Patent ID: 12192291

DETAILED DESCRIPTION

In the following description of various illustrative embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which aspects of the disclosure may be practiced. It is to be understood that other embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the present disclosure.

It is noted that various connections between elements are discussed in the following description. It is noted that these connections are general and, unless specified otherwise, may be direct or indirect, wired or wireless, and that the specification is not intended to be limiting in this respect.

FIGS.1A-1Cdepict one or more illustrative computing environments for controlling access to secure information resources using account lineage tracking and verification systems in accordance with one or more example embodiments. Referring toFIG.1A, computing environment100may include one or more computer systems. For example, computing environment100may include an account lineage tracking computing platform110, a distributed database computing platform120, an administrator computing device130, user computing device 1 (UCD1)140, user computing device 2 (UCD2)150including a source-level interceptor151, user computing device 3 (UCD3)160, intermediate computing device 1 (ICD1)170including a source-level interceptor171, user computing device 4 (UCD4)180including a source-level interceptor181, and intermediate computing device 2 (ICD2)190. Although not illustrated, one or more additional computing platforms and/or one or more computing devices may communicate with the computing environment100.

Intermediate computing devices170,190may include various computing devices via which one or more other computing devices may access distributed database computing platform120. For example, intermediate computing devices170,190may include virtualization servers, host servers, proxy servers, cloud servers, remote access computers, or the like. In some instances, the intermediate computing devices170,190may include one or more user computing devices accessed by another user computing device.

As illustrated in greater detail below, account lineage tracking computing platform110may include one or more computing devices configured to perform one or more of the functions described herein. For example, account lineage tracking computing platform110may include one or more computers (e.g., laptop computers, desktop computers, servers, server blades, or the like). In some instances, one or more functions and/or operations performed by account lineage tracking computing platform110may be initiated on, triggered on, and/or otherwise caused to be executed on other computing device(s)/platform(s).

Account lineage tracking computing platform110may include one or more computing devices and/or other computer components (e.g., processors, memories, communication interfaces). In addition, account lineage tracking computing platform110may host and/or execute one or more account lineage tracking applications, provide one or more database-level interceptors to one or more databases in distributed database computing platform120and one or more source-level interceptors to users of one or more computing devices, and/or generate one or more account lineage profiles associated with distributed database computing platform120and/or the one or more computing devices. In one or more arrangements, account lineage tracking computing platform110may be associated with an enterprise organization, such as a financial institution, and account lineage tracking computing platform110may be connected to other servers and/or enterprise computing infrastructure that is configured to provide various enterprise and/or back-office computing functions for the enterprise organization. For example, this enterprise computing infrastructure may include various servers and/or databases that store and/or otherwise maintain account information, such as financial account information including account balances, transaction history, account owner information, and/or other information. In addition, this enterprise computing infrastructure may process and/or otherwise execute transactions on specific accounts based on commands and/or other information received from other computer systems included in computing environment100.

Distributed database computing platform120may include one or more databases. The one or more databases may include one or more computing devices and/or other computer components (e.g., processors, memories, communication interfaces). In addition, and as illustrated in greater detail below, distributed database computing platform120may be configured to store and/or otherwise maintain enterprise data and/or other data, including data that may be used by and/or support one or more transaction processing programs, loan application processing programs, and/or other programs associated with an enterprise organization, such as a financial institution. For example, distributed database computing platform120may include various servers and/or databases that store and/or otherwise maintain account information, such as financial account information including account balances, transaction history, account owner information, and/or other information. In addition, distributed database computing platform120may process and/or otherwise execute transactions on specific accounts based on commands and/or other information received from other computer systems included in computing environment100.

Administrator computing device130may be a personal computing device (e.g., desktop computer, laptop computer) or mobile computing device (e.g., smartphone, tablet). In addition, administrator computing device130may be linked to and/or used by an administrative user (who may, e.g., be an information technology systems administrator of an enterprise organization operating account lineage tracking computing platform110). For instance, administrator computing device130may be linked to and/or used by an administrative user who may use administrator computing device130to define one or more policies and/or rules for computing devices and/or databases in an operating environment (which may, e.g., include policies and/or rules governing the access of secured data in one or more databases, changes of access rights and privileges, and/or changes of user accounts). For example, administrator computing device130may be used by an administrative user to define one or more criteria for identifying sensitive data that should not be accessed by an unverified source's user account.

User computing devices (e.g., UCD1140, UCD2150, UCD3160, UCD4180, etc.) may include one or more computing devices and/or other computer components (e.g., processors, memories, communication interfaces). User computing devices may be personal computing devices (e.g., desktop computer, laptop computer) or mobile computing devices (e.g., smartphone, tablet). In addition, a user computing device (e.g., UCD2150, UCD4180, etc.) including a source-level interceptor (e.g., source-level interceptor151, source-level interceptor181, etc.) may be linked to and/or used by one or more specific users (e.g., a customer, a user, or an employee, who may, e.g., be associated with an enterprise organization, such as a financial institution, operating account lineage tracking computing platform110and/or one or more other systems and/or devices in computing environment100).

Like user computing devices, intermediate computing devices (e.g., ICD1170, ICD2190, etc.) may include one or more computing devices and/or other computer components (e.g., processors, memories, communication interfaces). In addition, intermediate computing devices (e.g., ICD1170) may be linked to and/or used by one or more specific users (e.g., a customer, a user, or an employee, who may, e.g., be associated with an enterprise organization, such as a financial institution, operating account lineage tracking computing platform110and/or one or more other systems and/or devices in computing environment100).

Computing environment100also may include one or more networks, which may interconnect one or more of account lineage tracking computing platform110, distributed database computing platform120, administrator computing device130, user computing devices (e.g., UCD1140, UCD2150, UCD3160, and UCD4180), and intermediate computing devices (e.g., ICD1170and ICD2190). For example, computing environment100may include a network170, which may, for instance, include one or more private networks, public networks, sub-networks, and/or the like, and which may interconnect one or more of account lineage tracking computing platform110, distributed database computing platform120, administrator computing device130, user computing devices (e.g., UCD1140, UCD2150, UCD3160, and UCD4180), and intermediate computing devices (e.g., ICD1170and ICD2190).

In one or more arrangements, account lineage tracking computing platform110, distributed database computing platform120, administrator computing device130, user computing devices (e.g., UCD1140, UCD2150, UCD3160, and UCD4180), intermediate computing devices (e.g., ICD1170and ICD2190), and/or the other systems included in computing environment100may be any type of computing device capable of receiving a user interface, receiving input via the user interface, and communicating the received input to one or more other computing devices. For example, account lineage tracking computing platform110, distributed database computing platform120, administrator computing device130, user computing devices (e.g., UCD1140, UCD2150, UCD3160, and UCD4180), intermediate computing devices (e.g., ICD1170and ICD2190), and/or the other systems included in computing environment100may, in some instances, be and/or include server computers, desktop computers, laptop computers, tablet computers, smart phones, or the like that may include one or more processors, memories, communication interfaces, storage devices, and/or other components. As noted above, and as illustrated in greater detail below, any and/or all of account lineage tracking computing platform110, distributed database computing platform120, administrator computing device130, user computing devices (e.g., UCD1140, UCD2150, UCD3160, and UCD4180), and intermediate computing devices (e.g., ICD1170and ICD2190) may, in some instances, be special-purpose computing devices configured to perform specific functions.

Referring toFIG.1B, account lineage tracking computing platform110may include one or more processors111, memory112, and communication interface113. A data bus may interconnect processor111, memory112, and communication interface113. Communication interface113may be a network interface configured to support communication between account lineage tracking computing platform110and one or more networks (e.g., network170). Memory112may include one or more program modules having instructions that when executed by processor111cause account lineage tracking computing platform110to perform one or more functions described herein and/or one or more databases that may store and/or otherwise maintain information which may be used by such program modules and/or processor111. In some instances, the one or more program modules and/or databases may be stored by and/or maintained in different memory units of account lineage tracking computing platform110and/or by different computing devices that may form and/or otherwise make up account lineage tracking computing platform110. For example, memory112may have, store, and/or include an account lineage track module112a, an account lineage verification module112b, an account data alerting engine112c, and a source-level interceptor management module112d. Account lineage track module112amay have instructions that direct and/or cause account lineage tracking computing platform110to identify one or more account-change instances, to link one or more account-change instances, and to determine an account lineage chain, as discussed in greater detail below. Account lineage verification module112bmay verify one or more account-change instances, one or more accounts associated with the one or more account-change instances, and verify each linkage of the determined account lineage chain. Account data alerting engine112cmay generate one or more notifications and/or alerts for reporting, as discussed in greater detail below. Source-level interceptor management module112dmay manage downloading and installation of one or more types of source-level interceptors, as discussed in greater detail below.

Referring toFIG.1C, administrator computing device130may include one or more processors131, memory132, and communication interface133. A data bus may interconnect processor131, memory132, and communication interface133. Communication interface133may be a network interface configured to support communication between administrator computing device130and one or more networks (e.g., network170). Memory132may include one or more program modules having instructions that when executed by processor131cause administrator computing device130to perform one or more functions described herein and/or one or more databases that may store and/or otherwise maintain information which may be used by such program modules and/or processor131. In some instances, the one or more program modules and/or databases may be stored by and/or maintained in different memory units of administrator computing device130and/or by different computing devices that may form and/or otherwise make up administrator computing device130. For example, memory132may have, store, and/or include an authentication module132a, an account lineage report processing module132b, and a data access control engine112c. Authentication module132amay have instructions that direct and/or cause administrator computing device130to authenticate one or more user computing devices and/or intermediate computing devices and to grant installation of a source-level interceptor. Account lineage report processing module132bmay receive one or more reports (e.g., notifications, alerts, etc.) from account lineage tracking computing platform110, processes information included in the reports, and update one or more databases (e.g., an account lineage profile database), as discussed in greater detail below. Database access control engine132cmay have instructions that direct and/or cause administrator computing device130to control access to secure information resources using account lineage data and one or more entitled rights for various different accounts, as discussed in greater detail below.

FIGS.2A-2Ddepict an illustrative event sequence and account lineage data for controlling access to secure information resources using account lineage tracking and verification in accordance with one or more example embodiments. Referring toFIG.2A, at step201, administrator computing device130may perform an authentication process (e.g., shown inFIG.2B) with UCD1140. For example, at step201, administrator computing device130may receive, via a communication interface (e.g., communication interface133), from UCD1140, a first data access request to access data of one or more target databases (e.g., secured data stored in distributed database computing platform120). The access to the data of the one or more target databases may require a verification of a complete account lineage chain, which will be discussed below in more detail. After the authentication process, a source-level interceptor (or a source-level sniffer) may be installed to UCD1140to enable the verification of the complete account lineage chain.

At step202, account lineage tracking platform110may receive, from administrator computing device130, authorization to install a source-level interceptor to UCD1140. For example, at step202, based on a successful authentication of UCD1140(e.g., by administrator computing device130), administrator computing device130may authorize account lineage tracking platform110to install the source-level interceptor to UCD1140. The source-level interceptor may be installed to other computing devices (e.g., UCD3160, ICD2190, etc.) in a similar manner.

In some embodiments, administrator computing device130may directly install a source-level interceptor to UCD1140after a successful authentication process. For example, administrator computing device130may authenticate whether UCD1140is used by a preauthorized user (e.g., one or more users preauthorized by a financial institution) to access the secured data of the one or more target databases.

In some embodiments, administrator computing device130or account lineage tracking platform110may install a source-level interceptor to UCD1140without performing step201. For example, account lineage tracking platform110may install a source-level interceptor to UCD1140after receiving the first data access request from UCD1140. The source-level interceptor installed to UCD1140may be a public version of an interceptor application that can be installed to any non-private computing devices (e.g., one or more computers used by a plurality of users). The public version may be temporarily installed to UCD1140and may be automatically uninstalled or deleted (e.g., after a session is terminated).

At step203, UCD1140may download and install the source-level interceptor. For example, account lineage tracking platform110may send a code, a program, and/or software to run the source-level interceptor on UCD1140. The source-level interceptor may be downloaded and installed on any other computing devices that do not have the source-level interceptor, have a corrupted source-level interceptor, or have an outdated source-level interceptor. The source-level interceptor may be installed as a standalone program, a component code, an embedded code, or any other codes.

The source-level interceptor may be installed on various user computing devices. One or more computing devices (e.g., UCD2150, ICD1170, UCD4180) may include source-level interceptors (e.g., source-level interceptors151,171, and181) installed according to one or more processes described above or similar to the processes described above. In some embodiments, the source-level interceptors may be a generic program that can be installed to a plurality of computing devices.

In some embodiments, each source-level interceptor may be configured to be a user-specific source-level interceptor. For instance, source-level interceptor151may be configured to be used only by UCD2150. Source-level interceptor151may authenticate one or more user accounts accessing UCD2150. Source-level interceptor171of ICD1170may be configured to be used by one or more computing devices accessing distributed database computing platform120via ICD1170.

In some embodiments, intermediate computing devices (e.g., ICD1170, ICD2190) may be one or more of: virtualization servers; host servers; proxy servers; cloud servers; or remote access computers. For example, ICD1170or ICD2190may be accessed by a plurality of preauthorized users or unauthorized users via other user computing devices (e.g., UCD3160).

In some embodiments, intermediate computing devices (e.g., ICD1170) may be a user computing device accessed by UCD3160. For example, a hacker may illegitimately access ICD1170using UCD2160to impersonate a user of ICD1170to access distributed database computing platform120using a user account associated with ICD1170. In another example, an authenticated user of ICD1170may legitimately access ICD1170using UCD3160, which may be another user computing device accessed by the authenticated user.

Referring toFIG.2B, administrator computing device130may perform the authentication process with UCD1140. For example, steps251,252,253,254, and255may be example operations performed during the authentication process illustrated inFIG.2A(e.g., step201shown inFIG.2A). One or more steps illustrated inFIG.2Bmay be omitted or one or more steps may be added in performing the authentication process.

At step251, administrator computing device130may receive, from a user computing device (e.g., UCD1140), authentication data. For example, administrator computing device130may receive authentication data of a user, such as credentials, ID and password, etc. For instance, the authentication data may be registered to administrator computing device130based on a creation of a new user account.

At step252, administrator computing device130may verify the authentication data. For example, administrator computing device130may verify whether the received authentication data is valid (e.g., not expired). Administrator computing device130may verify the authentication data, for instance, by identifying that the authentication data is received from a preauthorized user computing device (e.g., UCD2150) or an unauthorized user computing device (e.g., UCD1140). Administrator computing device130may verify the authentication data, for instance, by determining whether UCD1140has failed the authentication process for more than a number of times (e.g., 3 times, 5 times, etc.).

At step253, administrator computing device130may send a secondary authentication request. For example, administrator computing device130may send the secondary authentication request if the authentication data is received from an unauthorized user computing device (e.g., UCD1140) and/or if UCD1140has failed the authentication process for more than a number of times. The secondary authentication request may include a request for temporary identification information. For example, the secondary authentication request may request temporary identification data (e.g., a temporary PIN number) that was sent to an authorized user's account (e.g., an email account, an application account, a text message to a phone number, etc.).

At step254, administrator computing device130may receive secondary authentication data in response to the secondary authentication request. For example, a user of UCD1140may input the temporary identification data via a user interface (e.g., a keyboard, a keypad, etc.) of UCD1140, and administrator computing device130may receive, from UCD1140, the temporary identification data via a communication interface (e.g., communication interface133).

At step255, administrator computing device130may indicate, to UCD1140, an authentication result and installation of a source-level interceptor. For example, administrator computing device130may receive the temporary identification data within a preset time period and determine that the secondary authentication data is successfully authenticated. Administrator computing device130may authorize the installation of the source-level interceptor on UCD1140based on the determination that the secondary authentication data is successfully authenticated.

Referring toFIG.2C, after installing a source-level interceptor (e.g., at step203ofFIG.2A), at step204, a source-level interceptor of a computing device (e.g., UCD1140after successfully installing the source-level interceptor, UCD2150, ICD170, or UCD4180) may monitor for account-change instances. For example, the source-level interceptor may examine account usage by the computing device on which the source-level interceptor is installed. The source-level interceptor may gather event data associated with the account usage. The event data may include event data associated with an account change from a first account to a second account and/or one or more commands issued to change an account or to change execution context.

In some embodiments, the account change or the change of execution context may include an identity switching at an operating system level or a network-layer. For example, one or more users may change or switch accounts in UCD2150or may execute as another account in UCD2150. For instance, at a first time, a user of UCD2150may initiate a first operating system installed on UCD2150and may login into the first operating system using a first user account of the first operating system. At a second time, a user of UCD2150may initiate a second operating system installed on UCD2150and may login into the second operating system using a second user account of the second operating system. A user of UCD2150may access the second operating system, via an interface (e.g., a virtual interface), while executing the first operating system. A user may access one or more applications by using one or more application accounts. The user identity may be changed or switched by using the one or more application accounts. A user may issue one or more commands, such as “execute as” commands, to switch the execution context or to switch the account to another account. The source-level interceptor151may monitor for such changes, switches, and/or any context switching of accounts used in UCD2150.

A database user account may be an account used in one or more databases (e.g., databases of distributed database computing platform120). For example, a first target database of distributed database computing platform120may include a database administrator account (e.g., a super user account of the first target database) and a general database user account (e.g., a database account with limited rights issued to a specific database user of the first target database). A source user account may be a user account tracked by one or more source-level interceptors in one or more computing devices. For example, a source user account may be any user account used externally from the perspective of distributed database computing platform120.

At step205, the source-level interceptor (e.g., source-level interceptor151, source-level interceptor171, source-level interceptor181, etc.) may detect one or more source user account events associated with the computing device (e.g., UCD2150). For example, source-level interceptor151may detect the first user account of the first operating system being accessed at the first time, and the second user account of the second operating system being accessed at the second time. Source-level interceptor151may detect one or more application accounts being accessed, at UCD2150, at different times. Source-level interceptor151may detect one or more account switching context events associated with one or more commands issued to switch the execution context or to switch the account. Each of an account access event, an account change event, an account switch event, or context switching event may constitute an account-change instance.

The source-level interceptor may generate one or more timestamps associated with the detected events. For example, source-level interceptor151may generate a first timestamp corresponding to the first time for the access of the first user account of the first operating system, and generate a second timestamp corresponding to the second time for the access, or the account switch to, the second user account of the second operating system. Source-level interceptor151may generate a timestamp corresponding to a time when an application account is accessed. Source-level interceptor151may generate a timestamp corresponding to a time when a command is issued to switch the execution context or to switch the account.

The source-level interceptor may detect device information associated with a computing device in which the source-level interceptor is installed. For example, source-level interceptor151may detect device information, such as one or more device identifiers of UCD2150(e.g., registered account(s) of UCD2150, installed operating system(s), serial number(s) of UCD2150or component(s) of UCD2150, MAC address(es) of network device(s) of UCD2150, IP address(es) used by UCD2150or other wired/wireless communication interface identifiers, a domain name(s) associated with UCD2150, gateway(s) associated with UCD2150, etc.).

At step206, the source-level interceptor may send an account-change message to account lineage tracking computing platform110. For example, the account-change message may indicate one or more account-change instances. For instance, a first account-change instance may correspond to the access of the first user account of the first operating system accessed at the first time. A second account-change instance may correspond to the access of the second user account of the second operating system, via an interface of the first operating system, while executing the first operating system. A third account-change instance may correspond to the access of an application account by launching an application (or a web browser or another program or interface) while using the second user account of the second operating system. A fourth account-change instance may correspond to a context switching (e.g., an execution context switching of a session based on one or more commands, such as “execute as” commands).

At step207, account lineage tracking computing platform110may generate a source-level account change report. For example, account lineage tracking computing platform110may generate a source-level account change report based on one or more account-change messages received from one or more source-level interceptors. As seen inFIG.2D, for instance, the source-level account lineage report may include source-level account lineage data270indicating one or more source user accounts271(e.g., the first user account of the first operating system, the second user account of the second operating system (as a source to a target application)), one or more target accounts272(e.g., the second user account of the second operating system (as a target from the first user account), the one or more application accounts, one or more target accounts switched based on one or more “executed as” commands), one or more timestamps275(e.g., the first timestamp, the second timestamp), the device information274(e.g., registered account(s) of UCD2150, installed operating system(s), serial number(s) of UCD2150or component(s) of UCD2150, MAC address(es) of network device(s) of UCD2150, IP address(es) used by UCD2150or other wired/wireless communication interface identifiers, a domain name(s) associated with UCD2150, gateway(s) associated with UCD2150, an host platform identification), and one or more command issued273(e.g., one or more “executed as” commands).

The source-level account lineage report may also include information indicating an account lineage chain from a source account to a target account. For example, the source-level account lineage report may include an account lineage from the first user account of the first operating system to a target application account of a target application.

In some embodiments, the source-level account lineage report may include a plurality of account lineage segments. For example, the source-level account lineage report may include a first account lineage segment from an originating account (e.g., the first user account of the first operating system) to a first intermediate account (e.g., the second user account of the second operating system), a second account lineage segment from the first intermediate account (e.g., the second user account of the second operating system) to a second intermediate account (e.g., a third user account switched from the second user account), and a third account lineage segment from the second intermediate account (e.g., the third user account switched from the second user account) to a target account (e.g., a target application account to access distributed database computing platform120). One or more intermediate accounts may be added or omitted based on the number of account-change instances detected by a source-level interceptor.

At step208, administrator computing device130may receive the source-level account change report and analyze the account-change instances. For example, administrator computing device130may analyze the source-level account change report based on previous account-change instances of the same user computing device or previous account-change instances of other computing devices. For instance, the source-level account change report may include one or more account-change instances that are not previously recognized (or atypical) in view of the previous account-change instances, which may be categorized as suspicious account-change instance(s).

FIGS.3A-3Cdepict an illustrative event sequence and notification for controlling access to secure information resources using account lineage tracking and verification involving a plurality of source-level computing devices in accordance with one or more example embodiments. As discussed in greater detail below, the example event sequence illustrated inFIGS.3A-3Bshows how an originating account of UCD3160is tracked via one or more intermediate computing devices (e.g., including ICD1170). Intermediate computing device ICD1170may have a source-level interceptor171, which may be installed based on one or more processes similar to those illustrated inFIGS.2A-2B. Source-level interceptor171may perform one or more processes similar to those discussed above with respect to the source-level interceptor installed on UCD140. Source-level interceptor171may monitor for one or more account-change instances associated with an external computing device, such as UCD3160. For example, source-level interceptor171may track backward to UCD3160and determine that a source user account of UCD3160attempts to access distributed database computing device platform120via ICD1170. For instance, source-level interceptor171may identify a first account-change instance from the source user account of UCD3160to a source user account of ICD1170and may identify a second account-change instance from the source user account of ICD1170to a database application account of ICD1170configured to access distributed database computing device platform120.

FIGS.3A-3Bmay be performed after installing source-level interceptor171on UCD1170. The installation of source-level interceptor171may be performed by one or more processes similar to those illustrated inFIGS.2A-2Bwith respect to UCD1140. Steps301,302, and303may be similar to steps204,205, and206, respectively. At step308, source-level interceptor171may additionally identify an external source user account of UCD3160. One or more source user accounts of UCD3160may be traced as discussed below.

Referring toFIG.3A, at step301, source-level interceptor171of ICD1170may monitor for one or more account-change instances. For example, source-level interceptor171may be installed on ICD1170based on one or more processes similar to those illustrated inFIGS.2A-2B. Source-level interceptor171may monitor for account-change instances in ICD1170based on one or more processes similar to those illustrated inFIG.2C(e.g., step204).

In some embodiments, UCD3160may access ICD1170without an access grant by ICD1170. For instance, UCD3160may illegitimately access ICD1170and may attempt to impersonate one or more source user accounts associated with ICD1170.

At step302, source-level interceptor171may detect one or more source user accounts of ICD1170and an external source user account of UCD3160. For example, source-level interceptor171may detect one or more accounts in ICD1170and an account lineage chain of those detected accounts based on one or more processes similar to those illustrated inFIG.2C(e.g., step205). Source-level interceptor171may also detect use of the external source user account of UCD3160that is linked to one or more of the detected accounts in ICD1170. For instance, a first remote access application account used by UCD3160may gain access to and control of ICD1170by receiving an access grant from a second remote access application account used by ICD1170. The first remote access application account and the second remote access application account may be linked in the account lineage chain of the detected accounts in ICD1170.

In some embodiments, source-level interceptor171may detect one or more network identifiers of UCD3160(e.g., IP address(es) used by UCD3160to communicate with ICD1170, MAC address(es) of UCD3160, etc.). However, source-level interceptor171might not detect one or more account-change instances in UCD3160, and source-level interceptor171might not identify one or more source user accounts, of UCD3160, that can be possibly linked to the first remoted access application account.

At step303, source-level interceptor171may send, to account lineage tracking computing platform110, a first account-change message. For example, the first account-change message may be sent based on one or more processes similar to those illustrated inFIG.2C(e.g., step206). The first account-change message may include information indicating source-level account lineage data similar to source-level account lineage data270illustrated inFIG.2D.

The first account-change message may include information indicating the external source user account of UCD3160(e.g., the first remote access application account) and information indicating an additional account lineage element between the external source user account of UCD3160and one or more source user accounts (e.g., the second remote access application account) of ICD1170. The additional account lineage element may indicate the account-change from the external source user account of UCD3 to the one or more source user accounts of ICD1170.

At step304, account lineage tracking computing platform110may determine that the external source user account of UCD3160is not verified. For example, account lineage tracking computing platform110may analyze the received first account-change message and may identify that the external source user account of UCD3160is linked to one or more source user accounts of ICD1170. Account lineage tracking computing platform110may determine that the external source user account is not verified by checking that a source-level interceptor is not running on a computing device (UCD3160) that is associated with the external source user account and that an account-change message from UCD3160has not been received by account lineage tracking computing platform110.

At step305, account lineage tracking computing platform110may perform an authentication process with UCD3160. For example, account lineage tracking computing platform110may perform the authentication process with UCD3160based on one or more processes similar to those illustrated inFIGS.2A and2B(e.g., steps201and251-255).

In some embodiments, account lineage tracking computing platform110may identify one or more network identifiers (e.g., IP address(es), MAC address(es), domain name(s), etc.) of UCD3160from the first account-change message. For the authentication process, account lineage tracking computing platform110may directly or indirectly communicate with UCD3160based on the identified one or more network identifiers of UCD3160. For instance, account lineage tracking computing platform110may directly communicate with UCD3160or indirectly communicate via ICD1170.

In some embodiments, as seen inFIG.3C, source-level interceptor171of ICD1170may display a notification371that indicates the external source user account of UCD3160is linked to one or more source user accounts of ICD1170. The notification may be displayed on a display of ICD1170and may also be sent to UCD3160. For instance, source-level interceptor171of ICD1170may control the communication channel (e.g., a remote access application associated with the second remote access application account used by ICD1170) between ICD1170and UCD3160to communicate with UCD3160.

In some embodiments, the notification371may be displayed if ICD1170attempts to access distributed database computing platform120. For example, as will be illustrated in more detail below, account lineage tracking computing platform110may receive, from distributed database computing platform120, a database-level account-change message indicating the access attempt from an application account (e.g., a target database application account) of ICD1170to distributed database computing platform120. Source-level interceptor171of ICD1170may detect possible security risk(s) associated with distributed database computing platform120when a source user account of an unverified entity, such as UCD3160, is linked to one or more source user accounts of ICD1170.

At step306, account lineage tracking computing platform110may cause UCD3160to download and install a source-level interceptor. For example, account lineage tracking computing platform110may cause UCD3160to download and install a source-level interceptor based on one or more processes similar to those illustrated inFIG.2A(e.g., step203). UCD3160may be instructed to install the source-level interceptor via ICD1170or via a direct communication with account lineage tracking computing platform110. A duplicate (or a variation) of source-level interceptor171may be sent to UCD3160via ICD170, for example, if the download is indirectly caused via source-level interceptor171of ICD1170.

In some embodiments, the authentication process of step205may be omitted. For example, account lineage tracking computing platform110may require all external computing devices that are connected to (or linked, via an account-change, with) ICD1170to install a source-level interceptor while ICD1170attempts to access distributed database computing platform120. For instance, the source-level interceptor may be a public version (or a non-user specific version) that can be installed on any computing devices that are not authenticated through an authentication process (e.g., the authentication process at step305).

Referring toFIG.3B, at step307, the source-level interceptor installed on UCD3160may monitor for one or more account-change instances occurred in UCD3160. For example, the source-level interceptor installed on UCD3160may monitor for one or more account-change instances occurring in UCD3160based on one or more processes similar to those illustrated inFIG.2C(e.g., step204).

In some embodiments, the source-level interceptor installed on UCD3160may detect one or more past account-change instances that occurred before installation of the source-level interceptor on UCD3160. For instance, the source-level interceptor installed on UCD3160may detect that the first remote access application account used by UCD3160attempted to access one or more source user accounts (e.g., the second remote access application account used by ICD1170).

In some embodiments, the source-level interceptor installed on UCD3160might not detect one or more past account-change instances occurred before installation of the source-level interceptor on UCD3160, for example, if the one or more past account-change instances have been disconnected, expired, and/or unlinked (e.g., UCD3160has logged off from the first remote access application account and its session has been expired).

At step308, the source-level interceptor installed on UCD3160may detect one or more source user accounts of UCD3160and verify an originating account. For example, the source-level interceptor installed on UCD3160may detect one or more source user accounts of UCD3160based on one or more processes similar to those illustrated inFIG.2C(e.g., step205). For instance, the source-level interceptor installed on UCD3160may detect all source user accounts of UCD3160based on the one or more detected account-change instances in UCD3160.

The source-level interceptor installed on UCD3160may also detect one or more external source user accounts associated with the one or more source user accounts of UCD3160. The one or more source user accounts (e.g., the first remote access application account used by UCD3160) of UCD3160may be linked, via an account-change, to a target external account (e.g., the second remote access application account used by ICD1170).

An account lineage from an originating account (e.g., a source user account of UCD3160) to a target account of distributed database computing platform120may show an account lineage from the originating account to a source user account of ICD1170, from the source user account of ICD1170to a database access application account of ICD1170, and from the database access application account of ICD1170to the target account of distributed database computing platform120. As shown inFIG.1A, since the source user account of UCD3160is linked to the source user account of ICD1170to gain access to distributed database computing platform120, the source user account of ICD1170is a target account from the perspective of the source user account of UCD3160, and the source user account of UCD3160is a source account from the perspective of the source user account of ICD1170. Likewise, since the first remote access application account used by UCD3160may be linked to the second remote access application account used by ICD1170to gain access to distributed database computing platform120, the second remote access application account used by ICD1170is a target account from the perspective of the first remote access application account used by UCD3160, and the first remote access application account used by UCD3160is a source account from the perspective of the second remote access application account used by ICD1170.

At step309, the source-level interceptor of UCD3160may send, to account lineage tracking computing platform110, a second account-change message. For example, the second account-change message may be sent based on one or more processes similar to those illustrated inFIG.2C(e.g., step206) orFIG.3A(e.g., step303). The second account-change message may include information indicating source-level account lineage data similar to source-level account lineage data270illustrated inFIG.2D.

In some embodiments, account lineage tracking computing platform110may determine that the first account-change message is associated with the second account-change message. For example, the first account-change message may include information indicating that a first source user account of UCD3160is accessing a second source user account of ICD1170. The first account-change message may also identify the network identifier(s) of UCD3160. The second account-change message may include information indicating that the first source user account of UCD3160is accessing the second source user account of ICD1170. The second account-change message may also identify the network identifier(s) of UCD3160. Further, as described herein, one or more timestamps included in each of the first account-change message and the second account-change message may be compared to determine the association between the first account-change message and the second account-change message.

At step310, account lineage tracking computing platform110may determine that one of the one or more source user accounts of UCD3160is an originating account. For example, the second account-change message may indicate that no additional source user account of another computing device (other than ICD1170) is linked to UCD3160. For instance, UCD3160may be the end node in the account lineage chain among UCD3160, ICD1170, and distributed database computing platform120.

At step311, account lineage tracking computing platform110may generate a source-level account lineage profile. For example, account lineage tracking computing platform110may generate the source-level account lineage profile based on the first account-change message and the second account-change message. The source-level account lineage profile may indicate information of an account lineage from an originating account of UCD3160to one or more source user accounts of ICD1170including a source user account of ICD1170that accesses distributed database computing platform120. For instance, the source-level account lineage profile may include information to indicate source-level portions770of the account lineage illustrated inFIG.7D(from user account1 of UCD3160to App account1, from the App account1 to user account of ICD1170, and from the user account of ICD1170to target DB1 App account1).

At step312, administrator computing device130may receive the source-level account lineage profile. For example, based on the source-level account lineage profile, administrator computing device130may generate (e.g., reproduce) and display account lineage data. For instance, administrator computing device130may reproduce the account lineage data illustrated inFIGS.7A-7D. Administrator computing device130may manage an account lineage profile database and update the account lineage profile database with newly received account lineage data profiles. Based on the account lineage profile database, administrator computing device130may analyze account-change trends at various source levels (and database levels, as discussed in greater detail below).

AlthoughFIGS.3A-3Billustrates only one intermediate computing device, ICD1170, one or more additional intermediate computing devices may exist between distributed database computing platform120and ICD1170. For example, a user of UCD3160may use a source user account of UCD3160to access a database of distributed database computing platform120via a plurality of intermediate computing devices using a plurality of account change instances. As discussed above, UCD3160may access ICD1170. ICD1170may access an intermediate computing device A, which may access an intermediate computing device B. The intermediate computing device B may access distributed database computing platform120. As will be discussed in more detail below, a database-level interceptor of the database of distributed database computing platform120may determine that the intermediate computing device B attempts to access the database of distributed database computing platform120, and cause the intermediate computing device B to install a source-level interceptor. The source-level interceptor of the intermediate computing device B may monitor for one or more account-change instances, determine that the attempt to access the database of distributed database computing platform120is originated from the intermediate computing device A, and cause the intermediate computing device A to install a source-level interceptor. The source-level interceptor of the intermediate computing device A may monitor for one or more account-change instances, determine that the attempt to access the database of distributed database computing platform120is originated from ICD1170, and cause ICD170to install source-level interceptor171. As discussed above, source-level interceptor171may monitor for one or more account-change instances, determine that the attempt to access the database of distributed database computing platform120is originated from UCD3160, and cause UCD160to install a source-level interceptor. The source-level interceptor of UCD 3160may determine that a source user account of UCD 3160is an originating account and report the originating account to account lineage tracking computing platform110.

FIGS.4A-4Ddepict another illustrative event sequence and account lineage data for controlling access to secure information resources using account lineage tracking and verification in accordance with one or more example embodiments. Referring toFIG.4A, account lineage tracking computing platform110may receive a database-level account-change message from distributed database computing platform120and may generate a database-level account lineage profile. At step401, UCD1140may attempt to access one or more target databases of distributed database computing platform120. For example, a user of UCD1140may attempt to access a first database of distributed database computing platform120by logging into a database user account of a database access application configured to access the first database. Distributed database computing platform120may receive a request for accessing the first database from UCD1140via the database access application.

Distributed database computing platform120may detect one or more identifiers associated with the request. For example, distributed database computing platform120may detect one or more network identifiers (e.g., IP address(es), MAC address(es), etc.) associated with UCD1140and may detect the database user account of the database access application. Based on the request and/or the database user account of the database access application, distributed database computing platform120may grant UCD1140to access the first database of distributed database computing platform120.

At step402, a database-level interceptor may detect one or more account-change instances in the first database. For example, each database of distributed database computing platform120may include a database-level interceptor. The database-level interceptor in each database may be configured as a database-specific interceptor in accordance with different syntaxes and database structures. For instance, different databases of distributed database computing platform120may be implemented with different identity configurations and data structures in association with database account changes and switching. Each database-level interceptor may detect an account-change or context switching (e.g., including execution context switching caused by one or more commands such as “execute as”) at a specific database level.

Each database-level interceptor may generate a database-level account-change message based on the one or more database-level account-change instances occurring in the respective database. The database-level account-change message may be in a database agnostic format. For example, a plurality of databases of distributed database computing platform120may have different database syntaxes and database structures, but they may generate account-change messages in the same format. The database-level account-change message may include information indicating database-level account lineage data (e.g., database-level account lineage data490illustrated inFIG.4D). As seen inFIG.4D, for instance, the database-level account lineage data490may indicate one or more source database accounts491(e.g., the database user account to access the first database), one or more target database accounts492(e.g., a database administrator account, one or more target database accounts switched based on one or more “executed as” commands), one or more timestamps495(e.g., a third timestamp associated with a time when the database user account accesses the first database, a fourth timestamp associated with a time when the database user account is switched to another database account), the database information494(e.g., database identifier(s), database version(s), etc.), and one or more command issued493(e.g., one or more “executed as” commands).

At step403, account lineage tracking computing platform110may receive the database-level account-change message from distributed database computing platform120. For example, account lineage tracking computing platform110may receive the database-level account-change message and analyze the information indicating database-level account lineage data. Account lineage tracking computing platform110may analyze account-change messages of a plurality of databases of distributed database computing platform120.

At step404, account lineage tracking computing platform110may generate a database-level account lineage profile based on one or more database-level account change messages. For example, the database-level account lineage profile may indicate information of an account lineage from a database user account to another database account (e.g., a database administrator account). For instance, the database-level account lineage profile may include information to indicate database-level portions771of the account lineage illustrated inFIG.7A(from a target DB1 App account1 to a target DB1 App account2). The target DB1 App account1 may be the database access application account of ICD1170for accessing the first database (e.g., database 1121illustrated inFIG.7A). The target DB1 App account2 may be the database administrator account of the first database. As seen inFIG.7A, a database-level interceptor of database 1121might not be aware of the user account of ICD1170that accessed the target DB1 App account1. Distributed database computing platform120may identify the one or more network identifiers and one or more timestamps (e.g., TS3 indicating a time when the user account of ICD1170accessed the target DB1 App account1). However, distributed database computing platform120might not be aware of one or more source user accounts of ICD1170that are possibly linked to the target DB1 App account1. The account lineage chain between database 1121and ICD1170may be incomplete (e.g., broken) as illustrated inFIG.7Auntil one or more source-level interceptors report one or more source-level account change messages and the one or more source-level account change messages are analyzed by account lineage tracking computing platform110.

At step405, account lineage tracking computing platform110may send the database-level account lineage profile to administrator computing device130. For example, based on the database-level account lineage profile, administrator computing device130may generate (e.g., reproduce) and display account lineage data at the database level. For instance, administrator computing device130may reproduce the account lineage data illustrated inFIGS.7A-7D. Administrator computing device130may manage the account lineage profile database and update the account lineage profile database with newly received database-level account lineage data profiles. Based on the account lineage profile database, administrator computing device130may analyze account-change trends at various database levels.

Account lineage tracking computing platform110may detect an incomplete account lineage chain and cause administrator computing device130to limit (or restrict, ban, deny, etc.) a database access request based on the incomplete account lineage chain. Referring toFIG.4B, at step451, UCD1140may attempt to access a target database of distributed database computing platform120. For example, UCD1140may attempt to access the target database based on an account change. For instance, a user of UCD1140may use a source user account of an operating system of UCD1140and use a database user account of a database application configured to access the target database. Distributed database computing platform120may detect the database user account but might not be aware of the source user account.

At step452, a database-level interceptor of the target database may detect one or more database-level account change instances. For example, the database-level interceptor of the target database may detect an attempt to switch from the database user account to a database administrator account. Distributed database computing platform120may generate a database-level account-change message based on the one or more database-level account change instances detected by the database-level interceptor of the target database.

At step453, account lineage tracking computing platform110may receive the database-level account-change message from distributed database computing platform120. For example, distributed database computing platform120may receive information of the one or more database-level account change instances from the database-level interceptor of the target database. The database-level account-change message may include one or more network identifiers of UCD1140corresponding to its attempts to access the target database.

At step454, account lineage tracking computing platform110may determine a failure of detecting the source user account of UCD1140. For example, UCD1140might not have a source-level interceptor, and might not send a source-level account-change message to account lineage tracking computing platform110.

At step455, account lineage tracking computing platform110may generate a notification indicating an account lineage is incomplete. For example, the notification may indicate that an originating account of a user computing device that requests the database-level account-change instance (e.g., from the database user account to the database administrator account) has not been identified or verified.

At step456, administrator computing device130may receive the notification indicating an account lineage is incomplete and may limit a database access of UCD1140. For example, administrator computing device130may cause distributed database computing platform120to reject the database-level account change (e.g., from the database user account to the database administrator account) and/or limit one or more rights of the database user account in the target database. For instance, the database user account may be locked and might not be used for accessing the target database until the locked account is successfully unlocked based on an authentication process (e.g., the authentication process illustrated inFIGS.2A-2B)

Account lineage tracking computing platform110may detect one or more account-change instances between databases in distributed database computing platform120. Referring toFIG.4C, at step471, UCD1140may access database1121based on a first account change (account-change 1). For example, UCD1140may use a first database application account to access database1121. The first account change may be an account-change from a first source user account (e.g., an originating account) of UCD1140to the first database application account.

At step472, a database-level interceptor1 of database1121of distributed database computing platform120may detect one or more database-level account-change instances in database1121. For example, database-level interceptor1 may detect an account-change instance from the first database application account to a second database account (e.g., a database account configured to access a plurality of databases of distributed database computing platform120).

At step473, database-level interceptor1 of database1121may send a first account-change message indicating the one or more database-level account-change instances. For example, the account-change instance from the first database application account to a second database account may be indicated by the first account-change message. At step474, the second database account accessed by UCD1140may access database2122based on a second account change (account-change 2). Database-level interceptor1 of database1121may also detect the second account change. Database-level interceptor1 of database1121may send another account-change message indicating the second account change. For example, database-level interceptor1 of database1121may indicate that the second database account accesses database 2 based on the second account change.

At step475, a database-level interceptor2 of database2122may detect one or more database-level account-change instances in database2122. For example, database-level interceptor2 may detect the account-change from database1121to database2122using the second database account. At step476, database-level interceptor2 may send a second account-change message indicating the account change from database1121to database2122using the second database account.

At step477, account lineage tracking computing platform110may determine a failure of detecting source user account of UCD1140. As discussed above, account lineage tracking computing platform110may determine that the first account-change message is associated with the second account-change message, based on comparing information included in the first account-change message and the second account-change message (e.g., one or more timestamps, device information, one or more network identifiers, source accounts, target accounts, etc.). Account lineage tracking computing platform110may determine, based on the first account-change message and the second account-change message, an account lineage chain from the first database application account to the second database account that accesses database2122. However, account lineage tracking computing platform110might not detect use of the source user account of UCD1140. For example, UCD1140might not have a source-level interceptor, and account lineage tracking computing platform110might not receive a source-level account-change message associated with the first account-change message or the second account-change message. Account lineage tracking computing platform110may determine an incomplete account lineage chain by determining a failure of detecting the source user account of UCD1140.

At step478, account lineage tracking computing platform110may indicate, to administrator computing device130, that an account lineage chain is incomplete. At step479, administrator computing device130may receive the indication that an account lineage chain is incomplete and may limit access to a database by the first database application account and/or the second database account.

FIG.5depicts another illustrative event sequence for controlling access to secure information resources using account lineage tracking and verification in accordance with one or more example embodiments. One or more processes illustrated inFIG.5may be similar to those discussed above. For example, UCD2150may perform steps502and504, which may be similar to steps308and309, respectively, or may be similar to steps205and206, respectively. For example, distributed database computing platform120may perform steps503and505, which may be similar to steps402and403, respectively. Account lineage tracking computing platform110receives account-change messages both from source-level interceptor(s) (e.g., as shown inFIGS.2A-2C and3A-3B) and database-level interceptors (e.g., as shown inFIGS.4A-4C) to determine a complete account lineage chain.

Referring toFIG.5, at step501, UCD2150may access a target database of distributed database computing platform120based on an account change (e.g., from a source user account of UCD2150to a database user account to access the target database). At step502, source-level interceptor151of UCD2150may detect source-level account-change instances (e.g., the account change from the source user account of UCD2150to a database user account to access the target database). At step503, a database-level interceptor of the target database of distributed database computing platform120may detect database-level account-change instances (e.g., the database user account accessing the target database from an external computing device (UCD2150) and a database-level account change from the database user account to a second database account). At step504, account lineage tracking computing platform110may receive a first account-change message indicating the source-level account change instances. At step505, account lineage tracking computing platform110may receive a second account-change message indicating the database-level account change instances.

At step507, account lineage tracking computing platform110may generate a multi-level account lineage profile based on the first and second account-change messages. For example, the multi-level account lineage profile may include both the source-level account lineage profile illustrated inFIG.3B(e.g., step311) and the database-level account lineage profile illustrated inFIG.4A(e.g., step404). For instance, the multi-level account lineage profile may include information indicating the source-level portions770of the account lineage illustrated inFIG.7D, the database-level portions771of the account lineage illustrated inFIG.7A, and/or the database-level portions772of the account lineage illustrated inFIG.7D. At step508, administrator computing device130may receive the multi-level account lineage profile from account lineage tracking computing platform110. Based on the multi-level account lineage profile, administrator computing device130may determine that the account-lineage chain is complete and the source user account of UCD2150is an originating account. At step509, administrator computing device130may grant one or more rights for the accounts in the complete account lineage chain to allow and/or otherwise enable such accounts to access the target database based on determining that the account-lineage chain is complete.

FIGS.6A-6Bdepict another illustrative event sequence for controlling access to secure information resources using account lineage tracking and verification in accordance with one or more example embodiments. One or more processes illustrated inFIGS.6A-6Bmay be performed, for example, if a user of a user computing device (e.g., UCD4180) having a source-level interceptor installed thereon attempts to access distributed database computing platform120via one or more intermediate computing devices (e.g., ICD2190) that do not have source-level interceptors. One or more processes illustrated inFIGS.6A-6Bmay be similar to those discussed above. As seen inFIG.1A, UCD4180may include a source-level interceptor but ICD2190might not include a source-level interceptor. Account lineage tracking computing platform110may receive a first account-change message from UCD4180and a second account-change message from distributed database computing platform120. Based on the first account-change message and the second account-change message, account lineage tracking computing platform110may determine that UCD4180attempts to access distributed database computing platform120via an intermediate computing device (e.g., ICD2190) that does not have a source-level interceptor. Account lineage tracking computing platform110may identify ICD2190and cause ICD2190to install a source-level interceptor. WhileFIGS.3A-3Billustrate a backward tracking process to identify UCD3160and its originating account,FIGS.6A-6Billustrate a forward tracking process to identify ICD2190and its source user accounts associated with an account lineage chain between UCD4180and distributed database computing platform120.

In some embodiments, UCD4180may use a remote access application to access and control ICD2190. For instance, UCD4180may access ICD2190with an access grant by ICD2190. UCD4180may control one or more computing resources of ICD2190to access a target database of distributed database computing platform120. ICD2190may be a user computing device having a remote access application, a virtualization server configured to be accessed by one or more user computing devices, a cloud computing server, etc.

Referring toFIG.6A, at step601, UCD4180may access a target database, via ICD2190, based on multiple account changes. For example, UCD4180may access ICD2190using a first source user account of UCD4180and may perform a first account change from the first source user account of UCD4180to a second source user account of ICD2190. UCD4180may control ICD2190to perform a second account change from the second source user account of ICD2190to a database user account configured to access a target database of distributed database computing platform120.

At step602, source-level interceptor181of UCD4180may detect one or more account change instances including information of the first source user account of UCD4140and the second source user account of ICD2190. The second account change from the second source user account of ICD2190to the database user account occurring in ICD2190might not be detected.

At step603, a database-level interceptor of the target database of distributed database computing platform120may detect one or more account change instances associated with ICD2190(e.g., the access to the target database using the database user account used via ICD2190, an account change from the database user account to a second database account, etc.).

At step604, account lineage tracking computing platform110may receive a first account-change message indicating the source-level account change instances in UCD4180. At step605, account lineage tracking computing platform110may receive a second account-change message indicating the database-level account change instances in the target database in distributed database computing platform120. However, account lineage tracking computing platform110might not receive an account-change message from ICD2190, which has not installed a source-level interceptor. At step606, account lineage tracking computing platform110may determine that an account lineage chain is incomplete (e.g., account lineage chain is broken at ICD2190), for example, because account lineage tracking computing platform110has not received an account-change message from ICD2190.

A source-level interceptor may be installed on ICD2190to cure the incomplete account chain. Referring toFIG.6B, at step607, account lineage tracking computing platform110(or administrator computing device130) may perform an authentication process with ICD2190. For example, account lineage tracking computing platform110may perform the authentication process with ICD2190, as discussed above. For instance, the authentication process may be based on one or more processes similar to those illustrated inFIGS.2A and2B(e.g., steps201and251-255). At step608, ICD2190may download and install a source-level interceptor. At step609, ICD2190may detect one or more account-change instances in ICD2190.

At step610, the source-level interceptor installed on ICD2190may send a third account-change message. For example, the third account-change message may indicate the second account change from the second source user account of ICD2190to the database user account (and/or any other account change instances in ICD2190associated with the account chain).

At step611, account lineage tracking computing platform110may generate a multi-level account lineage profile. For example, the multi-level account lineage profile may be generated based on the first account-change message, the second account-change message, and the third account change message. The multi-level account lineage profile may indicate that an account lineage chain updated based on the third account-change message is now complete. At step612, administrator computing device130may receive the multi-level account lineage profile.

FIGS.7A-7Ddepict an illustrative information flow associated with one or more account lineage profiles in accordance with one or more example embodiments. Referring toFIG.7A, a first database-level account change instance from source user account0 to target DB1 app account1 may have occurred at a time corresponding to a timestamp TS0. A second database-level account change instance from an unknown source account to target DB1 app account1 may have occurred at a time corresponding to a timestamp TS3 (e.g., the unknown source account accesses database1121using target DB1 app account1 at the time corresponding to TS3). The unknown source account may be a source user account of ICD1170unknown to distributed database computing platform120. A third database-level account change instance from target DB1 app account1 to target DB1 app account2 may have occurred at a time corresponding to a timestamp TS4.

The second database-level account change instance and the third database-level account change instance may be linked to each other based one or more timestamps (e.g., TS3 and TS4), session information (e.g., whether one or more sessions associated with an account is valid or expired). For example, a difference between TS3 and TS4 may be within a threshold time period (e.g., 30 minutes, one hour, three hours, one day, etc.) to link the second database-level account change instance and the third database-level account change to each other. To link the second database-level account change instance and the third database-level account change to each other, the database-level interceptor may determine target DB1 App account1 is still signed in and in an active session when target DB1 app account2 is accessed. Distributed database computing platform120may identify and provide one or more network identifiers of ICD1170and the timestamp TS3 to assist the determination whether to link the second database-level account change instance and the third database-level account change instance to each other.

A source-level interceptor of UCD3160may detect one or more source-level account-change instances in UCD3160. For example, a first source-level account change instance from source user account1 of UCD3160to App account1 may have occurred at a time corresponding to a timestamp TS1. A second source-level account change instance from App account1 to a source user account of ICD1170may have occurred at a time corresponding to a timestamp TS2.

The first source-level account change instance and the second source-level account change instance may be linked to each other based one or more timestamps (e.g., TS1 and TS2), session information (e.g., whether one or more sessions associated with an account is valid or expired). For example, a difference between TS1 and TS2 may be within a threshold time period (e.g., one hour, three hours, one day, etc.) to link the first source-level account change instance and the second source-level account change to each other. To determine the linkage, the source-level interceptor of UCD3160may determine source user account1 is still signed in (and in active sessions) when app account1 is accessed.

A source-level interceptor of ICD1170may detect one or more source-level account-change instances in ICD1170. For example, a third source-level account change instance from App account1 to the source user account of ICD1170may have occurred at a time corresponding to a timestamp TS2. A fourth source-level account change instance from the source user account of ICD1170to target DB1 app account1 may have occurred at a time corresponding to a timestamp TS3.

The third source-level account change instance and the fourth source-level account change instance may be linked to each other based one or more timestamps (e.g., TS2 and TS3), session information (e.g., whether one or more sessions associated with an account is valid or expired). For example, a difference between TS2 and TS3 may be within a threshold time period (e.g., one hour, three hours, one day, etc.) to link the third source-level account change instance and the fourth source-level account change to each other. To determine the linkage, the source-level interceptor of ICD1170may determine app account1 and/or source user account of ICD1170are still signed in (and in active sessions) when target DB1 app account1 is accessed.

The first database-level account change instance might not be linked to other account-change instances illustrated inFIG.7A. For example, source user account0 is not associated with ICD1170or UCD3160and/or TS0 may be too remote (e.g., a difference between TS0 and another timestamp illustrated inFIG.7Amay be greater than the threshold time period). For instance, the session associated with source user account0 may be already expired.

Referring toFIG.7B, account lineage tracking computing platform110may determine whether a first account lineage segment791is associated with a second account lineage segment792. For example, the timestamps TS3 of the first account lineage segment791and the second account lineage segment792may be compared to each other to determine whether the first account lineage segment791and the second account lineage segment792need to be linked. One or more network identifiers of ICD1170associated with the first account lineage segment791and the second account lineage segment792may be compared to each other to determine whether the first account lineage segment791and the second account lineage segment792need to be linked. AlthoughFIG.7Aillustrates that the timestamps TS3 of the first account lineage segment791and the second account lineage segment792are identical, the timestamp of the first account lineage segment791and the timestamp of the second account lineage segment792may be slightly different, for example, a difference between the two timestamps TS3 is within a threshold timing error difference (e.g., 0.1 ms, 1 ms, 1 sec, etc.).

Account lineage tracking computing platform110may link the first account lineage segment791and the second account lineage segment792to each other as part of the same account lineage chain. As seen inFIGS.7B-7C, the unknown source user account of ICD1170for the second account lineage segment792has been updated to source user account of ICD1170based on the first account lineage segment791.

A third account lineage segment793and a fourth account lineage segment794may be linked to each other in a similar way. For example, account lineage tracking computing platform110may compare two timestamps TS2. Account lineage tracking computing platform110may also determine that each of the third account lineage segment793and the fourth account lineage segment794has app account1 as a source account and user account of ICD1170as a target account.

As seen inFIG.7D, a complete multi-level account lineage chain including the source-level portions770and the database-level portions772may be generated by account lineage tracking computing platform110. Account lineage tracking computing platform110may determine that an originating account in the complete multi-level account lineage chain is user account1 of UCD3160and the final target database account in the complete multi-level account lineage chain is target DB1 app account2.

FIGS.8A-8Bdepict another illustrative information flow associated with one or more account lineage profiles in accordance with one or more example embodiments. InFIGS.8A-8B, a database-level interceptor of database1121of distributed database computing platform120may detect a plurality of account-change instances associated with target DB1 App account1. For example, target DB1 App account1 may be accessed by UCD1140(not having a source-level interceptor) and UCD2150(having source-level interceptor151). Account lineage tracking platform110may determine whether a database-level account lineage segment894is associated with a database-level account lineage segment892and a database-level account lineage segment893.

Referring toFIG.8A, account lineage tracking computing platform110may identify a source-level account lineage segment891and database-level account lineage segment892, for example, after receiving one or more account-change messages, as discussed above. For example, a user of UCD2150may use a source user account of UCD2150and launch a database access application. The user of UCD2150may use target DB1 app account1 to access database1121at a time corresponding to a timestamp TS6. While the user of UCD2150is accessing database1121, the database-level interceptor of database1121may detect another database-level account-change instance at a time corresponding to a timestamp TS7, which has an incomplete account lineage chain to an unknown source user account (e.g., a difference between TS6 and TS7 may be less than a threshold time period). Account lineage tracking computing platform110may determine database-level account lineage segment893based on the database-level account-change instance at a time corresponding to a timestamp TS7.

Account lineage tracking computing platform110may identify database-level account lineage segment894and a database-level account lineage segment895, for example, after receiving one or more account-change messages, as discussed above. For example, the database-level interceptor of database1121may detect an account-change instance from target DB1 app account1 to target DB2 app account1 at a time corresponding to TS8. Also, a database-level interceptor of database2122may detect an account-change instance from target DB1 app account1 to target DB2 app account1 at a time corresponding to TS8.

Referring toFIG.8B, account lineage tracking computing platform110may link the database-level account lineage segment894and the database-level account lineage segment895as part of a same account lineage chain. Also, account lineage tracking computing platform110may link the database-level account lineage segment891and the database-level account lineage segment892as part of a same account lineage chain.

Account lineage tracking computing platform110may determine the database-level account lineage segment894may be associated with one or more of the database-level account lineage segment892and/or the database-level account lineage segment893. Account lineage tracking computing platform110may determine that the database-level account lineage segment893may be a suspicious candidate associated with the account lineage segments891,892,894, and895.

Account lineage tracking computing platform110may perform one or more processes based on identifying a suspicious candidate (e.g., the database-level account lineage segment893). For example, account lineage tracking computing platform110may send an alert to administrator computing device130notifying a user of administrator computing device130of the suspicious candidate and its relationship with the account lineage segments891,892,894, and895. The alert may include one or more account lineage profiles so that administrator computing device130can reconstruct one or more account lineage chains and account lineage profiles (e.g., as illustrated inFIGS.8A-8B).

Account lineage tracking computing platform110and/or administrator computing device130may verify whether the database-level account lineage segment893is authorized. For example, account lineage tracking computing platform110may cause UCD1140to install a source-level interceptor to identify the unknown source account of the database-level account lineage segment893. If both the database-level account lineage segment893and the database-level account lineage segment894are authenticated, both the database-level account lineage segment893and the database-level account lineage segment894may be linked to the database-level account lineage segment894. A source-level interceptor may be installed on UCD1140to identify one or more source account-change instances in UCD1140(and additional computing devices associated with UCD1140), and a complete account lineage chain may be generated including one or more source-level account-change instances in UCD1140.

If the database-level account lineage segment894is not authenticated, account lineage tracking computing platform110may cause database1121to terminate a session associated with the database-level account lineage segment893. Account lineage tracking computing platform110may alert such suspicious events to administrator computing device130so that suspicious account-change instances can be updated in the account lineage profile database.

FIG.9depicts one or more illustrative modules for controlling access to secure information resources using an account lineage tracking system in accordance with one or more example embodiments. One or more modules (or sub-modules, functions, and/or processes) illustrated inFIG.9may be implemented by administrator computing device130and/or account lineage tracking computing platform110. Referring toFIG.9, a lineage tracking control module900may include one or more of: a lineage linking910, a use mapping920, and/or an account lineage monitoring930. Lineage linking910may include identifying information included in database-level account-change message and source-level account-change message, identifying and linking account-change instances and/or account lineage segments, and generating one or more account lineage profiles, as discussed above. Use mapping920may include maintaining an entitlement catalog and mapping, based on the entitlement catalog, one or more entitlements for each account in an account lineage chain. Use mapping920may also include identifying one or more accounts in an account lineage chain that are not granted to have one or more rights in distributed database computing platform120. An account lineage monitoring930may include monitoring and analyzing account lineage data (e.g., generating and sending notifications to an access review tool for reviewing account access histories associated with various different account lineage chains, generating and sending notifications to a monitoring tool for monitoring account use histories and/or for a trend analysis). Account lineage monitoring930may also include determining whether account-change instances are usual or unusual in view of historical account-lineage chains and account lineage profiles.

For account lineage monitoring930, a machine learning-based classification model may be implemented. The account lineage profile database may accumulate account lineage profile data and build a baseline data set for machine learning-based training. The machine learning-based classification model may be generated and use the baseline data set. One or more unusual account use patterns and account lineage profiles may be identified and notified to one or more monitoring tools.

One or more aspects of the disclosure may be embodied in computer-usable data or computer-executable instructions, such as in one or more program modules, executed by one or more computers or other devices to perform the operations described herein. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types when executed by one or more processors in a computer or other data processing device. The computer-executable instructions may be stored as computer-readable instructions on a computer-readable medium such as a hard disk, optical disk, removable storage media, solid-state memory, RAM, and the like. The functionality of the program modules may be combined or distributed as desired in various embodiments. In addition, the functionality may be embodied in whole or in part in firmware or hardware equivalents, such as integrated circuits, application-specific integrated circuits (ASICs), field programmable gate arrays (FPGA), and the like. Particular data structures may be used to more effectively implement one or more aspects of the disclosure, and such data structures are contemplated to be within the scope of computer executable instructions and computer-usable data described herein.

Various aspects described herein may be embodied as a method, an apparatus, or as one or more computer-readable media storing computer-executable instructions. Accordingly, those aspects may take the form of an entirely hardware embodiment, an entirely software embodiment, an entirely firmware embodiment, or an embodiment combining software, hardware, and firmware aspects in any combination. In addition, various signals representing data or events as described herein may be transferred between a source and a destination in the form of light or electromagnetic waves traveling through signal-conducting media such as metal wires, optical fibers, or wireless transmission media (e.g., air or space). In general, the one or more computer-readable media may be and/or include one or more non-transitory computer-readable media.

As described herein, the various methods and acts may be operative across one or more computing servers and one or more networks. The functionality may be distributed in any manner, or may be located in a single computing device (e.g., a server, a client computer, and the like). For example, in alternative embodiments, one or more of the computing platforms discussed above may be combined into a single computing platform, and the various functions of each computing platform may be performed by the single computing platform. In such arrangements, any and/or all of the above-discussed communications between computing platforms may correspond to data being accessed, moved, modified, updated, and/or otherwise used by the single computing platform. Additionally or alternatively, one or more of the computing platforms discussed above may be implemented in one or more virtual machines that are provided by one or more physical computing devices. In such arrangements, the various functions of each computing platform may be performed by the one or more virtual machines, and any and/or all of the above-discussed communications between computing platforms may correspond to data being accessed, moved, modified, updated, and/or otherwise used by the one or more virtual machines.

Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one or more of the steps depicted in the illustrative figures may be performed in other than the recited order, and one or more depicted steps may be optional in accordance with aspects of the disclosure.