Back to results
US 11,537,720 B1Granted
Security configuration optimizer systems and methods
AssigneeHashiCorp
InventorsJonathan James Currey, Robert Earle McKinstry, III, Armon Memaran Dadgar
Life of this patent
Estimating the term…
Abstract
Security configuration optimizer system and methods create optimized access control policies. The systems and methods analyze constraints on the secured system and produce a plurality of proposals for an updated security configuration. The proposals are analyzed and filtered. A resulting set of proposals are graded or ranked according to a variety of desirable outcomes. A proposal is selected according to criteria based on the balance of security and complexity. The security configuration is updated according to the selected proposal.
Claims20
A computer implemented method for configuring a secured system, the method comprising:
- generating a first plurality of proposals for a security configuration for the secured system, each proposal in the first plurality including required privileges for accessing the secured system by at least one principal, at least one proposal of the first plurality having only required privileges and remaining proposals of the first plurality having required privileges and optional privileges;
- scoring each proposal in the first plurality of proposals, a score to indicate a proposal fitness, the proposal fitness representing a level of risk to the security configuration according to the optional privileges;
- filtering the first plurality of proposals according to the proposal fitness of each proposal to produce a second plurality of proposals, where proposals in the second plurality are fewer in number than proposals in the first plurality;
- evaluating, using proposal metrics related to the proposal fitness, each proposal in the second plurality of proposals for risk and complexity to produce a third plurality of proposals;
- and
- selecting a proposal from the third plurality of proposals to implement in the secured system, the selected proposal representing maximal access by the at least one principal with minimal risk to the secured system, where the selected proposal from the third plurality of proposals includes only required privileges for the at least one principal and no optional privileges, and the selection is executed using one or more fork trees among the third plurality of proposals, each of the one or more fork trees being used to define a first set of the third plurality of proposals, score each proposal in the first set of the third plurality of proposals based on a policy included in each proposal, randomly choose two of the third plurality of proposals to be compared, choose one of the two of the third plurality of proposals for evaluation against a next proposal of the third plurality of proposals, and select the proposal from the third plurality of proposals according to the score to implement in the secured system.
3 more elements
A non-transitory computer-readable storage medium storing a computer program, that when executed by at least one processor causes the at least one processor to perform a method for configuring a secured system, the method comprising:
- generating a first plurality of proposals for a security configuration for the secured system, each proposal in the first plurality including required privileges for accessing the secured system by at least one principal, at least one proposal of the first plurality having only required privileges and remaining proposals of the first plurality having required privileges and optional privileges;
- scoring each proposal in the first plurality of proposals, score to indicate proposal fitness, the proposal fitness representing a level of risk to the security configuration according to the optional privileges;
- filtering the first plurality of proposals according to the proposal fitness of each proposal to produce a second plurality of proposals, where proposals in the second plurality are fewer in number than proposals in the first plurality;
- evaluating, using the proposal scores related to the proposal fitness, each proposal in the second plurality of proposals for risk and complexity to produce a third plurality of proposals;
- and
- selecting a proposal from the third plurality of proposals to implement in the secured system, the selected proposal representing maximal access by the at least one principal with minimal risk to the secured system, where the selected proposal from the third plurality of proposals includes only required privileges for the at least one principal and no optional privileges, and the selection is executed using one or more fork trees among the third plurality of proposals, each of the one or more fork trees being used to define a first set of the third plurality of proposals, score each proposal in the first set of the third plurality of proposals based on a policy included in each proposal, randomly choose two of the third plurality of proposals to be compared, choose one of the two of the third plurality of proposals for evaluation against a next proposal of the third plurality of proposals, and select the proposal from the third plurality of proposals according to the score to implement in the secured system.
3 more elements
Dependencies are inferred from the claim text.