Reconciliation of access rights in a computing system

Patent metadata

Field	Value
Publication number	US-9830455-B2
Application number	US-201615095611-A
Country	US
Kind code	B2
Filing date	Apr 11, 2016
Priority date	Dec 20, 2012
Publication date	Nov 28, 2017
Grant date	Nov 28, 2017

Abstract

Systems and methods are provide for reconciling access rights of a computing system are described. Access right information that respectively corresponds to access rights of a computing system may be obtained and evaluated. Reconciliation tasks may be performed using the access right information, and a reconciliation report may be generated during performance of at least one of the reconciliation tasks. The reconciliation report may indicate that one or more of the access rights should either be provisioned or revoked at the computing system.

First claim

What is claimed is:

1. A system for reconciling access rights of a computing system comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the system to generate a reconciliation report that indicates at least one access right of a computing system should either be provisioned or revoked wherein the reconciliation report is generated by performing one or more reconciliation tasks using access right information that corresponds to one or more access rights of a computing system and
wherein each of the one or more reconciliation tasks is associated with instructions stored at the memory that, when executed by the at least one processor, cause the system to:
determine, from the access right information, a plurality of users that are each associated with an access right of the one or more access rights,
obtain attribute information corresponding to one or more attributes of the plurality of users,
select one of the users of the plurality of users, and
generate the reconciliation report based on a comparison between a first portion of the attribute information that is associated with the selected user and a second portion of the attribute information that is respectively associated with a plurality of other users of the plurality of users; and

wherein the one or more reconciliation tasks include a first reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to:
determine, from the attribute information and for each of the plurality of users, an attribute of the user wherein the attribute comprises one of a role, a job code, a job title, a geographic location, a line-of-business, or a business division,
determine a percentage of the plurality of other users having the same attribute as the selected user, and
configure the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined percentage threshold.

2. The system of claim 1 , wherein:
the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to:
calculate an attribute deviation score based on the comparison between the first portion of the attribute information associated with the selected user and the second portion of the attribute information respectively associated with the plurality of other users,
configure the reconciliation report to indicate that the selected user is an outlier based on a comparison of the attribute deviation score to a predetermined attribute deviation threshold.

3. The system of claim 1 , wherein:
the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to:
determine, from the attribute information, a first plurality of attributes of the selected user,
determine, from the attribute information and for each of the plurality of other users, a second plurality of attributes of the other user,
obtain a plurality of attribute deviation scores based on a comparison of each of the first plurality of attributes of the selected user to, for each of the plurality of other users, a corresponding one of the second plurality of attributes of the other user,
aggregate the plurality of attribute deviation scores to obtain an aggregated attribute deviation score, and
configure the reconciliation report to indicate that the selected user is an outlier based on a comparison of the aggregated attribute deviation score to predetermined aggregated attribute deviation threshold.

4. The system of claim 1 , wherein:
the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to:
determine, from the access right information, that the access right associated with the plurality of users is a common role assigned to each of the plurality of users,
determine, from the attribute information and for each of the plurality of users, a job code assigned to the user,
determine a percentage of the plurality of other users having the same job code as the selected user, and
configure the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.

5. The system of claim 1 , wherein:
the one or more reconciliation tasks include a second reconciliation task associated with instructions stored at the memory that, when executed by the at least one processor, further cause the system to:
determine, from the access right information, the access right associated with the plurality of users is an entitlement to access a computing resource of the computing system,
determine, from the attribute information and for each of the plurality of users, a geographic location of the user,
determine a percentage of the plurality of other users having the same geographic location as the selected user, and
configure the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined threshold percentage.

6. The system of claim 1 , wherein:
the instructions, when executed by the at least one processor, further cause the system to provide the reconciliation report to an administrator of the computing system.

7. A computer-implemented method for reconciling access rights of a computing system comprising:
generating, by a computing device, a reconciliation report that indicates at least one access right of a computing system should either be provisioned or revoked wherein the reconciliation report is generated by performing one or more reconciliation tasks using access right information that corresponds to one or more access rights of a computing system and wherein each of the one or more reconciliation tasks comprises:
determining, by the computing device from the access right information, a plurality of users that are each associated with an access right of the one or more access rights,
obtaining, by the computing device, attribute information corresponding to one or more attributes of the plurality of users,
selecting, by the computing device, one of the users of the plurality of users, and
generating, by the computing device, the reconciliation report based on a comparison between a first portion of the attribute information that is associated with the selected user and a second portion of the attribute information that is respectively associated with plurality of other of the plurality of users; and

wherein the one or more reconciliation tasks include a first reconciliation task further comprising:
determining, by the computing device from the attribute information and for each of the plurality of users, an attribute of the user wherein the attribute comprises one of a role, a job code, a job title, a geographic location, a line-of-business, or a business division,
determining, by the computing device, a percentage of the plurality of other users having the same attribute as the user, and
configuring, by the computing device, the reconciliation report to indicate that the selected user is an outlier responsive to determining that the percentage is less than a predetermined percentage threshold.

8. The computer-implemented method of claim 7 , wherein:
the one or more reconciliation tasks include a second reconciliation task further comp

Assignees

• Bank Of America

Inventors

• Moloian Armen
• Ritchey Ronald W

Classifications

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/31

  User authentication · CPC title

• G06Q10/08 Primary

  Logistics, e.g. warehousing, loading or distribution; Inventory or stock management · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title