US 10,853,350 B1Granted

System for associating data policies with data objects

AssigneeAmazon Technologies, Inc.

InventorNima Sharifi Mehr

Life of this patent

Estimating the term…

Loading patent…

Abstract

Described are techniques for determining a data policy suitable for association with a data object based on the data access pattern for the data object. Correspondence between the data access pattern of the data object and pattern data, indicative of data access patterns stored in association with data policies, may be determined. Based on the correspondence between the data access pattern of the data object and a particular data access pattern of the pattern data, the data policy associated with the particular data access pattern may be suitable for use with the data object. A set of suitable data policies may be refined based on the content or metadata associated with the data object and the code or deployment status of services that access the data object. Once the access pattern for a data object is known, subsequent interactions with the data object may be analyzed to identify anomalous traffic.

Claims20

Dependent claims

A system comprising:

one or more memories storing computer-executable instructions;
and
one or more hardware processors configured to execute the computer-executable instructions to:
access a data access log corresponding to a data object;
determine a first data access pattern from the data access log, wherein the first data access pattern is indicative of:
one or more services accessing the data object;
at least one time corresponding to access of the data object by the one or more services;
and
one or more types of interaction corresponding to the access of the data object by the one or more services;
access pattern data including a plurality of data access patterns associated with a plurality of data policies;
determine that the first data access pattern of the data object matches at least a portion of a second data access pattern of the pattern data within a threshold value;
based on the first data access pattern matching the at least a portion of the second data access pattern, determine one or more data policies that correspond to the at least a portion of the second data access pattern of the pattern data;
output at least a subset of the one or more data policies;
receive user input indicative of a particular data policy;
associate the particular data policy with the data object, wherein the particular data policy includes one or more control actions to be taken with regard to the data object at one or more times;
determine an attempt to access the data object;
determine that the attempt to access the data objects deviates from a particular data access pattern that corresponds to the particular data policy by at least a threshold amount;
and
in response to the attempt deviating from the particular data access pattern, modify one or more security features associated with the data object.

16 more elements

A method comprising:

determining, at a first time, a first portion of a first data access pattern of a data object, wherein the first data access pattern is indicative of one or more of:
identifiers, times, or types of interaction corresponding to access of the data object;
accessing pattern data, wherein the pattern data associates a plurality of data access patterns with a plurality of data policies;
determining first correspondence between the first portion of the first data access pattern and at least one second data access pattern of the pattern data, wherein the first correspondence is less than a threshold confidence level;
determining, at a second time subsequent to the first time, a second portion of the first data access pattern of the data object;
determining second correspondence between the second portion of the first data access pattern and the at least one second data access pattern of the pattern data, wherein the second correspondence is greater than the threshold confidence level;
determining, based on the pattern data, a particular data policy of the plurality of data policies that is associated with the at least one second data access pattern;
based at least partially on the second correspondence, associating the particular data policy with the data object, wherein the particular data policy includes one or more control actions to be taken with regard to the data object at one or more times;
determining an attempt to access the data object;
determining that the attempt to access the data object deviates from a particular data access pattern associated with the particular data policy;
and
performing a control action in response to the attempt deviating from the particular data access pattern.

9 more elements

A system comprising:

one or more memories storing computer-executable instructions;
and
one or more hardware processors configured to execute the computer-executable instructions to:
determine a first data access pattern of a data object;
access pattern data that associates a plurality of data access patterns with a plurality of data policies;
determine correspondence between the first data access pattern of the data object and at least one second data access pattern of the pattern data, wherein the correspondence is within a threshold confidence value;
determine, based on the pattern data, one or more data policies that are associated with the at least one second data access pattern of the pattern data;
based on the correspondence between the first data access pattern and the at least one second data access pattern, associate a particular data policy of the one or more data policies with the data object, wherein the particular data policy includes one or more control actions to be taken with regard to the data object at one or more times;
determine an attempt to access the data object;
determine that the attempt deviates from a particular data access pattern associated with the particular data policy;
and
perform a control action in response to the attempt deviating from the particular data access pattern.

9 more elements

Dependencies are inferred from the claim text.