Trust-based dynamic access control system

Patent metadata

Field	Value
Publication number	US-12425409-B2
Application number	US-202218058168-A
Country	US
Kind code	B2
Filing date	Nov 22, 2022
Priority date	Nov 22, 2022
Publication date	Sep 23, 2025
Grant date	Sep 23, 2025

Abstract

Systems and methods are provided for creating and running an instance of a dynamic access control system (DACS). Trust providers may be defined in a trust broker of the DACS such that trust information associated with the trust providers can be used to create a custom data structure. Resources and resource groups may be defined in the DACS. Policies may be configured or coded in the DACS to map the custom data structure to recourses or resources groups. Additionally, policies may be configured or coded in the DACS to route the data structure and request to network segments or shared with other parties.

First claim

What is claimed is:

1. A system comprising:
computer-readable memory storing executable instructions; and
at least one computing device in communication with the computer-readable memory and programmed by the executable instructions to:
receive, from a device of a user, a request to access a network application;
receive, associated with the request, trust information generated by one or more trust providers, wherein the trust information represents at least:
first identity information regarding the user; and
second identity information regarding the device;

create a trust information data structure using the first identity information and the second identity information;
access a network application policy, wherein the network application policy maps the trust information data structure to one or more of (i) an access level of the network application, (ii) an access level to a network segment of a cloud provider network, (iii) routing instructions to a network firewall, or (iv) routing instructions to a network router;
transform the request based on the trust information data structure, wherein the transformation comprises a change to at least one of role, security context, and destination Internet protocol address;
determine access or routing information based at least in part on the network application policy and the trust information; and
perform an access or routing action based at least partly on the access or routing information.

2. The system of claim 1 , wherein the trust information generated by the one or more trust providers is provided, via a hypertext transfer protocol request, by a browser extension executing on the device of the user.

3. The system of claim 1 , wherein the access or routing information comprises at least one of:
an access level of the network application;
an access level to a network segment;
routing instructions to a network firewall;
routing instructions to a network router; or
a denial of access to the network application.

4. The system of claim 1 , wherein the access or routing action comprises at least one of:
providing the user with a level of access to the network application;
providing the user access to a network segment;
routing the trust information to a network firewall;
routing the trust information to a network router; or
denying access to the network application.

5. A computer-implemented method comprising:
under control of a computing system associated with a cloud provider network, the computing system comprising one or more computer processors configured to execute specific instructions:
receiving a request directed to a network resource on the cloud provider network, the request comprising first trust information representing one or more properties of a source of the request;
generating second trust information based at least partly on the first trust information and additional trust information obtained separately from the request, wherein the additional trust information is associated with the source of the request;
transforming the request based on the second trust information to change at least one of role, security context, and destination Internet protocol address; and
determining an action to be taken regarding the transformed request based on evaluation of the second trust information.

6. The computer-implemented method of claim 5 , further comprising determining, from the first trust information, a property of the one or more properties of the source of the request, wherein the property comprises: an identity of a user account, a property of the user account, an identity of a device, or a property of the device.

7. The computer-implemented method of claim 5 , further comprising accessing the additional trust information based at least partly on an association between the additional trust information and the source of the request, wherein the additional trust information comprises: a history of the source of the request, a security risk score associated with the source of the request, or a location of the source of the request.

8. The computer-implemented method of claim 5 , further comprising receiving the additional trust information prior to receiving the request.

9. The computer-implemented method of claim 5 , wherein generating the second trust information comprises generating a trust information data structure using a plurality of trust information items selected by a client associated with the network resource.

10. The computer-implemented method of claim 5 , wherein transforming the request with the second trust information to generate the transformed request comprises adding the second trust information to one or more headers of the request.

11. The computer-implemented method of claim 5 , wherein transforming the request with the second trust information to generate the transformed request comprises adding the second trust information to one or more encapsulation headers, wherein a packet of the request is encapsulated for transmission.

12. The computer-implemented method of claim 5 , further comprising removing, from the request, a header comprising at least a portion of the first trust information.

13. The computer-implemented method of claim 5 , wherein determining the action to be taken regarding the transformed request based on evaluation of the second trust information comprises determining to transmit the transformed request to the network resource based on the second trust information satisfying an access policy.

14. The computer-implemented method of claim 5 , wherein determining the action to be taken regarding the transformed request based on evaluation of the second trust information comprises determining to transmit the transformed request to a firewall configured to apply an access policy to determine whether to transmit the transformed request to the network resource.

15. The computer-implemented method of claim 5 , wherein determining the action to be taken regarding the transformed request based on evaluation of the second trust information comprises determining to transmit the transformed request over a segment of a plurality of segments of the cloud provider network, the segment selected based on the second trust information satisfying an access policy.

16. A system comprising:
computer-readable memory storing executable instructions; and
one or more processors in communication with the computer-readable memory and programmed by the executable instructions to:
receive a request directed to a network resource on a network, the request comprising first trust information representing one or more properties of a source of the request;
generate second trust information based at least partly on the first trust information and additional trust information obtained separately from the request, wherein the additional trust information is associated with the source of the request;
transform the request based on the second trust information to change at least one of role, security context, and destination Internet protocol address; and
determine an action to be taken regarding the transformed request based on evaluation of the second trust information.

17. The system of claim 16 , wherein the one or more processors are further programmed by the executable instructions to determine, from the first trust information, a property of the one or more properties of the source of the request, wherein the property comprises: an identity of a user account, a property of the user account, an identity of a device, or a property of the device.

18. The s

Assignees

• Amazon Tech Inc

Inventors

• Das Shovan Kumar
• Szmajda Jessica Kira
• Deb Bashuman
• Bolisetti Sujan
• Kulkarni Shridhar
• Qian Baihu
• Larue Brandon Michael
• Saville Stephen A

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title