Assigning privileges in an access control system

Inventors

Sanders, Matthew Westin • Yue, Chuan

Assignees

Colorado School of Mines

Abstract

An access control system may include a log data parser that receives log data observations in a cloud system and extract user-permission data from the log data observations. The system may also include a clustering unit that uses the user-permission data to generate one or more clusters, each cluster associated with one or more users. Alternatively, and/or additionally, the system may include a feature extractor and a classifier. The feature extractor may extract one or more features from the user-permission data. The classifier may generate predictions of permissions for the one or more users based on the extracted one or more features. The system may also include a policy generator that uses the output of the clustering unit and/or the classifier to generate an access control policy. The policy may be executed in the cloud system to control user's access to one or more services of the system.

Core Innovation

An access control system receives log data observations recorded in a cloud system and extracts user-permission data from the log data observations, where the observations include one or more user actions performed by one or more users in the cloud system. The system extracts one or more features from the user-permission data and generates predictions of permissions for the one or more users based on the extracted features, where each prediction includes one or more permissions associated with each user.

Using the predictions of permissions, the system generates one or more clusters and associates each cluster with the one or more users. The system then generates an access control policy by assigning permissions to each cluster, thereby deriving a policy from observed log data and permission predictions rather than using only static permission information.

In a related approach, the system generates access control policies based on at least one of the predictions of permissions, receives a request from a user device associated with a user, and executes the access control policy to determine whether to grant the request based on a permission of the user associated with the user device. The approach can further include classifier training and evaluation workflows that compare first permissions with first predictions across operation periods and compute precision, recall, and an F measure.

Claims Coverage

The independent claims cover four core aspects: extracting user-permission data from cloud log observations, deriving permissions via feature extraction and classifier-generated permission predictions, clustering users based on the predictions to generate cluster-based policy assignments, and executing the resulting policy to determine whether to grant requests for cloud services. The independent claims also cover variants where the policy is generated based on at least one set of permission predictions and includes classifier training and evaluation across operation periods.

Across the independent claims, the inventive core centers on deriving user-permission information from cloud log observations, transforming it into features, using a classifier to generate permission predictions, and then producing an access control policy, including cluster-based assignment, that is executed to determine whether to grant service requests. Additional independent-claim coverage supports policy generation from predicted permissions and classifier training and evaluation using permission/prediction comparisons and metrics.

Stated Advantages

Documented Applications