# US 12,762,254 B2 · Detection of over-privileged access permissions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,254 B2 - Document ID: US12762254B2 - Status: Granted - Kind: B2 - Application number: 17/333,425 - Filed: 2021-05-28 - Published: 2022-12-01 - Granted: 2026-10-13 - Earliest claimed: 2021-05-28 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Matthew A. Ghiold; Gavin McGrew; Devon Powley; Christopher Schultz - Web page: https://patentgrep.com/patent/US12762254B2 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed herein are system, method, and computer program product embodiments for evaluating whether or not a role has an over-privileged access permission contained in a set of effective access permissions to a system resource defined in a first security policy and a second security policy. The method includes comparing a scope of a name for the system resource defined in the first security policy with a permissible scope of the name for the system resource defined by a security rule to obtain a first comparison result; and comparing a scope of a name for the role defined in the second security policy with a permissible scope of the name for the role defined by the security rule to obtain a second comparison result. The method further includes determining, based on the first comparison result and the second comparison result, whether or not the role has the over-privileged access permission. ## Claims ### Claim 1 A computer-implemented method performed by a system, the method comprising: evaluating, by one or more computing devices, whether a name of a system resource defined in a first security policy is an allowable name for the system resource defined by a security rule to obtain a first evaluation result; evaluating, by the one or more computing devices, whether a name of a role defined in a second security policy is an allowable name for the role defined by the security rule to obtain a second evaluation result; determining, by the one or more computing devices, that the role has an over-privileged access permission contained in a set of effective access permissions based on the first evaluation result and the second evaluation result; identifying, by the one or more computing devices and based on the determining, a third security policy, related to the first security policy and the second security policy, that would also generate the over-privileged access permission, wherein the identifying is performed before requesting access to the system resource using the over-privileged access permission; labeling, by the one or more computing devices, the first security policy, the second security policy, and the third security policy as non-compliant; and restricting, by the one or more computing devices, the role from transmitting requests for system resources in response to labeling the first security policy, the second security policy, and the third security policy as non-compliant. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: generating, by the one or more computing devices, a remediation security policy for correcting the first security policy or the second security policy including the name of the system resource or the name of the role; and transmitting, by the one or more computing devices, to an entity that administers the role, an indication of the remediation security policy. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: generating, by the one or more computing devices, a notification to indicate that the first security policy, the second security policy, and the third security policy are not compliant when the name of the system resource is not an allowable name for the system resource defined by the security rule or when the name of the role is not an allowable name for the role defined by the security rule. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the first security policy and the second security policy are stored in a cloud storage. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the first security policy and the second security policy are specified by one or more statements in a markup language. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the set of effective access permissions comprises one or more of: an identity-based policy, a resource-based policy, a permissions boundary, an organizational service control policy (SCP), an access control list, and a session policy. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the first security policy or the second security policy includes an action statement specifying a list of actions to be performed on the system resource and an effect statement indicating whether the policy allows or denies access. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the action statement includes a read-only action, a view action, an update action, a write action, or a delete action. ### Claim 9 An apparatus for managing system resources, the apparatus comprising: a storage device configured to store a security rule; and a processor communicatively coupled to the storage device and configured to perform operations comprising: evaluating whether a name of a system resource defined in a first security policy is an allowable name for the system resource defined in the security rule to obtain a first evaluation result; evaluating whether a name of a role defined in a second security policy is an allowable name for the role defined by the security rule to obtain a second evaluation result; determining whether the role has an over-privileged access permission contained in a set of effective access permissions based on the first evaluation result and the second evaluation result; identifying, based on the determining, a third security policy, related to the first security policy and the second security policy, that would also generate the over-privileged access permission, wherein the identifying is performed before requesting access to the system resource using the over-privileged access permission; labeling the first security policy, the second security policy, and the third security policy as non-compliant; and restricting the role from transmitting requests for system resources in response to labeling the first security policy, the second security policy, and the third security policy as non-compliant. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the operations further comprise: generating a remediation security policy for correcting the first security policy or the second security policy including the name of the system resource or the name of the role; and transmitting, to an entity that administers the role, an indication of the remediation security policy. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the operations further comprise: generating a notification to indicate that the first security policy, the second security policy, and the third security policy are not compliant when the name of the system resource is not an allowable name for the system resource defined by the security rule or when the name of the role is not an allowable name for the role defined by the security rule. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the first security policy and the second security policy are stored in a cloud storage. ### Claim 13 (depends on 9) The apparatus of claim 9, wherein the first security policy and the second security policy are specified by one or more statements in a markup language. ### Claim 14 (depends on 9) The apparatus of claim 9, wherein the set of effective access permissions comprises one or more of: an identity-based policy, a resource-based policy, a permissions boundary, an organizational service control policy (SCP), an access control list, or a session policy. ### Claim 15 (depends on 9) The apparatus of claim 9, wherein the first security policy or the second security policy includes an action statement specifying a list of actions to be performed on the system resource and an effect statement indicating whether the policy allows or denies access. ### Claim 16 A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising: evaluating whether a name of a system resource defined in a first security policy is an allowable name for the system resource defined in a security rule to obtain a first evaluation result; evaluating whether a name of a role defined in a second security policy is an allowable name for the role defined in the security rule to obtain a second evaluation result; determining whether the role has an over-privileged access permission contained in a set of effective access permissions based on the first evaluation result and the second evaluation result; identifying, based on the determining, a third security policy, related to the first security policy and the second security policy, that would also generate the over-privileged access permission, wherein the identifying is performed before requesting access to the system resource using the over-privileged access permission; labeling the first security policy, the second security policy, and the third security policy as non-compliant; and restricting the role from transmitting requests for system resources in response to labeling the first security policy, the second security policy, and the third security policy as non-compliant. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the operations further comprise: generating a notification to indicate that the first security policy, the second security policy, and the third security policy are not compliant when the name of the system resource is not an allowable name for the system resource defined by the security rule or when the name of the role is not an allowable name for the role defined by the security rule. ### Claim 18 (depends on 16) The non-transitory computer-readable medium of claim 16, the operations further comprising: generating a remediation security policy for correcting the first security policy or the second security policy including the name for the system resource or the name for the role; and sending, to an entity that administers the role, an indication of the remediation security policy.