System and method for role validation in identity management artificial intelligence systems using analysis of network identity graphs
Systems and methods for embodiments of a graph based artificial intelligence systems for identity management are disclosed. Embodiments of the identity management systems disclosed herein may utilize a network graph approach to analyzing roles of a distributed networked enterprise computing environment. Specifically, in certain embodiments, an artificial intelligence based identity management systems may utilize role graphs to assess the role structure of a distributed enterprise computing environment.
1. An identity management system, comprising:
a data store;
a processor;
a non-transitory, computer-readable storage medium, including computer instructions, when executed by the processor, cause the system to perform the steps of:
obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment, the identity management data comprising data on a set of roles, a set of entitlements, and a set of identities, wherein the set of roles, set of entitlements and set of identities are utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine the set or roles, identities of the set of identities associated with each of the set of roles and entitlements of the set of entitlements associated with the set of roles;
generating a first role graph from the identity management data by:
creating a node of the first role graph for each of the determined set of roles;
for each first identity and second identity that share at least one entitlement of the set of entitlements or at least one identity of the set of identities, creating an edge of the first role graph between a first node representing a first role and a second node of the first role graph representing a second role; and
generating a weight for each edge of the first role graph between each first node representing the first role and second node representing the second role based on the at least one entitlement or the at least one identity shared between the first role represented by the first node and the second role represented by the second node;
storing the first role graph in the data store;
obtaining a pruning threshold associated with the first role graph;
pruning the set of edges of the first role graph based on the pruning threshold and the weight for each of the set of edges to generate a second role graph;
storing the second role graph in the data store;
determining a health metric for the set of roles associated with the distributed enterprise computing environment based on a structure of the second role graph; and
presenting the health metric and the second role graph to a user through a user interface.
2. The system of claim 1 , wherein the each edge is an access similarity relationship and the weight generated for each edge of the first role graph between each first node and second node is an access similarity weight based on a number of shared entitlements between the first role represented by the first node and the second role represented by the second node.
3. The system of claim 1 , wherein the each edge is a concurrency similarity relationship and the weight generated for each edge of the first role graph between each first node and second node is a concurrent similarity weight based on a number of identities that have both the first role represented by the first node and the second role represented by the second node.
4. The system of claim 3 , wherein the pruning of the first role graph is based on a concurrency count comprising the number of identities that include both roles.
5. The system of claim 1 , wherein the health metric for the set of roles associated with the distributed enterprise computing environment is a scaling metric that measures a deviation from an optimal structure of the second role graph.
6. The system of claim 5 , wherein the deviation from the optimal structure is determined based on the number of edges in the second role graph.
7. The system of claim 1 , wherein the health metric is based on a number of identities or entitlements associated with each role represented in the second role graph.
8. A method for managing roles, comprising the steps of:
obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment via one or more of computer network connections, the identity management data comprising data on a set of roles, a set of entitlements, and a set of identities, wherein the set of roles, set of entitlements and set of identities are utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine the set or roles, identities of the set of identities associated with each of the set of roles and entitlements of the set of entitlements associated with the set of roles;
generating a first role graph from the identity management data by:
creating a node of the first role graph for each of the determined set of roles;
for each first identity and second identity that share at least one entitlement of the set of entitlements or at least one identity of the set of identities, creating an edge of the first role graph between a first node representing a first role and a second node of the first role graph representing a second role; and
generating a weight for each edge of the first role graph between each first node representing the first role and second node representing the second role based on the at least one entitlement or the at least one identity shared between the first role represented by the first node and the second role represented by the second node;
storing the first role graph in the data store;
obtaining a pruning threshold associated with the first role graph;
pruning the set of edges of the first role graph based on the pruning threshold and the weight for each of the set of edges to generate a second role graph;
storing the second role graph;
determining a health metric for the set of roles associated with the distributed enterprise computing environment based on a structure of the second role graph; and
presenting the health metric and the second role graph to a user through a user interface.
9. The method of claim 8 , wherein the each edge is an access similarity relationship and the weight generated for each edge of the first role graph between each first node and second node is an access similarity weight based on a number of shared entitlements between the first role represented by the first node and the second role represented by the second node.
10. The method of claim 8 , wherein the each edge is a concurrency similarity relationship and the weight generated for each edge of the first role graph between each first node and second node is a concurrent similarity weight based on a number of identities that have both the first role represented by the first node and the second role represented by the second node.
11. The method of claim 10 , wherein the pruning of the first role graph is based on a concurrency count comprising the number of identities that include both roles.
12. The method of claim 8 , wherein the health metric for the set of roles associated with the distributed enterprise computing environment is a scaling metric that measures a deviation from an optimal structure of the second role graph.
13. The method of claim 12 , wherein the deviation from the optimal structure is determined based on the number of edges in the second role graph.
14. The method of claim 8 , wherein the health metric is based on a number of identities or entitlements associated with each role represented in the second role graph.
15. A non-transitory computer readable medium, comprising computer instructions, when executed by a computer processor, cause the computer process to perform the steps of:
obtaining identity management data from one or more identity management systems in a distributed enterprise computing environment, the identity management data comprising data on a set of roles, a set of entitlements, and a set of identities, wherein the set of roles, set of entitlements and set of identities are utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine the set or roles, identities of the set of identities associated with each of the set of roles and entitlements of the set of entitlements associated with the set of roles;
generating a first role graph from the identity management data by:
creating a node of the first role graph for each of the determined set of roles, for each first identity and second identity that share at least one entitlement of the set of entitlements or at least one identity of the set of identities, creating an edge of the first role graph between a first node representing a first role and a second node of the first role graph representing a second role; and
generating a weight for each edge of the first role graph between each first node representing the first role and second node representing the second role based on the at least one entitlement or the at least one identity shared between the first role represented by the first node and the second role represented by the second node;
storing the first role graph in the data store;
obtaining a pruning threshold associated with the first role graph;
pruning the set of edges of the first role graph based on the pruning threshold and the weight for each of the set of edges to generate a second role graph;
storing the second role graph;
determining a health metric for the set of roles associated with the distributed enterprise computing environment based on a structure of the second role graph; and
presenting the health metric and the second role graph to a user through a user interface.
16. The non-transitory computer readable medium of claim 15 , wherein the each edge is an access similarity relationship and the weight generated for each edge of the first role graph between each first node and second node is an access similarity weight based on a number of shared entitlements between the first role represented by the first node and the second role represented by the second node.
17. The non-transitory computer readable medium of claim 15 , wherein the each edge is a concurrency similarity relationship and the weight generated for each edge of the first role graph between each first node and second node is a concurrent similarity weight based on a number of identities that have both the first role represented by the first node and the second role represented by the second node.
18. The non-transitory computer readable medium of claim 17 , wherein the pruning of the first role graph is based on a concurrency count comprising the number of identities that include both roles.
19. The non-transitory computer readable medium of claim 15 , wherein the health metric for the set of roles associated with the distributed enterprise computing environment is a scaling metric that measures a deviation from an optimal structure of the second role graph.
20. The non-transitory computer readable medium of claim 19 , wherein the deviation from the optimal structure is determined based on the number of edges in the second role graph.
21. The non-transitory computer readable medium of claim 15 , wherein the health metric is based on a number of identities or entitlements associated with each role represented in the second role graph.