Method and system for risk-adaptive access control of an application action

Patent metadata

Field	Value
Publication number	US-9240996-B1
Application number	US-201313852865-A
Country	US
Kind code	B1
Filing date	Mar 28, 2013
Priority date	Mar 28, 2013
Publication date	Jan 19, 2016
Grant date	Jan 19, 2016

Abstract

Risk-adaptive access control techniques are disclosed. In various embodiments, a value for a threat level attribute is determined based at least in part on threat detection data generated by a security system or process. The determined value for the threat level attribute is used to make, at least in part, an access control decision with respect to a request to access the resource. In various embodiments, the threat level attribute is used as an environment attribute provided as input to an XACML-based access control system.

First claim

What is claimed is:

1. A method of controlling access to a resource, comprising:
setting one or more security policies for controlling access to the resource of an application, wherein the one or more security policies associate each of a plurality of access levels with a corresponding value for a threat level attribute;
receiving at an access control server, threat detection data from a security system or process via a communication interface, wherein the security system or process monitors network traffic received at a firewall;
determining, by a processor, based at least in part on the threat detection data received from the security system or process, a value for the threat level attribute, wherein the value for the threat level attribute is determined at least in part by performing a computation on the threat detection data and is determined based at least in part on comparing a degree to which recently observed behavior deviates from a baseline of normal behavior, wherein the normal behavior observed in a prior learning period;
receiving from the application, an access request that identifies a user of a client terminal, the resource of the application subject to the access request, and one or more actions requested associated with the resource of the application in response to the client terminal attempting to perform one or more actions with respect to the resource of the application over the communication network; and
determining, by the access control server, an access level of the plurality of access levels to apply to the resource of the application in response to receiving a request from the client terminal to access the resource over a communication network,
wherein the access level is determined based at least in part on the determined value for the threat level attribute, the identity of the user, the resource of the application subject to the request, the one or more actions requested associated with the resource of the application, and at least one of the one or more security policies.

2. The method of claim 1 , wherein determining the access level of the plurality of access levels to apply to the resource includes using the threat level attribute as an environment attribute provided as input to an XACML-based access control system.

3. The method of claim 1 , wherein the value for the threat level attribute is determined based at least in part on respective threat detection data generated by a plurality of security systems and/or processes.

4. The method of claim 1 , wherein the security system or process includes one or more of an intrusion detection system (IDS) and a network monitoring tool.

5. The method of claim 1 , wherein determining the access level of the plurality of access levels to apply to the resource includes applying a security policy identified based at least in part on an attribute associated with the access request.

6. The method of claim 1 , wherein the access control server determination is made based at least in part on respective attributes associated with one or more of the following: an action to be performed by the user with respect to the resource; and
an environment with which one or more of the user, the resource, and the request are associated.

7. The method of claim 1 , wherein the access control server determination is based at least in part on a security policy with which the request is associated.

8. The method of claim 1 , further comprising generating based on the access control server determination a response to the request to access the resource.

9. The method of claim 8 , wherein the response indicates the requested access is allowed with respect to the resource.

10. A system, comprising:
a processor configured to:
set one or more security policies for controlling access to a resource of an application, wherein the one or more security policies associate each of a plurality of access levels with a corresponding value for a threat level attribute;
receive threat detection data from the security system or process via a communication interface, wherein the security system or process monitors network traffic received at a firewall;
determine, based at least in part on the threat detection data received from the security system or process, a value for the threat level attribute, wherein the value for the threat level attribute is determined at least in part by performing a computation on the threat detection data and is determined based at least in part on comparing a degree to which recently observed behavior deviates from a baseline of normal behavior, wherein the normal behavior is observed in a prior learning period;
receive from the application an access request that identifies a user of a client terminal, the resource of the application subject to the access request, and one or more actions requested associated with the resource of the application in response to the client terminal attempting to perform one or more actions with respect to the resource of the application over the communication network; and
determine an access level of the plurality of access levels to apply to the resource of the application in response to receiving a request from the client terminal to access the resource over a communication network,
wherein the access level is determined based at least in part on the determined value for the threat level attribute, the identity of the user associated with the request to access the resource, the resource of the application subject to the request, the one or more actions requested associated with the resource of the application, and at least one of the one or more security policies; and

a memory or other storage device coupled to the processor and configured to store said threat detection data generated by said security system or process.

11. The system of claim 10 , wherein determining the access level of the plurality of access levels to apply to the resource includes using the threat level attribute as an environment attribute provided as input to an XACML-based access control system.

12. The system of claim 10 , wherein the value for the threat level attribute is determined based at least in part on respective threat detection data generated by a plurality of security systems and/or processes.

13. The system of claim 10 , wherein using the determined value for the threat level attribute to make, at least in part, an access control decision with respect to a request to access the resource includes applying a policy identified based at least in part on an attribute associated with the access request.

14. The system of claim 10 , wherein the access control determination is made based at least in part on respective attributes associated with one or more of the following: an action to be performed by the user with respect to the resource; and an environment with which one or more of the user, the resource, and the request are associated.

15. A computer program product embodied in a tangible, non-transitory computer-readable storage medium, comprising computer instructions for:
setting one or more security policies for controlling access to the resource of an application, wherein the one or more security policies associate each of a plurality of access levels with a corresponding value for a threat level attribute;
receiving the threat detection data from a security system or process via a communication interface, wherein the security system or process monitors network traffic received at a firewall;
determining, based at least in part on threat detection data generated by a security system or process, a value for the threat level attribu

Assignees

• Emc Corp

Inventors

• Sinnema Rémon

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title