US 12,407,691 B1
Methods and systems for optimizing grouping for enhanced access control and risk mitigation in an enterprise
Madhusudana Shashanka, Austin, TX (US); Bonnie Arogyam Varghese, Milpitas, CA (US); Leomart Crisostomo, Sunnyvale, CA (US); Shankar Subramaniam, Cupertino, CA (US); and Sumeet Khirwal, Jamshedpur (IN)
Assigned to CONCENTRIC SOFTWARE, INC., San Mateo, CA (US)
Filed by Concentric Software, Inc., San Mateo, CA (US)
Filed on Nov. 29, 2024, as Appl. No. 18/964,189.
Int. Cl. G06F 21/00 (2013.01); H04L 9/40 (2022.01)
CPC H04L 63/104 (2013.01) [H04L 63/101 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for optimizing grouping for enhanced access control and risk mitigation, the method comprising:
obtaining, by a server system, user data comprising data associated with a plurality of users and a plurality of groups, wherein each of the plurality of users is associated with at least one group of the plurality of groups, wherein the user data specifies a group membership of each of the plurality of users and one or more of the plurality of groups;
obtaining, by the server system, access data comprising data associated with a plurality of data objects and corresponding access information, wherein the access information specifies a set of users or groups, from the plurality of users or the plurality of groups respectively, authorized to access each respective data object of the plurality of data objects;
determining, by the server system, a first mapping information between each of the plurality of groups with corresponding users of the plurality of users based on the user data;
determining, by the server system, a second mapping information between each of the plurality of data objects with corresponding users of the plurality of users based at least on the access data;
generating, by the server system, a cluster dataset representing a plurality of clusters based at least on processing of a relational structure between the first mapping information and the second mapping information, the plurality of clusters representing newly generated groups of the plurality of users, wherein each user in the plurality of clusters has a same access authorization for the plurality of data objects as assigned within the plurality of groups, wherein a number of the plurality of clusters is less than a number of the plurality of groups; and
replacing, by the server system, an existing grouping of the plurality of users with the generated cluster dataset.