 8 , wherein the program instructions to perform the mitigation action corresponding to the overall risk of the network, further comprise program instructions to:
in response to determining that the respective risk factor of at least one of a primary or secondary child computing node indicates noncompliance with the compliance request, identify one or more relationships of the network to satisfy a condition corresponding to the compliance request.

10. The computer program product of claim 9 , further comprising program instructions, stored on the one or more computer readable storage media, to:
identify a cost associated with the identified one or more relationships, wherein an identified relationship includes adding a primary child computing node or a secondary child computing node to the network; and
determine a risk factor corresponding to the identified relationship of the added primary or secondary child computing node.

11. The computer program product of claim 7 , further comprising program instructions, stored on the one or more computer readable storage media, to:
identify a triggering event in the network, wherein the triggering event is selected from a group consisting of: regulation change of the network, onboarding a new primary or secondary child computing node, and a primary or second child computing node reporting a change in the network.

12. The computer program product of claim 7 , wherein the program instructions to determine the respective first and second risk factors of the primary and secondary child computing nodes further comprise program instructions to:
extract respective risk values from the responses to the compliance request by the primary and second child computing nodes.

13. A computer system comprising:
one or more computer processors;
one or more computer readable storage media; and
program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
program instructions to determine a set of network conditions a network, wherein the network includes a root computing node, a plurality of primary child computing nodes connected to the root computing node, and a plurality of secondary child computing nodes connected to respective primary child computing nodes, wherein at least one secondary child computing node is unknown to the root computing node;
program instructions to transmit a compliance request corresponding to the set of network conditions of the network to the plurality of primary and secondary child computing nodes;
program instructions to determine, and using a first multi-party computation (MPC) protocol, respective first risk factors of the secondary child computing nodes derived from responses to the compliance request by the secondary child computing nodes; and
program instructions to d

Assignees

• IBM

Inventors

• Abitbol Roy
• Bnayahu Jonathan
• Wasserkrug Eliezer Segev
• Dayama Pankaj Satyanarayan
• Barger Artem

Classifications

• H04L9/3218 Primary

  using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs · CPC title

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title

• G06Q10/06375

  Prediction of business process outcome or impact based on a proposed change · CPC title

• H04L63/0421

  Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer · CPC title

• H04L63/0407

  wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00) · CPC title