Method and apparatus for ephemeral roles implementing module

Patent metadata

Field	Value
Publication number	US-11316864-B2
Application number	US-202016797520-A
Country	US
Kind code	B2
Filing date	Feb 21, 2020
Priority date	Mar 6, 2019
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

Various methods, apparatuses, and media for implementing a machine-learning model execution module are provided. A processor is configured to generate a machine-learning model. The machine learning model includes data related to a requester's access to one or more ephemeral roles. The processor receives a request from the requester to access the one or more ephemeral roles within the machine-learning model. The processor also determines the requester's group or role membership status within an organization. The processor also dynamically evaluates the received request with the machine learning model in real time to grant or deny access to the one or more ephemeral roles based on the membership status of the requester.

First claim

What is claimed is:

1. A method for implementing a machine learning model execution module for granting access to ephemeral roles, the method comprising:
generating, by a processor, a machine learning model, the machine learning model including data related to a requester's access to one or more ephemeral roles;
receiving, by the processor, a request from a requester's computing device to access the one or more ephemeral roles within the machine learning model;
determining, by the processor, the requester's group or role membership status within an organization; and
dynamically evaluating, by the processor, the received request with the machine learning model in real time to grant or deny access to one or more ephemeral roles based on the membership status of the requester,
wherein ephemeral roles include no statically assigned set of permissions, and the method further comprising:
applying a predefined algorithm to dynamically determine access control at the time of request in real time to grant or deny access to a role requested by the requester.

2. The method according to claim 1 , further comprising:
dynamically updating the machine learning model after granting or denying access to one or more ephemeral roles.

3. The method according to claim 1 , further comprising:
sending an electronic notification, by the processor, to a manager's computing device, different from the requester's computing device, when access to one or more ephemeral roles has been denied;
automatically receiving, by the processor, approval or disapproval from the manager's computing device whether to grant access to one or more ephemeral roles; and
updating, by the processor, the machine learning model to incorporate data related to the received approval or disapproval from the manager's computing device.

4. The method according to claim 1 , further comprising:
dynamically determining whether access should be granted based on one or more of the following factors: who created the roles, other's usage of the roles, an organization's reporting lines or project codes or tags, sensitivity of the data being requested, and whether any hints have been provided.

5. The method according to claim 1 , further comprising:
dynamically determining whether access should be granted based on determining whether data requested by the requester conforms with a predefined classification scheme applied on the data.

6. The method according to claim 1 , further comprising:
dynamically determining whether access should be granted based on contextual identity of a requester.

7. A system for implementing a machine learning model execution module for granting access to ephemeral roles, the system comprising:
a memory; and
a processor operatively connected to the memory via a communication network,
wherein the processor is configured to:
generate a machine learning model, the machine learning model including data related to a requester's access to one or more ephemeral roles;
receive a request from a requester's computing device to access the one or more ephemeral roles within the machine learning model;
determine the requester's group or role membership status within an organization; and
dynamically evaluate the received request with the machine learning model in real time to grant or deny access to one or more ephemeral roles based on the membership status of the requester,
wherein ephemeral roles include no statically assigned set of permissions, and wherein the processor is further configured to:
apply a predefined algorithm to dynamically determine access control at the time of request in real time to grant or deny access to a role requested by the requester.

8. The system according to claim 7 , wherein the processor is further configured to:
dynamically update the machine learning model after granting or denying access to one or more ephemeral roles.

9. The system according to claim 7 , wherein the processor is further configured to:
send an electronic notification to a manager's computing device, different from the requester's computing device, when access to one or more ephemeral roles has been denied;
automatically receive approval or disapproval from the manager's computing device whether to grant access to one or more ephemeral roles; and
update the machine learning model to incorporate data related to the received approval or disapproval from the manager's computing device.

10. The system according to claim 7 , wherein the processor is further configured to:
dynamically determine whether access should be granted based on one or more of the following factors: who created the roles, other's usage of the roles, an organization's reporting lines or project codes or tags, sensitivity of the data being requested, and whether any hints have been provided.

11. The system according to claim 7 , wherein the processor is further configured to:
dynamically determine whether access should be granted based on determining whether data requested by the requester conforms with a predefined classification scheme applied on the data.

12. The system according to claim 7 , wherein the processor is further configured to:
dynamically determine whether access should be granted based on contextual identity of a requester.

13. A non-transitory computer readable medium configured to store instructions for implementing a machine learning model execution module for granting access to ephemeral roles, wherein when executed, the instructions cause a processor to perform the following:
generate a machine learning model, the machine learning model including data related to a requester's access to one or more ephemeral roles;
receive a request from a requester's computing device to access the one or more ephemeral roles within the machine learning model;
determine the requester's group or role membership status within an organization; and
dynamically evaluate the received request with the machine learning model in real time to grant or deny access to one or more ephemeral roles based on the membership status of the requester,
wherein when executed, the instructions further cause the processor to perform the following:
apply a predefined algorithm to dynamically determine access control at the time of request in real time to grant or deny access to a role requested by the requester.

14. The non-transitory computer readable medium according to claim 13 , wherein when executed, the instructions further cause the processor to perform the following:
dynamically update the machine learning model after granting or denying access to one or more ephemeral roles.

15. The non-transitory computer readable medium according to claim 13 , wherein when executed, the instructions further cause the processor to perform the following:
send an electronic notification to a manager's computing device, different from the requester's computing device, when access to one or more ephemeral roles has been denied;
automatically receive approval or disapproval from the manager's computing device whether to grant access to one or more ephemeral roles; and
update the machine learning model to incorporate data related to the received approval or disapproval from the manager's computing device.

16. The non-transitory computer readable medium according to claim 13 , wherein when executed, the instructions further cause the processor to perform the following:
dynamically determine whether access should be granted based on one or more of the following factors: who created the roles, other's usage of the roles, an organization's reporting lines or

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Asher Adrian
• Ackerman Michael D

Classifications

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06N20/00

  Machine learning · CPC title

• G06N5/04

  Inference or reasoning models · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title