User Access Group Clustering for Zero-Trust Security Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access management systems struggle with defining well-defined user access groups in complex systems with thousands of users and resources, often leading to haphazard and unmanageable group creations, especially when users change roles or access requirements evolve, making it difficult to maintain security and compliance with zero-trust guidelines.
Innovation Solution
A computer-implemented method using a centroid-based clustering algorithm to automatically discover user and resource access groups by generating a matrix of user-resource access, calculating similarity measurements, and iteratively clustering users or resources based on access rights, with manual refinement options.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If manual access group creation is used, then administrators can control access rights, but the process becomes haphazard and unmanageable in complex systems with thousands of users
Solution Approach 1:
The system automatically discovers and creates access groups by analyzing user access patterns and resource access relationships, eliminating the need for manual group creation while maintaining security control. The algorithm self-determines optimal groupings based on actual usage data.
Solution Approach 2:
The patent replaces manual mechanical group creation processes with an automated computational algorithm that uses clustering techniques to dynamically determine access groups based on user behavior and resource access patterns.
2Reliability
If access groups are created to manage security, then security improves, but maintaining groups becomes difficult when users change roles or access requirements evolve
Solution Approach 1:
The access groups are dynamically maintained through continuous analysis of user access patterns. When users change roles or access requirements, the system automatically detects these changes and updates group memberships accordingly, ensuring security remains effective without manual intervention.
Solution Approach 2:
The system continuously monitors and analyzes actual user access behavior, using this feedback to automatically adjust and refine access group definitions, ensuring they remain aligned with current organizational needs and security requirements.
3Extent of automation
If automated clustering algorithms are used, then optimal access groups are generated automatically, but the system complexity increases
Solution Approach 1:
The patent employs clustering algorithms that analyze multiple parameters simultaneously including user access patterns, resource access frequencies, and relationship strengths. By transforming complex access management into a multi-parameter optimization problem, the system achieves automated optimal grouping through computationally intensive but well-defined mathematical operations.
Data Source
AI summary
A method, computer program product, and computer system are provided for user access group discovery. The method includes: generating a matrix that depicts the respective resources of a set of resources accessed by each of a plurality of users; obtaining, for each user, a similarity measurement using the matrix, wherein the similarity measurement is based on a comparison of the resources accessed by the user to the resources accessed by the other users; generating, for each user, a feature vector for clustering the users into user access groups, wherein the feature vector represents the resources accessed by the user; applying the feature vectors and the similarity measurements to a centroid-based clustering algorithm to obtain the user access groups; and outputting the user access groups for application in a security environment.