Automated data security evaluation and adjustment

Patent metadata

Field	Value
Publication number	US-10979461-B1
Application number	US-201815909760-A
Country	US
Kind code	B1
Filing date	Mar 1, 2018
Priority date	Mar 1, 2018
Publication date	Apr 13, 2021
Grant date	Apr 13, 2021

Abstract

Data security may be automatically evaluated and adjusted using machine learning and/or satisfiability modulo theories (SMT). In various examples, a machine learning model(s) may be trained using training data that includes samples of customer data labeled with different types of data corresponding to different sensitivity levels of the samples of the customer data. Once trained, this trained machine learning model(s) can be used to classify data that is, or is requested to be, stored in a storage container. A SMT solver(s) may then evaluate the sufficiency of the existing data security (e.g., an existing access policy) of the storage container. Based on the result of the SMT solver's data security evaluation, an action(s) may be taken, such as a remedial action (e.g., adjusting data security of the storage container), a notification action (e.g., sending an alert about the data security deficiency), or the like.

First claim

What is claimed is:

1. A system comprising:
one or more processors; and
memory storing computer-executable instructions which, when executed by the one or more processors, cause the system to:
create training data by labeling samples of customer data maintained by a network-based storage system with different types of data corresponding to different sensitivity levels of the samples of the customer data;
train a machine learning model using the training data to generate a trained machine learning model;
receive a data object from a computing device of a customer as part of a request to store the data object in a storage container that is associated with the customer and that is maintained by the network-based storage system;
provide data of the data object as a subject for the trained machine learning model to classify among the different types of data;
generate, as output from the trained machine learning model, a classification of the data as a type of data among the different types of data;
identify, from a policy data store that maps different access policies to the different types of data, a corresponding access policy that maps to the type of data;
determine, using a satisfiability modulo theories (SMT) solver, that an existing access policy for the storage container is less secure than the corresponding access policy; and
alter, by the network-based storage system and based on the existing access policy being less secure than the corresponding access policy, the existing access policy for the storage container to the corresponding access policy.

2. The system of claim 1 , wherein the computer-executable instructions, when executed by the one or more processors, further cause the system to store the data object in the storage container in response to altering to the corresponding access policy for the storage container.

3. The system of claim 1 , wherein determining, using the SMT solver, that the existing access policy for the storage container is less secure than the corresponding access policy comprises:
transforming the existing access policy and the corresponding access policy into a formula expressed in a background theory;
processing the formula with the SMT solver in an attempt to find a solution to the formula; and
generating a result as second output of the SMT solver based on the processing, wherein the result indicates that the existing access policy for the storage container is less secure than the corresponding access policy.

4. A computer-implemented method comprising:
creating training data by labeling samples of customer data maintained by a network-based storage system with different types of data corresponding to different sensitivity levels of the samples of the customer data;
training a machine learning model using the training data to generate a trained machine learning model;
receiving data that is, or is requested to be, stored in a storage container maintained by the network-based storage system;
classifying the data as a type of data among the different types of data using the trained machine learning model;
identifying a corresponding access policy that corresponds to the type of data;
determining, using a module configured to solve a formula expressed in first-order logic, that an existing access policy associated with the storage container is less secure than the corresponding access policy, wherein the existing access policy specifies one or more first sources that are allowed or denied access to the storage container, and wherein the corresponding access policy defines one or more second sources different from the one or more first sources that are allowed or denied access to the storage container; and
performing an action based at least in part on the determining that the existing access policy is less secure than the corresponding access policy, wherein the action comprises at least one of:
altering the existing access policy for the storage container to the corresponding access policy;
sending an alert to a customer who is authorized to change the existing access policy of the storage container, the alert indicating that the existing access policy is insufficient for protecting the data; or
storing the data in a different storage container associated with a different access policy that is as secure as, or more secure than, the corresponding access policy.

5. The computer-implemented method of claim 4 , wherein the action comprises the altering of the existing access policy.

6. The computer-implemented method of claim 5 , further comprising receiving, prior to the receiving of the data and from the customer, authorization to automatically upgrade storage container access policies on behalf of the customer, wherein the altering of the existing access policy occurs without intervention from the customer based at least in part on the authorization.

7. The computer-implemented method of claim 5 , further comprising requesting, after the determining that the existing access policy associated with the storage container is less secure than the corresponding access policy and from the customer, authorization to apply the corresponding access policy to the storage container, wherein the altering of the existing access policy occurs in response to receiving the authorization.

8. The computer-implemented method of claim 5 , further comprising:
receiving a request for the data to be stored in the storage container; and
storing the data in the storage container in response to the altering of the existing access policy.

9. The computer-implemented method of claim 4 , further comprising receiving a request for the data to be stored in the storage container, wherein the performing of the action comprises performing actions that include storing the data in the storage container, and sending the alert to the customer.

10. The computer-implemented method of claim 4 , further comprising receiving a request for the data to be stored in the storage container, wherein the performing of the action comprises performing actions that include refraining from storing the data in the storage container, and sending the alert to the customer, the alert informing the customer that the data will not be stored in the storage container until the corresponding access policy is applied to the storage container.

11. The computer-implemented method of claim 4 , wherein the existing access policy and the corresponding access policy each specify a plurality of roles and a plurality of permissions pertaining to storage container access.

12. The computer-implemented method of claim 4 , further comprising determining that the type of data corresponds to a sensitivity level among the different sensitivity levels that meets or exceeds a threshold sensitivity level, wherein the identifying the corresponding access policy is based at least in part on the determining that the type of data corresponds to the sensitivity level that meets or exceeds the threshold sensitivity level.

13. The computer-implemented method of claim 4 , wherein the determining that the existing access policy is less secure than the corresponding access policy comprises:
transforming the existing access policy and the corresponding access policy into the formula;
processing the formula with a satisfiability modulo theories (SMT) solver to determine a solution to the formula; and
generating a result as output of the SMT solver based at least in part on the processing, wherein the result indicates that the existing access policy is less secure than the corresponding access policy.

14. One or more non-transitory computer-readable media storing comp

Assignees

• Amazon Tech Inc

Inventors

• Cervantez Michael Jerry
• Soulia Sheila Mary
• Leighton Russell Richard
• Evans Matthew R

Classifications

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N3/091

  Active learning · CPC title

• G06N3/0895

  Weakly supervised learning, e.g. semi-supervised or self-supervised learning · CPC title