Method and system for evaluating access granted to users moving dynamically across endpoints in a network

摘要

A network analysis tool is provided in support of a data communication network having user devices at indeterminate endpoints wherein user identities, namely, the collection of meta-data about a user device of a network (beyond the conventional networking concept of an endpoint address), is modeled as fixed endpoints for purposes of tracking. More specifically, users at indeterminate endpoints are identified by modeling using user roles as models of the user devices.

主权项

1. A data processing system for modeling access of users to a real data communication network comprising:
a processing element; random access memory for nonvolatile storage for a program set for modeling and for data associated with the modeling; at least one input interface device for receiving configuration information about the real network; said program set including a model of a portion of the real network, the model including a representation of an identity enforcement device and an element for modeling, as network locations, user roles of user devices of real users at indeterminate endpoints in the real network, the model being configured to determine access that has been or is granted between members of the user roles and the model of the portion of the real network; and an output interface device for extracting information from the model.