Enforce changes in session behavior based on updated machine learning model with detected risk behavior during session

Patent metadata

Field	Value
Publication number	US-11768699-B2
Application number	US-201916593985-A
Country	US
Kind code	B2
Filing date	Oct 5, 2019
Priority date	Oct 5, 2019
Publication date	Sep 26, 2023
Grant date	Sep 26, 2023

Abstract

Systems and methods are provided for managing dynamic controls over access to computer resources and, even more particularly, for evaluating and re-evaluating dynamic conditions and changes associated with user sessions. The systems and methods are configured to automatically make a determination as to whether new or additional authentication credentials are required for a user that is already authorized for accessing resources in a user session, in response to triggering events such as the identification of a new or changed condition associated with the user session.

First claim

What is claimed is:

1. A system that dynamically controls access to computer resources and that determines when new credential information is warranted for granting access, said system comprising:
a storage;
a conditional access engine;
one or more tenant session managers;
a machine learning engine;
one or more processors; and
one or more physical computer-readable storage media that store instructions that are executable by the one or more processors to cause the system to:
cause the conditional access engine to access one or more policies associated with one or more computer resources of a particular tenant, the one or more policies configured to enforce access permissions of the one or more computer resources based on one or more user credentials and one or more triggering events, the one or more triggering events comprising a triggering event based on evaluating a first condition associated with a comparison between behavior of a user in a current user session and behavior of the user in prior user sessions, wherein a third party information source connected to the system provides information related to the behavior of the user in the prior sessions, and wherein the one or more policies are stored in the storage;
cause the conditional access engine to receive user credentials from the user for requesting access to a particular computer resource of the one or more computer resources of the particular tenant;
in response to verifying the received user credentials based on the one or more policies, cause the conditional access engine to establish a user session and provide the user access to the particular computer resource;
cause one of the conditional access engine or the one or more tenant session managers to monitor events associated with the particular computer resource occurring during the user session;
in response to detecting at least one triggering event among the one or more triggering events associated with a change in a second condition relating to a machine learning model associated with the user session, cause the conditional access engine to reevaluate the user session based on the one or more policies, wherein the machine learning model is updated by the machine learning engine, wherein the machine learning engine updates the machine learning model based on a detected risk behavior, and wherein, when the machine learning model is updated based on the detected risk behavior, a risk profile for the user session increases;
based on the reevaluation, cause the conditional access engine to dynamically determine whether new user credentials are required to provide the user continued access to the particular computer resource; and
upon determining that the new user credentials are not required, cause the conditional access engine to continue to provide access to the particular computer resource, or alternatively,
upon determining that the new user credentials are required:
cause the one or more tenant session managers to suspend the granted access to the particular computer resource while maintaining session state for the user session;
cause the conditional access engine to request the new user credentials from the user; and
upon obtaining the new user credentials, cause the one or more tenant session managers to unsuspend the granted access to the particular computer resource.

2. The system of claim 1 , wherein the system further terminates the user session during the determination of whether the new user credentials are required.

3. The system of claim 1 , wherein the change in conditions comprises a detected change in user behavior relative to a stored user profile.

4. The system of claim 1 , wherein the change in conditions comprises a change in user location.

5. The system of claim 1 , wherein the change in conditions comprises a change other than a detected period of inactivity or a new request for a particular resource or type of resource.

6. The system of claim 1 , wherein the system further requests the new user credentials from the user and receives the new user credentials from the user.

7. The system of claim 6 , wherein the new user credentials include at least one credential that was not previously provided by the user to the system for establishing the user session.

8. The system of claim 7 , wherein the new user credentials include multi-factor authentication credentials provided through at least two different devices.

9. The system of claim 8 , wherein the new user credentials include at least one credential provided by an entity other than the user.

10. A method for dynamically controlling access to one or more computer resources accessible to a computing system and for dynamically determining when new credential information is needed for granting access to the one or more computer resources in a previously established and authorized user session between a user and the computing system, which includes a storage, a conditional access engine, one or more tenant session managers, and a machine learning engine, the method comprising:
causing the conditional access engine to access one or more policies associated with the one or more computer resources of a particular tenant, the one or more policies configured to enforce access permissions of the one or more computer resources based on one or more user credentials and one or more triggering events, the one or more triggering events comprising a triggering event based on evaluating a first condition associated with a comparison between behavior of a user in a current user session and behavior of the user in prior user sessions, wherein a third party information source connected to the computer system provides information related to the behavior of the user in the prior sessions, and wherein the one or more policies are stored in the storage;
causing the conditional access engine to receive user credentials from the user for requesting access to a particular computer resource of one or more computer resources of the particular tenant;
in response to verifying the received user credentials based on the one or more policies, causing the conditional access engine to establish a user session and to provide the user access to the particular computer resource;
causing one of the conditional access engine or the one or more tenant session managers to monitor events associated with the particular computer resource occurring during the user session;
in response to detecting at least one triggering event among the one or more triggering events associated with a change to a second dynamic condition relating to a machine learning model associated with the user session, causing the conditional access engine to reevaluate the user session based on the one or more policies, wherein the machine learning model is updated by the machine learning engine, wherein the machine learning engine updates the machine learning model based on a detected risk behavior, and wherein, when the machine learning model is updated based on the detected risk behavior, a risk profile for the user session increases;
based on the reevaluation, causing the conditional access engine to dynamically determine whether new user credentials are required to authorize and to continue granting the user access to the particular computer resource; and
upon determining that new user credentials are not required, causing the conditional access engine to continue to provide access to the computer resources, or alternatively,
upon determining that the new user credentials are required:
cause the one or more tenant session managers to terminate or suspend the granted access to the particular computer resource, while maintaining session state for the user session;
cause the conditio

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Esibov Alexander
• Azulay Itamar

Classifications

• G06F9/468 Primary

  Specific access rights for resources, e.g. using capability register · CPC title

• G06F9/5011

  the resources being hardware resources other than CPUs, Servers and Terminals · CPC title

• G06F21/32

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• G06F21/564

  by virus signature recognition · CPC title

• G06N20/00

  Machine learning · CPC title