# US 2022/0345484 A1 · Zero trust architecture for networks employing machine learning engines > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0345484 A1 - Document ID: US20220345484A1 - Status: Published application - Kind: A1 - Application number: 17/724,071 - Filed: 2022-04-19 - Published: 2022-10-27 - Earliest claimed: 2021-04-21 - Assignees: Andro Computation Solutions - Applicants: ANDRO Computation Solutions, LLC - Inventors: Andrew Louis Drozd; Jithin Jagannath; Anu Jagannath; Keyvan Ramezanpour - Web page: https://patentgrep.com/patent/US20220345484A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04W 4/40: for vehicles, e.g. vehicle-to-pedestrians [V2P] - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/092: Reinforcement learning - G06N 3/094: Adversarial learning - G06N 3/098: Distributed learning, e.g. federated learning - H04L 63/10: {for controlling access to devices or network resources} - H04W 12/08: Access security - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - H04W 12/66: {Trust-dependent, e.g. using trust scores or trust relationships} - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - G06N 3/044: Recurrent networks, e.g. Hopfield networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system for governing access to a network environment, including: at least one communication node communicatively coupled to a network infrastructure; a network assurance agent configured to monitor the at least one communication node, wherein the network assurance agent performs actions including: generating, in response to an access request for a network resource from the at least one communication node, an environmental model of the at least one communication node relative to the network environment, wherein the environmental model includes operational data of the at least one communication node or at least one other communication node in the network environment, calculating a risk score for the at least one communication node via a machine learning algorithm, based on the environmental model, and granting or denying the access request based on the risk score. ## Claims ### Claim 1 A system for governing access to a network environment, the system comprising: at least one communication node communicatively coupled to a network infrastructure; a network assurance agent configured to monitor the at least one communication node, wherein the network assurance agent performs actions including: generating, in response to an access request for a network resource from the at least one communication node, an environmental model of the at least one communication node relative to the network environment, wherein the environmental model includes operational data of the at least one communication node or at least one other communication node in the network environment; calculating a risk score for the at least one communication node via a machine learning algorithm, based on the environmental model; and granting or denying the access request based on the risk score. ### Claim 2 (depends on 1) The system of claim 1, wherein the network assurance agent is further configured to: calculate an error score for the granting or denying of the access request; and modify the machine learning algorithm in response to the error score exceeding a threshold value. ### Claim 3 (depends on 1) The system of claim 1, wherein the network assurance agent is further configured to identify an anomalous activity in the at least one communication node in the network environment, wherein granting or denying the access request is further based on the identified anomalous activity. ### Claim 4 (depends on 1) The system of claim 1, wherein the machine learning algorithm is included on each communication node. ### Claim 5 (depends on 1) The system of claim 1, wherein the machine learning algorithm includes a graph neural network (GNN) for calculating the risk score. ### Claim 6 (depends on 1) The system of claim 1, wherein the machine learning algorithm is further configured to generate the environmental model based on a communication objective of the at least one communication node. ### Claim 7 (depends on 1) The system of claim 1, wherein the network assurance agent further comprises a module on the at least on communication node that is configured to: analyze network traffic targeting the at least one communication node; and determine a trust score for the network environment, wherein the risk score is at least partially calculated based on the trust value. ### Claim 8 (depends on 1) The system of claim 1, wherein the network infrastructure includes an open radio access network (O-RAN). ### Claim 9 (depends on 8) The system of claim 8, wherein the O-RAN includes a near real-time (RT) RAN intelligent controller (RIC), and wherein the risk score is calculated by a component of the network assurance agent that is deployed in the near-RT RIC controller or as an application interacting with the near-RT RIC controller. ### Claim 10 (depends on 9) The system of claim 9, wherein the O-RAN further includes a non-RT RIC, and wherein the granting or denying of the access request based on the risk score is implemented by a component of the network assurance agent that is deployed in the non-RT RIC controller or as an application interacting with the non-RT RIC controller. ### Claim 11 (depends on 1) The system of claim 1, wherein the network infrastructure includes a multi-access edge computing (MEC) architecture deployed in a local area data network (LADN). ### Claim 12 A method for governing access to a network environment including at least one communication node communicatively coupled to a network infrastructure, comprising: generating, in response to an access request for a network resource from the communication node, an environmental model of the at least one communication node relative to the network environment, wherein the environmental model includes operational data of the at least one communication node or at least one other communication node in the network environment; calculating a risk score for the at least one communication node via a machine learning algorithm, based on the environmental model; and granting or denying the access request based on the risk score. ### Claim 13 (depends on 12) The method of claim 12, wherein the method further comprises: calculating an error score for the granting or denying of the access request; and modifying the machine learning algorithm in response to the error score exceeding a threshold value. ### Claim 14 (depends on 12) The method of claim 12, wherein the method further comprises identifying an anomalous activity in the at least one communication node in the network environment, wherein granting or denying the access request is further based on the identified anomalous activity. ### Claim 15 (depends on 12) The method of claim 12, wherein the machine learning algorithm is included on each communication node. ### Claim 16 (depends on 12) The method of claim 12, wherein the machine learning algorithm includes a graph neural network (GNN) for calculating the risk score. ### Claim 17 (depends on 12) The method of claim 12, wherein the machine learning algorithm is further configured to generate the environmental model based on a communication objective of the at least one communication node. ### Claim 18 (depends on 12) The method of claim 12, further comprising: providing a module on the at least on communication node that is configured to: analyze network traffic targeting the at least one communication node; and determine a trust score for the network environment, wherein the risk score is at least partially calculated based on the trust value. ### Claim 19 (depends on 12) The method of claim 12, wherein the network infrastructure includes an open radio access network (O-RAN), and wherein: the risk score is calculated by a module that is deployed in a near real-time (RT) RAN intelligent controller (RIC) of the O-RAN or as an application interacting with the near-RT RIC controller. ### Claim 20 (depends on 19) The method of claim 19, wherein the granting or denying of the access request based on the risk score is implemented by a module that is deployed in a non-RT RIC controller of the O-RAN or as an application interacting with the non-RT RIC controller.