Back to results
US 11,768,699 B2Granted
Enforce changes in session behavior based on updated machine learning model with detected risk behavior during session
AssigneeMicrosoft Technology Licensing, LLC
InventorsAlexander Esibov, Itamar Azulay
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided for managing dynamic controls over access to computer resources and, even more particularly, for evaluating and re-evaluating dynamic conditions and changes associated with user sessions. The systems and methods are configured to automatically make a determination as to whether new or additional authentication credentials are required for a user that is already authorized for accessing resources in a user session, in response to triggering events such as the identification of a new or changed condition associated with the user session.
Claims17
A system that dynamically controls access to computer resources and that determines when new credential information is warranted for granting access, said system comprising:
- a storage;
- a conditional access engine;
- one or more tenant session managers;
- a machine learning engine;
- one or more processors;
- and
- one or more physical computer-readable storage media that store instructions that are executable by the one or more processors to cause the system to:
- cause the conditional access engine to access one or more policies associated with one or more computer resources of a particular tenant, the one or more policies configured to enforce access permissions of the one or more computer resources based on one or more user credentials and one or more triggering events, the one or more triggering events comprising a triggering event based on evaluating a first condition associated with a comparison between behavior of a user in a current user session and behavior of the user in prior user sessions, wherein a third party information source connected to the system provides information related to the behavior of the user in the prior sessions, and wherein the one or more policies are stored in the storage;
- cause the conditional access engine to receive user credentials from the user for requesting access to a particular computer resource of the one or more computer resources of the particular tenant;
- in response to verifying the received user credentials based on the one or more policies, cause the conditional access engine to establish a user session and provide the user access to the particular computer resource;
- cause one of the conditional access engine or the one or more tenant session managers to monitor events associated with the particular computer resource occurring during the user session;
- in response to detecting at least one triggering event among the one or more triggering events associated with a change in a second condition relating to a machine learning model associated with the user session, cause the conditional access engine to reevaluate the user session based on the one or more policies, wherein the machine learning model is updated by the machine learning engine, wherein the machine learning engine updates the machine learning model based on a detected risk behavior, and wherein, when the machine learning model is updated based on the detected risk behavior, a risk profile for the user session increases;
- based on the reevaluation, cause the conditional access engine to dynamically determine whether new user credentials are required to provide the user continued access to the particular computer resource;
- and
- upon determining that the new user credentials are not required, cause the conditional access engine to continue to provide access to the particular computer resource, or alternatively,
- upon determining that the new user credentials are required:
- cause the one or more tenant session managers to suspend the granted access to the particular computer resource while maintaining session state for the user session;
- cause the conditional access engine to request the new user credentials from the user;
- and
- upon obtaining the new user credentials, cause the one or more tenant session managers to unsuspend the granted access to the particular computer resource.
17 more elements
A method for dynamically controlling access to one or more computer resources accessible to a computing system and for dynamically determining when new credential information is needed for granting access to the one or more computer resources in a previously established and authorized user session between a user and the computing system, which includes a storage, a conditional access engine, one or more tenant session managers, and a machine learning engine, the method comprising:
- causing the conditional access engine to access one or more policies associated with the one or more computer resources of a particular tenant, the one or more policies configured to enforce access permissions of the one or more computer resources based on one or more user credentials and one or more triggering events, the one or more triggering events comprising a triggering event based on evaluating a first condition associated with a comparison between behavior of a user in a current user session and behavior of the user in prior user sessions, wherein a third party information source connected to the computer system provides information related to the behavior of the user in the prior sessions, and wherein the one or more policies are stored in the storage;
- causing the conditional access engine to receive user credentials from the user for requesting access to a particular computer resource of one or more computer resources of the particular tenant;
- in response to verifying the received user credentials based on the one or more policies, causing the conditional access engine to establish a user session and to provide the user access to the particular computer resource;
- causing one of the conditional access engine or the one or more tenant session managers to monitor events associated with the particular computer resource occurring during the user session;
- in response to detecting at least one triggering event among the one or more triggering events associated with a change to a second dynamic condition relating to a machine learning model associated with the user session, causing the conditional access engine to reevaluate the user session based on the one or more policies, wherein the machine learning model is updated by the machine learning engine, wherein the machine learning engine updates the machine learning model based on a detected risk behavior, and wherein, when the machine learning model is updated based on the detected risk behavior, a risk profile for the user session increases;
- based on the reevaluation, causing the conditional access engine to dynamically determine whether new user credentials are required to authorize and to continue granting the user access to the particular computer resource;
- and
- upon determining that new user credentials are not required, causing the conditional access engine to continue to provide access to the computer resources, or alternatively,
- upon determining that the new user credentials are required:
- cause the one or more tenant session managers to terminate or suspend the granted access to the particular computer resource, while maintaining session state for the user session;
- cause the conditional access engine to request the new user credentials from the user;
- and
- upon obtaining the new user credentials, cause the one or more tenant session managers to unsuspend the granted access to the particular computer resource.
10 more elements
A physical computer-readable storage media having stored thereon computer-executable instructions that are executable by one or more processors of a system to dynamically control access to one or more computer resources accessible to the system and to dynamically determine when new credential information is needed for granting access to the computer resources, the system comprising a storage, a conditional access engine, one or more tenant session managers, and a machine learning engine, the system being configured to:
- cause the conditional access engine to access one or more policies associated with the one or more computer resources of a particular tenant, the one or more policies configured to enforce access permissions of the one or more computer resources based on one or more user credentials and one or more triggering events, the one or more triggering events comprising a triggering event based on evaluating a first condition associated with a comparison between behavior of a user in a current user session and behavior of the user in prior user sessions, wherein a third party information source connected to the system provides information related to the behavior of the user in the prior sessions, and wherein the one or more policies are stored in the storage;
- cause the conditional access engine to receive user credentials from the user for requesting access to a particular computer resource of one or more computer resources of the particular tenant;
- in response to verifying the received user credentials based on the one or more policies, cause the conditional access engine to establish a user session and provide the user access to the particular computer resource;
- cause one of the conditional access engine or the one or more tenant session managers to monitor events associated with the particular computer resource occurring during the user session;
- in response to detecting at least one triggering event among the one or more triggering events associated with a change in a second condition relating to a machine learning model that is associated with the user session, cause the conditional access engine to reevaluate the user session based on the one or more policies, wherein the machine learning model is updated by the machine learning engine, wherein the machine learning engine updates the machine learning model based on a detected risk behavior, and wherein, when the machine learning model is updated based on the detected risk behavior, a risk profile for the user session increases;
- based on the reevaluation, cause the conditional access engine to dynamically determine whether new user credentials are required to authorize and to continue granting access to the particular computer resource;
- upon determining that new user credentials are not required, cause the conditional access engine to continue to provide access to the particular computer resource, or alternatively,
- upon determining that the new user credentials are required:
- cause the one or more tenant session managers to suspend the granted access to the particular computer resource, while maintaining session state for the user session;
- cause the conditional access engine to request the new user credentials from the user;
- and
- upon obtaining the new user credentials, cause the one or more tenant session managers to unsuspend the granted access to the particular computer resource.
9 more elements
Dependencies are inferred from the claim text.