Back to results
US 10,122,757 B1Granted
Self-learning access control policies
AssigneeAmazon Technologies, Inc.
InventorsWilliam Frederick Hingle Kruse, Ashish Rangole, James E. Scharf, Jr., Kai Zhao, Jeffrey John Wierer
Life of this patent
Estimating the term…
Abstract
Techniques for self-learning access control policies are disclosed herein. A set of security policy modification recommendations is produced based on set of effective permissions and also based on a set of requests for access subject to that set of effective permission. Each policy modification recommendation is configured to alter the set of effective permissions by performing one or more actions altering one or more of the effective permissions. A selected policy modification recommendation is provided that is configured to produce a modified set of effective permissions.
Claims23
A computer-implemented method, comprising:
- obtaining, at a policy management service, an access control policy associated with a user of a computing resource service provider, the access control policy having a corresponding set of effective permissions associated with one or more resources of the computing resource service provider;
- obtaining usage history information generated as a result of a plurality of previously submitted requests for access to the one or more resources that implicate the access control policy, the usage history information comprising an indication of one or more outcomes of the plurality of previously submitted requests;
- producing a set of policy modification recommendations based at least in part on a comparison of the usage history information to the access control policy, each policy modification recommendation of the set of policy modification recommendations specifying an alteration to the set of effective permissions;
- selecting a policy modification recommendation from the set of policy modification recommendations;
- altering the access control policy in accordance with the selected policy modification recommendation by at least removing an unnecessary permission or adding a missing permission to the access control policy to produce a modified access control policy;
- presenting the modified access control policy to the policy management service to cause the access control policy to be replaced by the modified access control policy;
- and
- controlling access to at least one of the one or more resources using the modified access control policy.
5 more elements
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
- determine a set of effective permissions, each effective permission of the set of effective permissions corresponding to a right of a principal to perform an action in connection with a resource of one or more resources;
- obtain usage history information generated as a result of a plurality of previously submitted requests for access to the one or more resources that implicate the set of effective permissions, the usage history information comprising an indication of one or more outcomes of the plurality of previously submitted requests;
- produce, based at least in part on comparing the obtained usage history information to the set of effective permissions, a set of permission modification recommendations, each permission modification recommendation of the set of permission modification recommendations specifying an alteration to the set of effective permissions;
- provide a subset of the set of permission modification recommendations;
- apply the subset of the set of permission modification recommendations to the set of effective permissions by at least removing an unnecessary permission or adding a missing permission to produce a modified set of effective permissions;
- presenting the modified set of effective permissions to cause a policy management service to replace the set of effective permissions with the modified set of effective permissions;
- and
- control access to the one or more resources using the modified set of effective permissions.
5 more elements
A system, comprising:
- one or more machine-readable mediums having stored thereon a set of instructions, which if performed by one or more processors, cause the system to at least:
- obtain usage history information indicating requests for access to one or more resources associated with a first user of the system, the usage history information comprising an indication of one or more outcomes of the requests for access to the one or more resources;
- produce a set of permission modification recommendations based at least in part on comparing a set of effective permissions to the obtained usage history information, each permission modification recommendation of the set of permission modification recommendations specifying an alteration to one or more permissions of the set of effective permissions;
- select a permission modification recommendation from the set of permission modification recommendations, the selected permission modification recommendation specifying one or more modifications to a subset of the set of effective permissions;
- apply the selected permission modification recommendation to the set of effective permissions by at least removing an unnecessary permission or adding a missing permission to produce a modified set of effective permissions;
- and
- present the modified set of effective permissions to a policy management service to cause access to the one or more resources to be controlled using the modified set of effective permissions.
4 more elements
Dependencies are inferred from the claim text.