Systems for network risk assessment including processing of user access rights associated with a network of devices

Patent metadata

Field	Value
Publication number	US-9467455-B2
Application number	US-201514731312-A
Country	US
Kind code	B2
Filing date	Jun 4, 2015
Priority date	Dec 29, 2014
Publication date	Oct 11, 2016
Grant date	Oct 11, 2016

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.

First claim

What is claimed is:

1. A computerized method comprising:
by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors, obtaining information describing network traffic between a plurality of network devices within a network;
determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and wherein each node is associated with one or more network devices;
associating indications of user access rights of users to respective nodes included in the network topology; and
generating user interface data associated with the network topology;
wherein an indication of user access rights of a particular user to a particular node comprises one or more of:
information indicating that the particular user is permitted access to a space which includes at least one network device associated with the particular node,
information indicating that a user account associated with the particular user can provide information to, or receive information from, at least one network device associated with the particular node, or
information indicating that the user account associated with the particular user is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

2. The computerized method of claim 1 , further comprising:
obtaining access control lists associated with respective nodes, wherein each access control list identifies user accounts permitted to access one or more network devices associated with a node.

3. The computerized method of claim 1 , further comprising:
obtaining access records associated with respective nodes, wherein each access record identifies actual access attempts by user accounts to one or more network devices associated with a node.

4. The computerized method of claim 1 , wherein generating user interface data comprises generating a graph identifying the network topology.

5. The computerized method of claim 1 , wherein each edge included in the network topology represents a communication path.

6. The computerized method of claim 1 , further comprising:
receiving an identifier of a particular user;
obtaining indications of user access rights of the particular user that are associated with respective nodes included in the network topology; and
including information in the user interface data identifying the indications of user access rights.

7. A system comprising:
one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
obtaining information describing network traffic between a plurality of network devices within a network;
determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and wherein each node is associated with one or more network devices; and
associating indications of user access rights of users to respective nodes included in the network topology;
wherein an indication of user access rights of a particular user to a particular node comprises one or more of:
information indicating that the particular user is permitted access to a space which includes at least one network device associated with the particular node,
information indicating that a user account associated with the particular user can provide information to, or receive information from, at least one network device associated with the particular node, or
information indicating that the user account associated with the particular user is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

8. The system of claim 7 , wherein the operations further comprise:
obtaining access control lists associated with respective nodes, wherein each access control list identifies user accounts permitted to access one or more network devices associated with a node.

9. The system of claim 7 , wherein the operations further comprise: obtaining access records associated with respective nodes, wherein each access record identifies actual access attempts by user accounts to one or more network devices associated with a node.

10. The system of claim 7 , wherein the operations further comprise:
generating user interface data associated with the network topology.

11. The system of claim 10 , wherein the operations further comprise:
receiving an identifier of a particular user;
obtaining indications of user access rights of the particular user that are associated with respective nodes included in the network topology; and
including information in the user interface data identifying the indications of user access rights.

12. The system of claim 10 , wherein generating user interface data comprises generating a graph identifying the network topology.

13. The system of claim 7 , wherein each edge included in the network topology represents a communication path.

14. A computer program product, encoded on one or more non-transitory computer storage media, comprising instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:
obtaining information describing network traffic between a plurality of network devices within a network;
determining, based on the information describing network traffic, a network topology of the network, wherein the network topology comprises a plurality of nodes each connected by an edge to one or more of the plurality of nodes, and wherein each node is associated with one or more network devices;
associating indications of user access rights of users to respective nodes included in the network topology; and
generating user interface data associated with the network topology;
wherein an indication of user access rights of a particular user to a particular node comprises one or more of:
information indicating that the particular user is permitted access to a space which includes at least one network device associated with the particular node,
information indicating that a user account associated with the particular user can provide information to, or receive information from, at least one network device associated with the particular node, or
information indicating that the user account associated with the particular user is permitted to access, or has actually attempted to access, at least one network device associated with the particular node.

15. The computer program product of claim 14 , wherein the operations further comprise:
obtaining access control lists associated with respective nodes, wherein each access control list identifies user accounts permitted to access one or more network devices associated with a node.

16. The computer program product of claim 14 , wherein the operations further comprise:
obtaining access records associated with respective nodes, wherein each access record identifies actual access attempts by user accounts to one or more network devices associated with a node.

17. The computer program product of claim 14 , wherein the operations further comprise:
receiving an identifier of a particular user;
obtaining indications of

Assignees

• Palantir Technologies Inc

Inventors

• Seiver Miles
• Rosenblum Charles

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title