Cognitive user credential authorization advisor

Patent metadata

Field	Value
Publication number	US-11075918-B2
Application number	US-201816150532-A
Country	US
Kind code	B2
Filing date	Oct 3, 2018
Priority date	Oct 3, 2018
Publication date	Jul 27, 2021
Grant date	Jul 27, 2021

Abstract

Techniques are provided for selectively granting access credentials through the use of a machine learning model. Embodiments include collecting data from one or more sources related to user access of an information technology (IT) infrastructure. Based on the collected data, a machine learning model is created for authenticating a request from a client device to access the computer system within the IT infrastructure based on the collected data, based on the machine learning model. An access credential is generated upon processing the user identifier as an input to the machine learning model, and the access credential is provided to the client device.

First claim

What is claimed is:

1. A method for generating access credentials for a computer system within an information technology (IT) infrastructure, comprising:
collecting data on a computer from one or more computerized sources communicating with the computer via a communications network, the collected data related to user access of the IT infrastructure;
creating, based on the collected data, a machine learning model for authenticating a request from a client device to access the computer system within the IT infrastructure, wherein the request specifies a user identifier, and wherein creating the machine learning model comprises:
evaluating the collected data related to user access, wherein collected data includes: i) one or more policies for granting access to the IT infrastructure, and ii) an urgency level associated with the request; and
creating an authorization policy for granting access to the computer system based on the evaluation;

upon processing at least the user identifier as an input to the machine learning model and determining to grant the request based on an output of the machine learning model, generating an access credential corresponding to the user identifier; and
providing the access credential to the client device.

2. The method of claim 1 , further comprising:
identifying the one or more users requesting access to the IT infrastructure using biometric data associated with the user identifier.

3. The method of claim 1 , wherein creating the machine learning model further comprises:
evaluating ii) an access history corresponding to the user identifier, and ii) an access history corresponding to another user identifier specified in other requests to access the computer system, wherein the another user identifier has one or more common credentials with the user identifier specified in the request.

4. The method of claim 3 , wherein generating the access credential comprises:
utilizing the authorization policy to determine an authorization confidence score for granting the request to access the computer system within the IT infrastructure; and
upon determining that the authorization confidence score exceeds a predefined threshold level of confidence, granting the request.

5. The method of claim 4 , wherein utilizing the authorization policy to determine an authorization confidence score further comprises:
increasing the authorization score if at least one of:
the user identifier is registered in a configuration management database associated with the computer system to be accessed,
the user identifier is registered in a human resources database as having a role compatible with the computer system to be accessed,
the user identifier is registered in the human resources database as being part of a group associated with the computer system to be accessed,
the user identifier is registered as an active asset in the human resources database, and
the user identifier is registered in the human resources database as associated with an account that owns the computer system to be accessed.

6. The method of claim 4 , further comprising:
determining a second authorization confidence score for granting a second request to access the computer system;
upon determining that the second authorization confidence score is less than the predefined threshold level of confidence, denying the second request to access the computer system;
generating a notification that indicates the second request was denied.

7. The method of claim 4 , further comprising:
updating the machine learning model and the authorization policy, based on whether the request was granted.

8. A system, comprising:
one or more computer processors; and
a memory containing computer program code that, when executed by operation of the one or more computer processors, performs an operation for generating access credentials for a computer system within an information technology (IT) infrastructure comprising:
collecting data on a computer from one or more computerized sources communicating with the computer via a communications network, the collected data related to user access of the IT infrastructure;
creating, based on the collected data, a machine learning model for authenticating a request from a client device to access the computer system within the IT infrastructure, wherein the request specifies a user identifier, and wherein creating the machine learning model comprises:
evaluating the collected data related to user access, wherein collected data includes: i) one or more policies for granting access to the IT infrastructure, and ii) an urgency level associated with the request; and
creating an authorization policy for granting access to the computer system based on the evaluation;

upon processing at least the user identifier as an input to the machine learning model and determining to grant the request based on an output of the machine learning model, generating an access credential corresponding to the user identifier; and
providing the access credential to the client device.

9. The system of claim 8 , wherein the operation further comprises:
identifying the one or more users requesting access to the IT infrastructure using biometric data associated with the user identifier.

10. The system of claim 8 , wherein creating the machine learning model further comprises:
evaluating i) an urgency level associated with the request, and ii) an access history corresponding to another user identifier specified in other requests to access the computer system, wherein the another user identifier has one or more common credentials with the user identifier specified in the request.

11. The system of claim 10 , wherein generating the access credential comprises:
utilizing the authorization policy to determine an authorization confidence score for granting the request to access the computer system within the IT infrastructure; and
upon determining that the authorization confidence score exceeds a predefined threshold level of confidence, granting the request.

12. The system of claim 11 , wherein utilizing the authorization policy to determine an authorization confidence score further comprises:
increasing the authorization score if at least one of
the user identifier is registered in a configuration management database associated with the computer system to be accessed,
the user identifier is registered in a human resources database as having a role compatible with the computer system to be accessed,
the user identifier is registered in the human resources database as being part of a group associated with the computer system to be accessed,
the user identifier is registered as an active asset in the human resources database, and
the user identifier is registered in the human resources database as associated with an account that owns the computer system to be accessed.

13. The system of claim 11 , wherein the operation further comprises:
determining a second authorization confidence score for granting a second request to access the computer system;
upon determining that the second authorization confidence score is less than the predefined threshold level of confidence, denying the second request to access the computer system;
generating a notification that indicates the second request was denied.

14. The system of claim 11 , wherein the operation further comprises:
updating the machine learning model and the authorization policy, based on whether the request was granted.

15. A computer-readable storage medium containing computer program code that, when executed by operation of one or more computer proc

Assignees

• IBM

Inventors

• Pereira Edson Gomes
• Kern Mainieri Trevisan Daniela
• Costa Thiago Rodrigues De Souza
• Varga Sergio
• Rotta Thiago Cesar

Classifications

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title

• H04L63/102

  Entity profiles · CPC title