Related asset access based on proven primary asset access

Patent metadata

Field	Value
Publication number	US-11765152-B2
Application number	US-201916522466-A
Country	US
Kind code	B2
Filing date	Jul 25, 2019
Priority date	Jul 25, 2019
Publication date	Sep 19, 2023
Grant date	Sep 19, 2023

Abstract

Access control enhancements reduce security risks and management burdens when a user with access to a primary asset seeks access to a related supplementary asset. When a sufficient proof of access to the primary asset is provided, and the relationship of the primary and supplementary assets is recognized, access to the supplementary asset is granted without requiring a separate sign-in, a permission query to the supplementary asset's owner, or an authorization through an authenticated identity of the requestor, for example. Automatic access to the supplementary asset can be granted without the security risks inherent in a file share or a share link. In particular, a developer with access to one component of a project can be automatically and conveniently granted access to the rest of the project. Likewise, a custom machine learning model for autocompletion becomes accessible to all developers working on the repository source used to train the model.

First claim

What is claimed is:

1. An access control system comprising an access controller, the access controller comprising:
an access control memory;
an access control processor in operable communication with the access control memory, the access control processor configured to perform access control steps which include (a) receiving a request by a requestor for access to a supplementary asset which is associated to a user account of a user who is not the requestor, (b) determining that the supplementary asset is related to a primary asset, (c) verifying that the request identifies or contains a proof of access to the primary asset, and (d) granting the access request based on a determination result of the determining step and on a verification result of the verifying step even though the supplementary asset was not associated to an account of the requestor, wherein the determining produces at least one of the following determination results, thereby representing a recognized relationship between the supplementary asset and the primary asset: at least a portion of one of the assets was computationally derived from at least a portion of the other asset, each asset belongs to the same software artifact build project, one of the assets is repository-resident and the other asset includes a development tool or artifact that is applicable to at least a portion of the repository-resident asset, one of the assets includes a build dependency of the other asset or a runtime dependency of the other asset or both, one of the assets includes data stored in a system configured for large file storage and the other asset includes a text pointer or other reference to that data; or one of the assets includes a machine learning model which was trained at least in part using at least a portion of the other asset;
whereby the system provides an increase in available access to the supplementary asset without conditioning the increase in available access to the supplementary asset on any identity of the requestor.

2. The system of claim 1 , wherein the primary asset includes source code, and the supplementary asset includes at least one of the following:
an artifact which was computationally derived at least in part from the source code; or
a build component of a project in which the source code is also a build component.

3. The system of claim 1 , further characterized in at least one of the following ways:
the system comprises a requestor device having a requestor device memory and a requestor device processor, and the requestor device is configured to generate within an integrated development environment the request for access to the supplementary asset;
the system comprises an access controller web service interface, and the access controller receives the request through the access controller web service interface.

4. The system of claim 1 , wherein the primary asset includes source code, the supplementary asset includes a model computationally derived at least in part from the source code, and the model is configured for use by an autocompletion tool.

5. The system of claim 1 , wherein the primary asset includes source code in a version control system, the source code including source code versions at a plurality of commit points within the version control system, and wherein the supplementary asset includes an artifact that was computationally derived at least in part from the source code version at a commit point.

6. The system of claim 1 , wherein the assets reside in different respective regions for at least one of the following definitions of a region: a local area network, a physical server, a computer, a data center, a trust domain, a web site, a web service, a repository, a machine learning model, a geographic city, a geographic county, a geographic state, or a geographic province.

7. A method used by an access controller to control access by a requestor to a supplementary asset which is associated to a user account of a user who is not the requestor, the method comprising:
receiving a request by the requestor for access to the supplementary asset;
determining that the supplementary asset is related to a primary asset, wherein the determining produces at least one of the following determination results, thereby representing a recognized relationship between the supplementary asset and the primary asset: each asset belongs to the same software artifact build project, one of the assets is repository-resident and the other asset includes a development tool or artifact that is applicable to at least a portion of the repository-resident asset, one of the assets includes a build dependency of the other asset or a runtime dependency of the other asset or both, one of the assets includes data stored in a system configured for large file storage and the other asset includes a text pointer or other reference to that data; or one of the assets includes a machine learning model which was trained at least in part using at least a portion of the other asset;
verifying whether the requestor has access to the primary asset; and
when a verification result of the verifying indicates the requestor has access to the primary asset, then granting the requestor access to the supplementary asset based on a determination result of the determining and on the verification result; and
when the verification result of the verifying does not indicate the requestor has access to the primary asset, then denying the requestor access to the supplementary asset based on at least the verification result;
whereby the requestor is granted access to the supplementary asset or the requestor is denied access to the supplementary asset, even though the supplementary asset was not associated to an account of the requestor, without interactively seeking a supplementary asset access permission on behalf of the requestor from an administrator or an owner of the supplementary access.

8. The method of claim 7 , wherein the determining produces at least one of the following determination results, thereby representing a recognized relationship between the supplementary asset and the primary asset:
at least a portion of one of the assets was computationally derived from at least a portion of the other asset; or
one of the assets includes source code resident in a version control system and the other asset includes a development tool or artifact that is applicable to at least a portion of the source code.

9. The method of claim 7 , wherein there are multiple versions of the supplementary asset and multiple versions of the primary asset, and wherein the method further comprises mapping between a particular version of the supplementary asset and a particular version of the primary asset.

10. The method of claim 7 , wherein the method grants the requestor access to the supplementary asset without conditioning that access on supplementary-asset-specific operations performed using a share link, a file share, or another explicit sharing management mechanism.

11. The method of claim 7 , wherein the verifying comprises comparing a hash previously stored by the access controller in correspondence with the supplementary asset to a hash supplied to the access controller through the request.

12. The method of claim 7 , wherein there are multiple versions of the primary asset, and wherein the method further comprises associating different versions of the primary asset with corresponding versions of a proof of access to the primary asset.

13. The method of claim 7 , wherein the method grants the requestor access to the supplementary asset without conditioning that access on a supplementary sign-in that is specifically performed to gain ac

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Obando Chacon German David
• Keech Jonathan Daniel
• Wilson-Thomas Mark Alistair

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/44

  Program or device authentication · CPC title