Learning cognitive access control service

Patent metadata

Field	Value
Publication number	US-12182237-B2
Application number	US-202117540031-A
Country	US
Kind code	B2
Filing date	Dec 1, 2021
Priority date	Dec 1, 2021
Publication date	Dec 31, 2024
Grant date	Dec 31, 2024

Abstract

An indication associated with a request to access a protected object by a subject is received. Using one or more processors, application level behavioral patterns of the subject, context of the request by the subject, usage patterns associated with the protected object, and a current system state are automatically analyzed using one or more machine learning models to determine an analysis result associated with whether to grant the subject access to the protected object. An access control mechanism for the protected object is automatically modified based on the analysis result.

First claim

What is claimed is:

1. A method, comprising:
receiving an indication associated with a request to access a protected object by a subject;
using one or more processors to automatically analyze at least application level behavioral patterns of the subject, context of the request by the subject, usage patterns associated with the protected object, and a current system state using one or more machine learning models to determine an analysis result associated with whether to grant the subject access to the protected object, wherein the analysis result includes a plurality of predicted consequential effects of the access of the protected object determined using at least a portion of the one or more machine learning models; and
automatically modifying an access control mechanism for the protected object based on the analysis result including the plurality of predicted consequential effects determined using at least a portion of the one or more machine learning models.

2. The method of claim 1 , wherein the access control mechanism for the protected object is automatically modified for a limited amount of time.

3. The method of claim 1 , wherein the access control mechanism utilizes an Identity Based Access Control (IBAC) and Access Control Lists (ACLs), Role Based Access Control (RBAC), Attribute Based Access Control (ABAC), or Next Generation Access Control (NGAC).

4. The method of claim 1 , further comprising:
evaluating a result of the modification to the access control mechanism; and
retraining the one or more machine learning models based on the evaluated result.

5. The method of claim 1 , wherein the modified access control mechanism is a conditional modification.

6. The method of claim 5 , further comprising:
identifying a failure to meet the conditional modification; and
automatically revoking the automatic modification to the access control mechanism for the protected object.

7. The method of claim 1 , wherein determining the analysis result associated with whether to grant the subject access to the protected object includes:
identifying a prospective action to perform;
evaluating a confidence rating corresponding to whether an intended consequence included the plurality of predicted consequential effects will occur; and
in response to a determination that the confidence rating exceeds a threshold value, performing the prospective action.

8. The method of claim 1 , wherein determining the analysis result associated with whether to grant the subject access to the protected object includes identifying a first, a second, a third, and a fourth order effect included the plurality of predicted consequential effects determined using at least a portion of the one or more machine learning models.

9. The method of claim 1 , wherein determining the analysis result associated with whether to grant the subject access to the protected object includes creating a graphical representation of a current system context, wherein the current system context includes details extracted from the current system state and the context of the request by the subject.

10. The method of claim 1 , wherein automatically modifying the access control mechanism for the protected object based on the analysis result includes providing a justification of the modification, wherein the justification is based on a system policy.

11. A system, comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
receive an indication associated with a request to access a protected object by a subject;
automatically analyze at least application level behavioral patterns of the subject, context of the request by the subject, usage patterns associated with the protected object, and a current system state using one or more machine learning models to determine an analysis result associated with whether to grant the subject access to the protected object, wherein the analysis result includes a plurality of predicted consequential effects of the access of the protected object determined using at least a portion of the one or more machine learning models; and
automatically modify an access control mechanism for the protected object based on the analysis result including the plurality of predicted consequential effects determined using at least a portion of the one or more machine learning models.

12. The system of claim 11 , wherein the access control mechanism for the protected object is automatically modified for a limited amount of time.

13. The system of claim 11 , wherein the access control mechanism utilizes an Identity Based Access Control (IBAC) and Access Control Lists (ACLs), Role Based Access Control (RBAC), Attribute Based Access Control (ABAC), or Next Generation Access Control (NGAC).

14. The system of claim 11 , wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
evaluate a result of the modification to the access control mechanism; and
retrain the one or more machine learning models based on the evaluated result.

15. The system of claim 11 , wherein the modified access control mechanism is a conditional modification, and wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
identify a failure to meet the conditional modification; and
automatically revoke the automatic modification to the access control mechanism for the protected object.

16. The system of claim 11 , wherein determining the analysis result associated with whether to grant the subject access to the protected object includes:
identifying a prospective action to perform;
evaluating a confidence rating corresponding to whether an intended consequence included the plurality of predicted consequential effects will occur; and
in response to a determination that the confidence rating exceeds a threshold value, performing the prospective action.

17. The system of claim 11 , wherein determining the analysis result associated with whether to grant the subject access to the protected object includes identifying a first, a second, a third, and a fourth order effect included the plurality of predicted consequential effects determined using at least a portion of the one or more machine learning models.

18. The system of claim 11 , wherein determining the analysis result associated with whether to grant the subject access to the protected object includes creating a graphical representation of a current system context, wherein the current system context includes details extracted from the current system state and the context of the request by the subject.

19. The system of claim 11 , wherein automatically modifying the access control mechanism for the protected object based on the analysis result includes providing a justification of the modification, wherein the justification is based on a system policy.

20. A non-transitory computer readable storage medium comprising computer instructions for:
receiving an indication associated with a request to access a protected object by a subject;
automatically analyzing at least application level behavioral patterns of the subject, context of the request by the subject, usage patterns associated with the protected object, and a current system state using one or more machine le

Assignees

• Servicenow Inc

Inventors

• Mozano Ashton
• Talmat Mohamed Sofiane

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title