Providing security to an enterprise via user clustering

Patent metadata

Field	Value
Publication number	US-9699196-B1
Application number	US-201514868567-A
Country	US
Kind code	B1
Filing date	Sep 29, 2015
Priority date	Sep 29, 2015
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

A computer-implemented technique provides security to an enterprise. The technique involves receiving, by processing circuitry, personal information belonging to users of the enterprise. The technique further involves providing, by the processing circuitry, lists of user identifiers based on user relationships defined by the personal information. The lists of user identifiers respectively identify clusters of users of the enterprise. The technique further involves electronically imposing, by the processing circuitry, security classes on the clusters of users of the enterprise based on the lists of user identifiers. Along these lines, such classification can be used for risk assessment (e.g., authentication), alert filtering (e.g., filtering false alarms), and permission/privilege monitoring and/or assignment, among others.

First claim

What is claimed is:

1. A computer-implemented method of providing security to an enterprise, the method comprising:
receiving, by processing circuitry, personal information belonging to users of the enterprise;
providing, by the processing circuitry, lists of user identifiers based on user relationships defined by the personal information, the lists of user identifiers respectively identifying clusters of users of the enterprise; and
electronically imposing, by the processing circuitry, security classes on the clusters of users of the enterprise based on the lists of user identifiers;

wherein receiving the personal information belonging to users of the enterprise includes:
obtaining user data from electronic personal information managers operated by the users of the enterprise;

wherein providing the lists of user identifiers based on the user relationships defined by the personal information includes:
identifying clusters of users from the user data obtained from the electronic personal information managers, and
outputting the lists of user identifiers to reflect the clusters of users identified from the user data;

wherein the user data obtained from the electronic personal information managers includes email communications processed by email circuitry operated by the users of the enterprise;
wherein identifying the clusters of users from the user data includes:
based on the email communications, generating a vertex-edge graph having vertexes and edges connecting the vertexes, each vertex representing a user of the enterprise and each edge representing a relationship between multiple users, and
performing a set of pruning operations on the vertex-edge graph to derive the clusters of users;

wherein generating the vertex-edge graph includes providing, to each edge, a weight having a relationship strength value which is based on analytics performed on the email communications; and
wherein performing the set of pruning operations on the vertex-edge graph includes identifying groups of vertexes based on the relationship strength value of the weight of each edge.

2. A computer-implemented method as in claim 1 wherein the user data obtained from the electronic personal information managers further includes meeting data processed by calendaring circuitry operated by the users of the enterprise; and wherein:
the vertex-edge graph is further generated based on co-attendance information in the meeting data.

3. A computer-implemented method as in claim 2 wherein generating the vertex-edge graph further includes providing, to each edge, a weight having a relationship strength value which is based on analytics performed on the co-attendance information in the meeting data.

4. A computer-implemented method as in claim 1 wherein a same user of the enterprise belongs to at least two clusters.

5. A computer-implemented method as in claim 1 wherein electronically imposing the security classes on the clusters of users of the enterprise based on the lists of user identifiers includes:
forming a behavior profile based on collected user behavior of users of a particular cluster, and
providing a risk score based on a comparison of (i) current behavior of a human purporting to be a user of the particular cluster to (ii) the behavior profile, the risk score being a numerical measure of riskiness that the human is an imposter.

6. A computer-implemented method as in claim 1 wherein electronically imposing the security classes on the clusters of users of the enterprise based on the lists of user identifiers includes:
forming an alarm filter based on collected alarm behavior from users of a particular cluster, and
applying the alarm filter to new alarms arising from user activity by a user of the particular cluster to remove false alarms.

7. A computer-implemented method as in claim 1 wherein electronically imposing the security classes on the clusters of users of the enterprise based on the lists of user identifiers includes:
identifying a consensus set of permissions based on collected permissions of users of a particular cluster, each permission defining a level of access control for a particular computerized resource of the enterprise, and
adjusting an existing set of permissions for a user of the particular cluster based on a comparison of the existing set of permissions to the consensus set of permissions.

8. Electronic equipment, comprising:
memory; and
control circuitry coupled to the memory, the memory storing instructions which, when carried out by the control circuitry, cause the control circuitry to:
receive personal information belonging to users of the enterprise;
provide lists of user identifiers based on user relationships defined by the personal information, the lists of user identifiers respectively identifying clusters of users of the enterprise; and
electronically impose security classes on the clusters of users of the enterprise based on the lists of user identifiers;

wherein the control circuitry, when receiving the personal information belonging to users of the enterprise, is constructed and arranged to:
obtain user data from electronic personal information managers operated by the users of the enterprise;

wherein the control circuitry, when providing the lists of user identifiers based on the user relationships defined by the personal information, is constructed and arranged to:
identify clusters of users from the user data obtained from the electronic personal information managers, and
output the lists of user identifiers to reflect the clusters of users identified from the user data;

wherein the user data obtained from the electronic personal information managers includes email communications processed by email circuitry operated by the users of the enterprise;
wherein the control circuitry, when identifying the clusters of users from the user data, is constructed and arranged to:
based on the email communications, generate a vertex-edge graph having vertexes and edges connecting the vertexes, each vertex representing a user of the enterprise and each edge representing a relationship between multiple users, and
perform a set of pruning operations on the vertex-edge graph to derive the clusters of users;

wherein the control circuitry, when generating the vertex-edge graph, is constructed and arranged to:
provide, to each edge, a weight having a relationship strength value which is based on analytics performed on the email communications; and

wherein the control circuitry, when performing the set of pruning operations on the vertex-edge graph, is constructed and arranged to:
identify groups of vertexes based on the relationship strength value of the weight of each edge.

9. Electronic equipment as in claim 8 wherein the control circuitry, when electronically imposing the security classes on the clusters of users of the enterprise based on the lists of user identifiers, is constructed and arranged to:
identify a consensus set of permissions based on collected permissions of users of a particular cluster, each permission defining a level of access control for a particular computerized resource of the enterprise, and
adjust an existing set of permissions for a user of the particular cluster based on a comparison of the existing set of permissions to the consensus set of permissions.

10. A computer program product having a non-transitory computer readable medium which stores a set of instructions to provide security to an enterprise, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:
receiving personal information belonging to users of the enterpr

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Kolman Eyal
• Sahar Carmit
• Blatt Marcelo
• Kaufman Alon

Classifications

• G06F17/30598

  Physics · mapped topic

• G06F17/30958

  Physics · mapped topic

• H04L63/104 Primary

  Grouping of entities · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title