In-Line Resolution of an Entity's Identity

Patent metadata

Field	Value
Publication number	US-2020076784-A1
Application number	US-201916360264-A
Country	US
Kind code	A1
Filing date	Mar 21, 2019
Priority date	Sep 4, 2018
Publication date	Mar 5, 2020
Grant date	—

Abstract

A system, method, and computer-readable medium for resolving an identity of an entity, comprising: parsing entity identifier information, the parsing generating entity identifier elements from the entity identifier information; classifying an entity identifier element type; normalizing an entity identifier element to provide a normalized entity identifier element; and, associating the normalized entity identifier element with an entity to resolve the identity of the entity.

First claim

1 - 20 . (canceled)

21 . A computer-implementable method for resolving an identity of an entity, comprising:
receiving an event stream, the event stream comprising a plurality of events; extracting an extracted event feature from a particular event of the plurality of events; parsing entity identifier information using the extracted event feature, the parsing generating entity identifier elements from the entity identify information; classifying an entity identifier element with an entity identifier element type; normalizing an entity identifier element to provide a normalized entity identifier element; and, associating the normalized entity identifier element with the entity to resolve the identity of the entity, the identity of the entity being resolved in-line.

22 . The method of claim 21 , wherein:
the entity identifier comprises at least one of a user identification factor, a user identify factor, location data, information associated with an endpoint device, information associated with an edge device, information associated with an internal network, information associated with an external network and information associated with a resource entity.

23 . The method of claim 21 , wherein:
the entity identifier element type comprising a representation of a particular attribute associated with an entity identifier element.

24 . The method of claim 21 , wherein:
the entity identifier element type comprises at least one of a simple mail transfer protocol (SMTP) address type, an exchange address type and an inferred type; and, normalizing the entity identifier element is specific to the entity identifier element type.

25 . The method of claim 21 , wherein:
the associating resulting in a classified and normalized entity identifier element being cross-referenced with another classified and normalized entity identifier element.

26 . The method of claim 21 , wherein:
the normalizing provides an implicit identifier pair associated with the normalized entity identifier element.

27 . A system comprising:
a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code for resolving an identity of an entity, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
receiving an event stream, the event stream comprising a plurality of events;
extracting an extracted event feature from a particular event of the plurality of events;
parsing entity identifier information using the extracted event feature, the parsing generating entity identifier elements from the entity identify information;
classifying an entity identifier element with an entity identifier element type;
normalizing an entity identifier element to provide a normalized entity identifier element; and,
associating the normalized entity identifier element with the entity to resolve the identity of the entity, the identity of the entity being resolved in-line.

28 . The system of claim 27 , wherein:
the entity identifier comprises at least one of a user identification factor, a user identify factor, location data, information associated with an endpoint device, information associated with an edge device, information associated with an internal network, information associated with an external network and information associated with a resource entity.

29 . The system of claim 27 , wherein:
the entity identifier element type comprising a representation of a particular attribute associated with an entity identifier element.

30 . The system of claim 27 , wherein:
the entity identifier element type comprises at least one of a simple mail transfer protocol (SMTP) address type, an exchange address type and an inferred type; and, normalizing the entity identifier element is specific to the entity identifier element type.

31 . The system of claim 27 , wherein:
the associating resulting in a classified and normalized entity identifier element being cross-referenced with another classified and normalized entity identifier element.

32 . The system of claim 27 , wherein:
the normalizing provides an implicit identifier pair associated with the normalized entity identifier element.

33 . A non-transitory, computer-readable storage medium embodying computer program code for resolving an identity of an entity, the computer program code comprising computer executable instructions configured for:
receiving an event stream, the event stream comprising a plurality of events; extracting an extracted event feature from a particular event of the plurality of events; parsing entity identifier information using the extracted event feature, the parsing generating entity identifier elements from the entity identify information; classifying an entity identifier element with an entity identifier element type; normalizing an entity identifier element to provide a normalized entity identifier element; and, associating the normalized entity identifier element with the entity to resolve the identity of the entity, the identity of the entity being resolved in-line.

34 . The non-transitory, computer-readable storage medium of claim 33 , wherein:
the entity identifier comprises at least one of a user identification factor, a user identify factor, location data, information associated with an endpoint device, information associated with an edge device, information associated with an internal network, information associated with an external network and information associated with a resource entity.

35 . The non-transitory, computer-readable storage medium of claim 33 , wherein:
the entity identifier element type comprising a representation of a particular attribute associated with an entity identifier element.

36 . The non-transitory, computer-readable storage medium of claim 33 , wherein:
the entity identifier element type comprises at least one of a simple mail transfer protocol (SMTP) address type, an exchange address type and an inferred type; and, normalizing the entity identifier element is specific to the entity identifier element type.

37 . The non-transitory, computer-readable storage medium of claim 33 , wherein:
the associating resulting in a classified and normalized entity identifier element being cross-referenced with another classified and normalized entity identifier element.

38 . The non-transitory, computer-readable storage medium of claim 33 , wherein:
the normalizing provides an implicit identifier pair associated with the normalized entity identifier element.

39 . The non-transitory, computer-readable storage medium of claim 33 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.

40 . The non-transitory, computer-readable storage medium of claim 33 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.

Assignees

• Forcepoint Llc

Inventors

• Renner William
• Bracikowski Phillip
• Snyder Russell
• Poirel Christopher

Classifications

• H04L69/22 Primary

  Parsing or analysis of headers · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title