Client reputation driven role-based access control

Patent metadata

Field	Value
Publication number	US-11575686-B2
Application number	US-202016992704-A
Country	US
Kind code	B2
Filing date	Aug 13, 2020
Priority date	Jul 29, 2014
Publication date	Feb 7, 2023
Grant date	Feb 7, 2023

Abstract

The present disclosure discloses a system and method for dynamically modifying role based access control for a client based on the activity. Generally, a client device is granted access to a network resource based on a first reputation score assigned to the client device. The activity of the client device is monitored. Responsive to monitoring the activity of the client device, a second reputation score is determined for the client device based on the activity. The access by the client device to the network resource is then modified to be granted based on the second reputation score.

First claim

What is claimed is:

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:
selectively granting or denying a first client device of a plurality of client devices access to network resources in accordance with a first configuration based on a first reputation score assigned to the first client device;
monitoring activities on one or more client devices of the plurality of client devices;
based on the monitoring of the activities on the one or more client devices, modifying the first reputation score to a second reputation score;
modifying the access by the first client device to the network resources to be granted in accordance with a second configuration based on the second reputation score.

2. The medium of claim 1 , wherein modifying the first reputation score to the second reputation score comprises:
decreasing the first reputation score to obtain a third reputation score based on a first set of actions performed by the first client device during a first period of time;
increasing the third reputation score to obtain the second reputation score based on a second set of actions performed by the first client device during a second period of time.

3. The medium of claim 1 , wherein modifying the first reputation score is proportional to a weighted value associated with each of the monitored activities.

4. The medium of claim 1 , wherein the operations further comprise distributing the second reputation score to one or more network devices of the plurality of network devices.

5. The medium of claim 1 , wherein the first client device logs out from a network and thereafter logs back into the network, and the operations further comprise:
subsequent to modifying the first reputation score to the second reputation score:
storing the second reputation score in association with the first client device;

subsequent to the first client device logging back into the network, assigning the first client device the second reputation score previously stored in association with the first client device.

6. The medium of claim 1 , wherein selectively granting or denying the first client access to the network resources comprises granting access to a first set of network resources, and wherein modifying the access by the first client device to the network resources comprises granting access to a second set of network resources different than the first set of network resources.

7. The medium of claim 1 , wherein selectively granting or denying the first client access to the network resources comprises granting access using a first bandwidth for the first client device, and wherein modifying the access by the first client device to the network resources comprises granting access using a second bandwidth for the first client device different than the first bandwidth.

8. The medium of claim 1 , wherein modifying the access by the first client device to the network resources comprises granting access using a first radio frequency band for the first client device, and wherein granting access to the network resources in accordance with the second configuration comprises granting access using a second radio frequency band for the first client device different than the first radio frequency band.

9. The medium of claim 1 , wherein monitoring of the activities on one or more of the client devices comprises monitoring one or more characteristics of data transmitted by the first client device or received by the first client device.

10. The medium of claim 9 , wherein the one or more characteristics comprise a confidentiality level associated with the data.

11. The medium of claim 1 , wherein monitoring of the activities on one or more of the client devices comprises monitoring one or more characteristics of an electronic mail attachment transmitted by the first client device or received by the first client device.

12. The medium of claim 1 , wherein monitoring of the activities on one or more of the client devices comprises monitoring applications accessed by the first client device, and wherein the applications include at least one of a social networking application, an instant messaging application, a peer-to-peer file sharing application, a video-chatting application, a photo-sharing application, a microblogging application, a video-sharing application, or video-streaming application.

13. The medium of claim 1 , wherein modifying the first reputation score comprises evaluating a productivity level based on the activities, and modifying the first reputation score based on the productivity level.

14. The medium of claim 1 , wherein monitoring of the activities on one or more of the client devices comprises onitoring data breached by the first client device, wherein the data is confidential and sensitive.

15. The medium of claim 1 , wherein monitoring of the activities on one or more of the client devices comprises detecting a denial of service attack originated by the first client device.

16. The medium of claim 1 , wherein a rate of change for increasing a reputation score is smaller than a rate of change for decreasing the reputation score.

17. The medium of claim 1 , wherein the monitoring of the activities on the one or more client devices comprises monitoring activities performed on a locally-installed application within the first client device.

18. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
monitoring a plurality of resources accessible by a client device;
identifying current content received by the client device and provided by a particular resource in the plurality of resources accessible by the client device;
detecting that the client device accessed the particular resource;
modifying access by the client device to network resources to be granted in accordance with a configuration that is based on the current content.

19. The medium of claim 18 , wherein the configuration is based on a trust category associated with the current content.

20. The medium of claim 18 , wherein the particular resource is a website.

21. The medium of claim 18 , wherein the current content is received from a third party.

22. The method of claim 18 , wherein identifying the current content comprises analyzing content of packets received by the client device and provided by the particular resource.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Ardeli Ramesh
• Kurmala Hari Krishna

Classifications

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title