Automatic reduction of permissions for client applications
AssigneeMicrosoft Technology Licensing, LLC
InventorsJEFFREY THOMAS SAKOWICZ, BENJAMIN R VINCENT
Life of this patent
Estimating the term…
Abstract
A least-privilege permission or permissions is automatically assigned to a client application in order to ensure that the client application is able to perform the bare minimum actions on a resource. The client application accesses the protected resource using a web API. The determination of the least-privilege permission(s) is based on actions previously performed on the resource by the client application. The identity provider monitors the actions performed on a resource by the client application and determines the bare minimum permission needed for the client application.
Claims20
A system comprising:
- one or more processors;
- and a memory;
- one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions that:
- provide a client application a permission to access a protected resource hosted by a multi-tenant cloud service;
- track requests made by the client application to access the protected resource;
- determine from the tracked requests a bare minimum permission needed to implement actions found in the tracked requests;
- and
- reconfigure the client application with the bare minimum permission.
A device, comprising:
- at least one processor and a memory;
- wherein the at least one processor is configured to:
- provide a client application with an access token, the access token including a permission that allows a plurality of operations to be performed on a resource hosted by a multi-tenant cloud service;
- track operations performed on the resource made through one or more web application programming interface (API) calls to the resource, wherein the one or more web API calls include the access token;
- and
- based on the tracked operations, determine a bare minimum permission for the client application, wherein the bare minimum permission reduces a number of the plurality of operations authorized to be performed on the resource.
A method, comprising:
- receiving, at a computing device having a processor and a memory, a request for an access token, the access token including a first permission that allows the client application to perform one or more operations on the protected resource;
- tracking the operations performed on the protected resource by the client application;
- determining a bare minimum permission for the client application based on the tracked operations;
- and
- reconfiguring the first permission to include only the bare minimum permission.
Dependencies are inferred from the claim text.