US 12,149,549 B1
Peer-based inference of unused identity and access management rights
Brendan Cruz Colon, Seattle, WA (US); Matthew Michael Sommer, Issaquah, WA (US); Alexander Noble Adkins, Catlettsburg, KY (US); Christopher Miller, Seattle, WA (US); and Kimberly A. Young, Woodinville, WA (US)
Assigned to AMAZON TECHNOLOGIES, INC., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Nov. 16, 2021, as Appl. No. 17/527,808.
Int. Cl. H04L 41/142 (2022.01); H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 41/142 (2013.01); H04L 63/102 (2013.01); H04L 63/104 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method of unused rights detection, the method comprising:
receiving a first rights vector representing a plurality of rights associated with a first user profile, wherein each right of the plurality of rights is associated with a respective permitted action, wherein each element of the first rights vector corresponds to a respective permissive action, wherein a respective value of each element of the first rights vector indicates whether the respective permissive action is permissible for the first user profile;
generating a first skill-usage vector representing skill-usage associated with the first user profile over a first period of time, the first skill-usage vector indicating at least one of whether and a respective number of times each skill of a plurality of skills was used in connection with the first user profile over the first period of time;
determining, using a first approximate nearest neighbor algorithm, a second user profile associated with a second skill-usage vector representing skill-usage associated with the second user profile over the first period of time, wherein the second skill-usage vector is determined by the first approximate nearest neighbor algorithm to be similar to the first skill-usage vector using a distance metric;
determining a second rights vector associated with the second user profile;
comparing the first rights vector to the second rights vector;
determining, based on the comparing the first rights vector to the second rights vector, a first right associated with the first user profile that is not associated with the second user profile; and
generating a modified first rights vector by removing the first right from the first rights vector; and
storing the modified first rights vector in non-transitory computer-readable memory in association with the first user profile.