Methods and systems for gradual expiration of credentials

Patent metadata

Field	Value
Publication number	US-10007779-B1
Application number	US-201514869185-A
Country	US
Kind code	B1
Filing date	Sep 29, 2015
Priority date	Sep 29, 2015
Publication date	Jun 26, 2018
Grant date	Jun 26, 2018

Abstract

Methods and systems are provided to enable gradual expiration of credentials. Instead of depriving a user of all his access rights upon expiration of his credential (e.g., password), the user's access rights may be gradually restricted during a grace period after an expected or initial expiration time and/or before a final expiration time. The access right may be determined based on a duration from a time of the access request to the final expiration time or to the initial expiration time.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, at a first access request time, a first access request for accessing a resource using a credential, the first access request time occurring after an initial expiration time associated with the credential and before a final expiration time, the final expiration time determined by adding a predetermined grace period to the initial expiration time;
selecting a first access rule from a plurality of access rules based at least in part on first durations between the first access request time, the initial expiration time, and the final expiration time;
determining a first access right with respect to the resource based at least in part on the selected first access rule, the first access right configured to be more restrictive than an access granted prior to the initial expiration time;
generating a first access response corresponding to the first access request based at least in part on the first access right;
receiving, at a second access request time, a second request for accessing the resource using the credential, the second access request time occurring after the first access request time and before the final expiration time;
selecting a second access rule from the plurality of access rules based at least in part on second durations between the second access request time, the initial expiration time, and the final expiration time;
determining a second access right with respect to the resource based at least in part on the selected second access rule, historical access data associated with aggregated user behavior for selected previous access to the resource, and one or more attributes associated with sensor data indicating security breaches at the resource, the second access right being more restrictive than the first access right; and
generating a second access response corresponding to the second access request based at least in part on the second access right.

2. The computer-implemented method of claim 1 , wherein the first access right is configured to allow access to the resource and the second access right is configured to deny access to the resource.

3. The computer-implemented method of claim 1 , wherein the first access right is configured to allow read/write access to the resource and the second access right is configured to allow read-only access to the resource.

4. The computer-implemented method of claim 1 , wherein the credential includes at least one of a password, a cryptographic key, or a digital certificate.

5. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by a computing system, configure the computing system to perform operations comprising:
in response to receiving, at a request time, a request to access a resource using a credential, the request time occurring after an initial expiration time associated with the credential and before a final expiration time:
selecting a first access rule from a plurality of access rules based at least in part on first durations between the request time, the initial expiration time, and the final expiration time;
determining an access right with a level of a plurality of different access right levels with respect to the resource based at least in part on the selected first access rule, historical access data associated with aggregated user behavior for selected previous access to the resource, and one or more attributes associated with sensor data indicating security breaches at the resource, the different access right levels respectively corresponding to different durations between the request time and the final expiration time for the credential; and
providing a level of access to the resource based at least in part on the level of determined access right.

6. The computer-readable storage media of claim 5 , wherein the access right is determined based at least in part on a second duration between the request time and the initial expiration time.

7. The computer-readable storage media of claim 5 , wherein determining the access right comprises:
selecting a second access rule from the plurality of access rules based at least in part on a duration between the request time and the final expiration time for the credential; and
determining the access right based at least in part on the selected second access rule.

8. The computer-readable storage media of claim 7 , wherein determining the access right comprises:
comparing the duration with one or more predetermined intermediate durations relative to the final expiration time, each of the one or more intermediate durations associated with a set of one or more access rules of the plurality of access rules;
selecting, based at least in part on the comparison, the set of access rules associated with one of the one or more intermediate durations; and
determining the access right based at least in part on the selected set of access rules.

9. The computer-readable storage media of claim 8 , wherein the one or more intermediate durations includes a first intermediate duration with a first set of access rules and a second intermediate duration with a second set of access rules, the second intermediate duration being shorter than the first intermediate duration and the second set of access rules being more restrictive than the first set of access rules.

10. The computer-readable storage media of claim 5 , wherein the access right is determined further based at least in part on one or more characteristics associated with the resource or with the credential.

11. The computer-readable storage media of claim 5 , wherein the access right indicates a type, a duration, or a scope of access with respect to the resource.

12. The computer-readable storage media of claim 5 , wherein the access right indicates an allowance or denial of access to the resource.

13. A computer system, comprising:
a memory that stores computer-executable instructions; and
a processor configured to access the memory and execute the computer-executable instructions to at least:
receive, at a request time, a request from a requester to access a plurality of resources using a credential, the request time occurring after an initial expiration time associated with the credential and before a final expiration time;
select a first access rule from a plurality of access rules based at least in part on first durations between the request time, the initial expiration time, and the final expiration time;
determine an access right with a level of a plurality of different access right levels with respect to a resource of the plurality of resources based at least in part on the selected first access rule, historical access data associated with aggregated user behavior for selected previous access to the resource, and one or more attributes associated with sensor data indicating security breaches at the resource, the different access right levels respectively corresponding to different durations between the request time and the initial expiration time for the credential; and
provide access to the subset of resources for the requester based at least in part on the access right.

14. The computer system of claim 13 , wherein the plurality of resources comprises at least one of a service, a computing device, or a data object.

15. The computer system of claim 13 , wherein the one or more attributes include attributes associated with the requestor, the credential, or at least one of the plurality of resources and wherein final expiration time is determined based at least in part on the one or more attributes.

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Golwalkar Yogesh Vilas
• Bhimanaik Bharath Kumar
• Mcadams Darin Keith
• Sethi Tushaar

Classifications

• G06F21/31

  User authentication · CPC title

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title