Access decision management system for digital resources

Patent metadata

Field	Value
Publication number	US-12333028-B2
Application number	US-202217971200-A
Country	US
Kind code	B2
Filing date	Oct 21, 2022
Priority date	Oct 21, 2022
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

A data processing system implements receiving an access request from the client device of a content requestor to access a content item for which access to the content item is managed by a content access management platform and obtaining access control information. The access control information comprising information associated with a content owner associated with the content item, information associated with the content requestor, and information associated with the content item. The system further implements analyzing the access control information using a first machine learning model trained to analyze the access control information and to output an access determination score, the access determination score representing a level of certainty that the content requestor should be granted access to the content item, determining an automatic access decision to grant or deny the access request based on the access determination score, and notifying the content requestor whether the access request has granted or denied based on the automatic access decision.

First claim

What is claimed is:

1. A data processing system comprising:
a processor; and
a machine-readable medium storing executable instructions that, when executed, cause the processor to perform operations comprising:
receiving an access request from a client device of a content requestor to request access to a content item for which access is managed by a content access management platform;
obtaining access control information, the access control information comprising information associated with a content owner associated with the content item, information associated with the content requestor, and information associated with the content item;
sending a request to the client device of the content requestor for access justification information describing a reason the content requestor requires access to the content item;
receiving the access justification information from the client device of the content requestor;
analyzing the access justification information using a first machine learning model trained to receive the access justification information as an input, to perform a semantic analysis of the access justification information, and to output semantic information representing a meaning of the access justification information;
analyzing the access control information and the semantic information using a second machine learning model trained to analyze the access control information and to output an access determination score, the access determination score representing a level of certainty that the content requestor should be granted access to the content item;
determining an automatic access decision to grant or deny the access request based on the access determination score; and
notifying the content requestor whether the access request has granted or denied based on the automatic access decision.

2. The data processing system of claim 1 , wherein determining whether to automatically grant or deny the access request based on the access determination score further comprises:
determining a level of access to grant to the content requestor based on the access determination score.

3. The data processing system of claim 2 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
determining, based on the access determination score, that the content requestor should be granted temporary access to the content item.

4. The data processing system of claim 3 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
sending an access control request to a client device of the content owner to grant or deny access to the content item;
receiving a content access response from the client device of the content owner indicating whether the content requestor should be granted or denied access to the content item; and
granting or denying access to the content item by the content requestor in response to receiving the content access response.

5. The data processing system of claim 3 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
receiving access configuration information from the client device of the content owner indicating the level of access to be granted to the content requestor; and
granting access to the content requestor at the level of access indicated in the access configuration information.

6. The data processing system of claim 2 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
sending a confirmation request to the content owner requesting that the content owner confirm whether the automatic access decision was correct; and
receiving a confirmation response from the content owner.

7. The data processing system of claim 6 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
overriding the automatic access decision responsive to the confirmation response from the content owner indicating that the automatic access decision was incorrect.

8. The data processing system of claim 6 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
receiving access configuration information from the client device of the content owner indicating the level of access that should have been granted to the content requestor; and
overriding the level of access associated with the automatic access decision based on the access configuration information received from the content requestor.

9. The data processing system of claim 6 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
fine tuning parameters of the second machine learning model based on the confirmation response received from the content owner.

10. The data processing system of claim 6 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
determining that the content owner is unavailable;
identifying an alternative user associated with the content owner responsive to determining that the content owner is unavailable;
sending the confirmation request to the alternative user requesting whether the alternative user confirm that the automatic access decision was correct; and
receiving a confirmation response from the alternative user.

11. The data processing system of claim 2 , wherein the machine-readable medium includes instructions configured to cause the processor to perform operations of:
monitoring behavior of the content requestor after granting access to the content item by the content requestor;
determining that access to the content item should be revoked based on the behavior of the content requestor; and
automatically revoking access to the content item by the content requestor responsive to determining that the access to the content item should be revoked.

12. A data processing system comprising:
a processor; and
a machine-readable medium storing executable instructions that, when executed, cause the processor to perform operations comprising:
receiving an access request from a client device of a content requestor to access a content item for which access is managed by a content access management platform;
obtaining relationship information indicative of a relationship between a content owner and the content requestor;
sending a request to the client device of the content requestor for access justification information describing a reason the content requestor requires access to the content item;
receiving the access justification information from the client device of the content requestor;
analyzing the access justification information using a first machine learning model trained to receive the access justification information as an input, to perform a semantic analysis of the access justification information, and to output semantic information representing a meaning of the access justification information;
analyzing the relationship information and the semantic information using a second machine learning model trained to analyze the relationship information and to output an access determination score, the access determination score representing a level of certainty that the content requestor should be granted access to the content item;
determining an automatic access decision to grant or deny the access request based on the access determination score; and
notifying the content requestor whether the access request has granted or denied based on the automatic acce

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Doyle Darren
• Farrell Terry

Classifications

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title