Least privilege resource permission management

Abstract

A minimum permission required for an identity, such as a user account, application, user group, or process, to access resources of a tenant of a cloud service is determined from a predicted future resource usage. The predicted future resource usage is based on a resource usage history of the identity, a resource usage history of similar identities, and a resource usage history of peers of the identity. Similar identities are determined from a graph embedding of nodes representing assigned permissions of identities to resources and usage activity at the resources. The permissions required to perform the predicted future resource usage are compared to current permission assignments to determine an absolute minimum permission required for the identity to its current ongoing and future workflows.

Description

Background Technology

[0001] The widespread adoption of the internet has transformed the workplace. An organization's information technology (IT) resources can be hosted on cloud services, enabling access from any location, across different types of applications (e.g., web-based, mobile, desktop applications) and different types of devices (e.g., mobile devices, Internet of Things (IoT), desktop computers, laptops, etc.). While cloud services offer increased productivity in the workplace, their complexity introduces various security vulnerabilities that need to be overcome to protect network resources. One such vulnerability arises when broad permissions are granted to user accounts, applications, or processes that exceed the necessary permissions to perform legitimate, intended tasks. Such broad permission assignments can lead to unintentional and malicious alterations and data breaches. Summary of the Invention

[0002] The summary portion of this invention provides a simplified overview of the chosen concepts, which will be further described in the detailed embodiments below. This summary portion is not intended to identify key or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter.

[0003] An identity, such as a user account, application, user group, or process, requires the minimum permission to access a tenant's resources in a cloud service based on predictions of that identity's future resource usage. These predictions are based on the identity's resource usage history, the resource usage history of similar identities, and the resource usage history of the identity's peers. The permission required for an identity to perform these predicted future resource uses is then compared to the current permissions assigned to that identity to determine the absolute minimum permission required for that identity's ongoing workflow.

[0004] Resource usage by similar identities is a good predictor of future activities an identity may perform on a resource. To determine which identities have similar usage behaviors, a graph representing the permission assignments of identities to tenant resources in a cloud service is generated. This graph includes nodes and edges, where nodes represent identities, permissions, or resources, and edges identify the permissions assigned to resources and the identity's usage activities on those resources. Random walks are used to generate paths representing unsupervised samples trained on a deep learning-based model to compute node embeddings that capture the context and semantic similarity of the data represented in the graph.

[0005] The differences in node embeddings are used to identify similar identities with similar resource usage. The resource usage history of similar identities is a good predictor of the future activities that an identity may need in its ongoing workflow. The permissions required to execute the predicted future activities can be used to determine the absolute minimum permissions.

[0006] These and other features and advantages will become apparent from reading the following detailed description and viewing the accompanying drawings. It should be understood that the above general description and the following detailed description are merely illustrative and not intended to limit the claimed aspects. Attached Figure Description

[0007] Figure 1 An exemplary system is shown that automatically determines the minimum permission permissions for accessing resources within a cloud environment.

[0008] Figure 2A It is an exemplary identity-resource-permission graph with nodes and edges, where edges represent permission assignments.

[0009] Figure 2B It is an exemplary identity-resource-license graph with nodes and edges, where edges represent license assignment and usage activities.

[0010] Figure 3 This is a flowchart illustrating an exemplary method for determining the minimum permission granted for an identity.

[0011] Figure 4 This is a flowchart illustrating an exemplary method for deriving a similarity score for each identity.

[0012] Figure 5 This is a flowchart illustrating an exemplary method for predicting the future use of resources based on identity.

[0013] Figure 6 This is a block diagram illustrating an exemplary operating environment. Detailed Implementation

[0014] Overview

[0015] Several aspects of this invention address the identification of the absolute minimum permissions required for an identity (e.g., user account, process, user group, and application) to perform legitimate tasks within a computing environment. Least privileges ensure access to resources hosted in a computing environment with the minimum set of permissions required to perform the intended action on those resources. This protects resources from security risks such as data leakage and data loss.

[0016] On one hand, a computing environment is a cloud service that hosts resources for multiple tenants. A tenant is a directory associated with an enterprise, organization, group, user account, or entity that subscribes to a cloud service. A subscription is a logical entity that grants access rights to resources. A tenant contains resources grouped into a subscription, such as virtual machines, applications, application programming interfaces (APIs), storage accounts, services, etc. An identity is a user account, user group, application, or process that has been granted one or more permissions to access resources.

[0017] Cloud services host tenants' resources and control access to those resources. Examples of cloud services include, but are not limited to, Microsoft. Google Cloud Platform TM Serve, Resources are entities managed by cloud services, such as virtual machines, virtual networks, storage accounts, databases, web-accessible applications, and services. Resources may belong to resource groups or subscriptions. Resource groups are logical groupings of resources, allowing them to be managed as a single entity.

[0018] Access to resources is controlled through role assignment. Each identity is assigned a role, which includes a set of permissions. A permission set can include zero or more permissions. Roles are assigned at the scope level. A scope can include a single resource or a group of resources, such as a resource group or subscription. For example, the Owner role has all permissions associated with a resource and the right to delegate those permissions to others. The Contributor role has the permissions required to create and manage a resource, but cannot grant access to that resource to others. The Reader role has permissions that allow reading of resources.

[0019] Initially, if no role is assigned to an identity, a default set of permissions may be assigned to it. This default set of permissions may include rights that the identity does not need to perform its tasks. Granting roles extensive permissions that exceed what the identity needs to perform its tasks can create security risks. The technique described in this paper reduces the set of permissions granted to an identity based on its resource usage history, the resource usage history of other identities accessing similar resources, and the resource usage history of its peers, thereby identifying an appropriate set of permissions that will not compromise the identity's work.

[0020] Attention now turns to a further discussion of the systems, devices, components, and methods used to determine the absolute minimum permission for an identity.

[0021] system

[0022] Figure 1 A block diagram of an exemplary system 100 in which various aspects of the invention can be practiced is shown. System 100 may be configured with a cloud service 102 that operates in a multi-tenant environment serving multiple customers of a service tenant. Cloud service 102 provides services to users on demand via a publicly accessible network such as the Internet.

[0023] Tenants 116A-116N (“116”) are directories associated with an enterprise, organization, group, user, or entity subscribing to cloud service 102. Tenant 116 contains resources, such as virtual machines, applications, application programming interfaces (APIs), storage accounts, services, etc., which are grouped into subscriptions. A subscription is an object representing a folder containing resources. Tenant 116 may have multiple subscriptions. Cloud service 102 manages tenant subscriptions and controls access to the resources contained in the subscriptions. Subscriptions can be based on paid or free services and last for a specified duration. Examples of cloud services include, but are not limited to, Microsoft. Google Cloud Platform TM Serve, wait.

[0024] Cloud service 102 includes one or more cloud servers 108A-108N (“108”) that facilitate the hosting of tenant resources. Cloud server 108 may be part of a data center providing distributed computing services such as cloud computing services. The data center can provide pooled resources, on which customers or tenants can dynamically configure and scale applications as needed without adding servers or additional networking. The data center can be configured to communicate with local computing devices used by cloud consumers, including personal computers, mobile devices, embedded systems, or other computing devices. Within the data center, computing devices can be configured as servers, which can be standalone devices or individual blades in a rack of one or more other server devices. Tenants may initially use a virtual machine on a server to run applications. When demand increases, the data center can activate additional virtual machines on the server or other servers, and when demand decreases, the data center can deactivate the virtual machines.

[0025] A data center can be a local, proprietary system serving a single enterprise user, a publicly (or semi-publicly) accessible distributed system serving multiple potentially unrelated customers and tenants, or a combination of both. Furthermore, a data center may be contained within a single geographic location or distributed across multiple locations globally, providing redundancy and disaster recovery capabilities. For example, a data center can designate a virtual machine on a server as the primary location for a tenant's application, and can activate another virtual machine on the same or another server as a secondary or backup in the event of a failure of the first virtual machine or server.

[0026] Tenant 116 can communicate with other devices, including each other or with devices located outside cloud service 102 via network 104 (e.g., the Internet). In one example, tenant 116 can communicate with other devices via an assigned network address (e.g., an assigned Internet Protocol (IP) address). In one example, a user of device 106 can log in to tenant 116 and access resources 114A-114N (“114”). In some examples, resource 114 is available to authorized users, and users can impose further restrictions on each authorized user for each resource in cloud service 102 via permissions from a set of permission levels.

[0027] Management service 112 helps users log in and access resources 114 of tenant 116, including external resources, such as Software as a Service applications and applications on tenant networks and intranets, such as through Single Sign-On (SSO). In one aspect, management service 112 provides features similar to domain directory services, such as user group configuration, authentication, and authorization. However, management service 112 differs from domain directory services because domain directory services cannot manage web-based services.

[0028] Management service 112 is configured to support web-based services, such as REST (Representational State Transfer) APIs (Application Programming Interfaces) for many Software-as-a-Service applications. Management service 112 uses protocols different from those of the domain directory service. For example, management service 112 can work with protocols that enable web-based services, such as authentication protocols including Security Assertion Markup Language (SAML), Open Authorization (OAuth), identity layers on top of OAuth protocols such as OpenID Connect, and Web Services Federation (WS-Federation). On one hand, each tenant can apply an instance of the management service, such as a tenant's directory 118. Directory 118 can be configured to include tenant users, groups, and applications, and can perform management functions for identifying and accessing tenant resources.

[0029] User device 106 communicates with the cloud service via a REST API. The REST API is used to request information or access resources from cloud service 102 using the Hypertext Transfer Protocol (HTTP) method. Cloud service 102 responds by returning an HTTP response. The REST API is transmitted to endpoint 120 of cloud service 102. Endpoint 120 is the port through which the device connects to the services hosted by cloud service 102. Endpoint 120 is addressed by a Uniform Resource Locator (URL), which user device 106 uses to access resources or services hosted by cloud service 102. Cloud service 102 may have multiple endpoints 120. In one aspect, endpoint 120 is an API endpoint, each configured to receive requests via a specified REST API.

[0030] Management service 112 enables cloud service customers (i.e., organizations, entities, tenants, etc.) to deploy, manage, and monitor their resources as a group, and control access to those resources. Management service 112 manages resources through role assignment. A role is a set of permissions that identifies actions or operations that can be performed on a resource. Roles are assigned at the scope level. Roles can be assigned to all resources in a subscription, to a single resource, or to all resources in a group of resources. Role assignment file 126 includes the role assignments made for each identity in each subscription.

[0031] The built-in role file 128 includes a list of available roles within cloud service 102 and the licenses contained within each role. For example, in Microsoft... Cloud services have 70 built-in roles. Four commonly used roles are: Owner; Contributor; Reader; and User Access Administrator. The Owner role grants full access to all resources and the ability to grant access to others. There are no prohibited actions. The Contributor role grants permission to create and manage all types of resources according to security principles, but does not grant access to resources to others. The Reader role grants read-only permission to resources. The User Access Administrator role grants permission to manage user access to resources.

[0032] Other exemplary roles include: Classic Virtual Machine Contributor, which allows management of classic virtual machines but not access to them or the virtual networks or storage accounts to which they are connected; SQL Server Contributor, which allows management of SQL Server and databases but not access to SQL Server and databases or their security-related policies; and DataPurger, which allows the purging of analytical data.

[0033] Resource log 124 contains all actions performed on resource 114 by an identity. Each time resource 114 is accessed and used, an entry is written to resource log 124. Each subscription, each resource group, or each resource can have its own resource log. Entries in resource log 124 can identify the identity accessing the resource, the action performed by that identity, and the time of access. Entries in resource log 124 are used to obtain the resource usage history of an identity.

[0034] Organization chart 122 identifies peers of users or user accounts that utilize the resources of cloud service 102 within an entity or organization. Alternatively, organization chart 122 may be a list of related user groups working on the same project.

[0035] Cloud service 102 may include a least privilege license management component 130, which identifies the appropriate set of licenses for an identity. The least privilege license management component 130 may include a license management engine 132 and an identity-resource-license graph 134. The license management engine 132 identifies the appropriate set of licenses for an identity based on predicted future resource usage. The identity-resource-license graph identifies the licenses granted to each resource and identity, as well as the identity's usage activities on each resource.

[0036] It should be noted that Figure 1 System components are shown in one aspect of an environment in which various aspects of the invention can be practiced. However, in practice Figure 1 The various aspects of the configuration shown and their changes may not be necessary. Figure 1 The exact configuration of the components shown is illustrated, and the types of components that can be manufactured without departing from the spirit or scope of the invention. For example, this disclosure is not limited to cloud services, and the techniques described herein can be practiced with other systems that use licenses to control access to shared resources.

[0037] Figure 2A and Figure 2B An exemplary identity-resource-license graph is shown. The identity-resource-license graph is a directed acyclic graph where nodes are connected by edges. There are three types of nodes. The first node type (type 1) represents an identity, which can be a user account, application, process, or user group. The second node type (type 2) represents one or more licenses, and the third node type (type 3) represents a resource. There are two types of edges. The first edge type represents an assignment relationship between two connected nodes. The second edge type represents the usage activity associated with the two connected nodes.

[0038] like Figure 2AAs shown, Figure 200 has nodes 202, 204, and 206 and edges 208 and 210. Node 202 is a Type 1 node representing a user account, application, or user group. Node 204 is a Type 2 node representing one or more permissions, and node 206 is a Type 3 node representing a resource. Edges 208 and 210 are assignment edges. Edge 208 indicates that a read permission has been assigned to user account A, while edge 210 indicates that the read permission is for resource B.

[0039] Figure 2B Graph 212 is shown, which has assignment and usage edges. Graph 212 has... Figure 2A The same nodes and assignment edges are shown, but edge 214 has been added. Edge 214 connects identities to resources and indicates the identity node's usage activity on the resource. Figure 2B As shown, edge 214 indicates that user account A read resource B 5 times in the past week. Edge 214 can indicate the permissions used (e.g., read, write, read / write, all), the frequency of access (e.g., 5 times, twice a day, three times a week), and the time span of the usage activity (e.g., in the past week, in the past 2 days).

[0040] method

[0041] Attention now turns to the description of various exemplary methods utilizing the systems and devices disclosed herein. The operation of these aspects can be further described with reference to various exemplary methods. It will be understood that the representative methods need not necessarily be performed in the order presented or in any particular order, unless otherwise stated. Furthermore, the various activities described with respect to the methods can be performed in a serial or parallel manner, or in any combination of serial and parallel operations. In one or more aspects, the method illustrates the operation of the systems and devices disclosed herein.

[0042] Figure 3 The illustration depicts an exemplary method 300 for determining the minimum permission granted for an identity. (Reference) Figure 1 and Figure 3 The license management engine 132 generates an identity-resource-license graph 134 (box 302) for each tenant. Initially, the identity-resource-license graph 134 contains nodes representing user accounts, applications, processes, and user groups, and edges representing license assignments for resources. The license management engine 132 obtains user accounts, applications, processes, and user groups configured with permissions to access resources within a specific tenant. The license management engine 132 can obtain the identity associated with the tenant from directory 118 and the license assignment from role assignment file 126.

[0043] In some aspects, cloud services may include a role-based access control system (RBAC) and / or an identity and access management (IAM) system (not shown). An RBAC system contains user accounts, applications, processes, and user groups authorized to access resources, as well as permissions granted to each identity through their assigned roles. Additionally, identities may be obtained from an identity and access management system (IAM) associated with the cloud service, which facilitates the management of digital identities.

[0044] The license management engine 132 overlays usage activity for each resource onto the identity-resource-license graph 134 (box 304) by adding usage edges between identities and resources. The usage edges represent the license used to access the resource, the frequency of access, and the time period during which the access occurs. Usage activity can be obtained from the resource logs 124 in the management service 112. Alternatively, usage activity can be obtained from tenants who track usage activity.

[0045] Next, the license management engine 132 identifies similar identities for each identity (box 306). The license management engine 132 then derives a similarity score for each identity. The similarity score is used to identify identities with similar resource usage. Identity accessing similar resources receives a high score, while identity using different resources receives a low score. A similarity score is generated for each identity node in the graph. The differences in similarity scores for identity nodes are then used to identify those identities with similar resource usage behavior.

[0046] Figure 4 The illustration shows an exemplary method 400 for generating similarity scores for each identity. (Go to...) Figure 1 and 4 The license management engine 132 generates a node embedding (box 402) for each identity in the identity-resource-license graph.

[0047] Graphs are a natural representation of sets of entities and the relationships between them. Representation learning is a technique that integrates information from graphs into deep learning-based machine learning models, such as node embeddings for each identity node in an identity-permission-resource graph. Node embeddings are low-dimensional representations of discrete data found in the graph; the embeddings are continuous vectors of real numbers. Similar nodes will have similar node embeddings. Node embeddings are then used to identify similar nodes based on the distance between their respective vector representations.

[0048] The computation of node embeddings in a graph can be mathematically represented as a maximum likelihood optimization problem. Let G = (V, E) denote identity resource permission G, where vertices or nodes are V and edges are E. There exists a path from node V to feature representations... mapping function Where d is the number of dimensions in the feature representation. For each node u∈V, the network neighbors Ns(u) of node u are generated by a neighbor sampling policy S, such as a normalized random walk. Using scalar gradient descent optimization, the following objective function is optimized by maximizing the log probability of observing the network neighbors Ns(u) of node u, conditioned on the feature representation of node u:

[0049] f: max f ∑ u∈V log P(Ns(u)|f(u)).

[0050] Random walks are used to represent the inherent structure and relationships in an identity-resource-permission graph. A random walk begins with a randomly selected node and moves to a random neighbor within a predefined number of steps. Random walks generate paths through a graph of given length, thus producing samples for learning feature representations of the nodes. These samples capture the contextual and semantic relationships between nodes, such as permissions assigned to perform actions on a resource by an identity and each identity's usage activities on the resource.

[0051] A random walk W starting from a source node r∈V of given length l can be represented as W. Let w j It is the j-th node in W that is visited, where w0 = r is the first node in W. Node w j The probability P(w) can be normalized. j |w j-1 )generate:

[0052]

[0053] The degree of node v is denoted as d(v), and N(v) represents the set of neighboring nodes v. It is a normalization term.

[0054] The path W generated by the random walk n ={W (t-2) W (t-1) , ..., W t .W (t+1) W (t+2) The input is fed into the encoder. On one hand, the encoder is a Word2Vec model. The Word2Vec model is a convolutional neural network that uses an embedding learning algorithm to generate node embeddings. On the other hand, the Continuous Bag-of-Words (CBOW) algorithm is used. CBOW is a predictive deep learning-based encoder that computes continuous dense vector representations of words, which capture context and semantic similarity. However, it should be noted that the techniques described in this paper are not limited to a specific encoder and other encoders such as node2vec, doc2vec, and FastText can also be utilized.

[0055] Once node embeddings are generated for each identity, a similarity score is generated for each pair of identities (box 404). The similarity score is calculated as the reciprocal of the difference between the two node embeddings. The similarity score can be represented as l / (Ni-Nj), where Ni is the node embedding of node i and Nj is the node embedding of node j. The difference (Ni-Nj) can be calculated as cosine similarity, LI norm, or L2 distance. The similarity score is used to identify similar identities with similar resource usage (box 406). Identity with a high similarity score is considered similar, while identity with a low similarity score is considered dissimilar.

[0056] Back Figure 3 After finding similar identities, the license management engine 132 determines the predicted future usage of the identity based on the resource usage history of the similar identities, the resource usage history of the identity itself, and the resource usage history of the identity's equivalents (box 308). [Turn] Figure 1 and Figure 5 The diagram illustrates a method 500 for predicting future use in calculating identity.

[0057] For each identity, the permission management engine 132 finds the resource usage history for each similar identity, the resource usage history for each peer of that identity, and the resource usage history for that identity (box 502). The resource usage history can be obtained from the resource log 124 in the management service 112 or from the tenant 116. The resource usage history indicates the resources accessed, the permissions used to access the resources, the frequency of access, and the time period during which the access was performed.

[0058] In addition, the license management engine 132 finds peers for the identity from the organization diagram 122. An identity can be associated with an organization such as a business or group that accesses resources with a consistent set of licenses. The organization diagram 122 can indicate other identities associated with the target identity. In one aspect, the organization diagram 122 can relate to members of an organization, entity, project, or group. However, in other aspects, the organization diagram 122 can represent associations or groupings of identities that are related in some way. Once peers are found (if any), the license management engine 132 obtains the resource usage history for each peer associated with the target identity. The peer's resource usage history indicates each resource accessed, the license used to access the resource, the frequency of access, and the time period (collectively referred to as box 502).

[0059] For each identity, the license management engine 132 finds an aggregate set of licenses for accessing its similar identities, its peers, and resources used by itself. The license management engine 132 then uses this aggregate set of licenses as a predicted future use for that identity (collectively referred to as box 504).

[0060] return Figure 1 and Figure 3 Once the predicted future use of an identity is generated, the least privilege set of permissions is calculated. For example, if a resource is only read and not modified, and the identity has a permission to modify it, the least privilege permission for that resource will be changed to a read permission. The permission management engine 132 compares the permissions granted to the identity with the permissions for the predicted future use to determine the absolute minimum permissions required for the identity to perform its tasks (collectively referred to as box 310).

[0061] Once the absolute minimum permissions are identified, the roles corresponding to these permissions are determined (box 312). If the configuration of the role for an identity changes, the role can be reconfigured (box 314). The permission management engine 132 can provide a notification that publishes recommendations for changing roles and / or permissions (box 314). Alternatively, the permission management engine 132 can reconfigure roles and / or permissions automatically or with user confirmation (box 314).

[0062] Demonstration operating environment

[0063] Now let’s turn our attention to the discussion of the exemplary operating environment. Figure 6 An exemplary operating environment 600 is illustrated, in which a cloud service 602 is used to determine the minimum permission for identity verification. The cloud service 602 may include one or more computing devices 608, 624 coupled to a network 622. The cloud service may be coupled to one or more user devices 606 (i.e., computing devices) via a global network 604. However, it should be noted that the aspects disclosed herein are not limited to any particular configuration of the devices, and other configurations are possible.

[0064] Computing devices 606, 608, and 624 can be any type of electronic device, such as, but not limited to, mobile devices, personal digital assistants, mobile computing devices, smartphones, cellular phones, handheld computers, servers, server arrays or server clusters, web servers, network servers, blade servers, internet servers, workstations, minicomputers, mainframe computers, supercomputers, network devices, web devices, Internet of Things (IoT) devices, distributed computing systems, multiprocessor systems, or combinations thereof. The operating environment 600 can be configured in a network environment, a distributed environment, a multiprocessor environment, or in a standalone computing device that can access remote or local storage devices.

[0065] Computing devices 606, 608, and 624 may include one or more processors 610, 626, and 646; one or more communication interfaces 612, 628, and 648; one or more storage devices 614, 630, and 650; one or more input / output devices 618, 632, and 652; and one or more memory devices 616, 634, and 654. Processors 610, 626, and 646 may be any commercially available or custom-made processor and may include dual-microprocessor and multiprocessor architectures. Communication interfaces 612, 628, and 648 facilitate wired or wireless communication between the computing device and other devices.

[0066] Storage devices 614, 630, and 650 may be computer-readable media that do not contain propagation signals such as modulated data signals transmitted via a carrier wave. Examples of storage devices 614, 630, and 650 may include, but are not limited to, RAM, ROM, EEPROM, flash memory or other storage technologies, CD-ROM, digital versatile disk (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, and disk storage, all of which do not contain propagation signals such as modulated data signals transmitted via a carrier wave. Multiple storage devices may be present in a computing device. Input / output devices 618, 632, and 652 may include keyboards, mice, pens, voice input devices, touch input devices, displays, speakers, printers, and any combination thereof.

[0067] Memory devices 616, 634, and 654 can be any non-transitory computer-readable storage medium capable of storing executable processes, applications, and data. Computer-readable storage media are not propagated signals such as modulated data signals transmitted over a carrier wave. They can be any type of non-transitory storage device (e.g., random access memory, read-only memory, etc.), magnetic storage, volatile storage, non-volatile storage, optical storage, DVDs, CDs, floppy disk drives, etc., which are not propagated signals such as modulated data signals transmitted over a carrier wave. Memory devices 616, 634, and 654 may also include one or more external memory devices or remote memory devices, which are not propagated signals such as modulated data signals transmitted over a carrier wave.

[0068] Memory device 616 may include an operating system 620 and applications and data 621. Memory device 634 may include an operating system 636, management services 638, a license management engine 640, an identity-resource-license graph 642, and other applications and data 644. Memory device 654 includes an operating system 656 and other applications and data 658.

[0069] Networks 604 and 622 can be configured as ad hoc networks, intranets, extranets, virtual private networks (VPNs), local area networks (LANs), wireless LANs (WLANs), wide area networks (WANs), wireless wide area networks (WWANs), metropolitan area networks (MANs), the Internet, part of the public switched telephone network (PSTN), ordinary old-style telephone service (POTS) networks, wireless networks, etc. A network or any other network type or combination of networks.

[0070] Networks 604 and 622 can employ a variety of wired and / or wireless communication protocols and / or technologies. The network may employ various communication protocols and / or technologies, including but not limited to Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Enhanced Data GSM Environment (EDGE), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access 2000 (CDMA-2000), High-Speed ​​Downlink Packet Access (HSDPA), Long Term Evolution (LTE), Universal Mobile Telecommunications System (UMTS), Evolution-Data Optimized (Ev-DO), Global Microwave Access Interoperability (WiMax), Time Division Multiple Access (TDMA), Orthogonal Frequency Division Multiplexing (OFDM), Ultra Wideband (UWB), Wireless Application Protocol (WAP), User Datagram Protocol (UDP), Transmission Control Protocol / Internet Protocol (TCP / IP), any part of the Open Systems Interconnection (OSI) model protocol, Session Initiation Protocol / Real-Time Transport Protocol (SIP / RTP), Short Message Service (SMS), Multimedia Messaging Service (MMS), or any other communication protocol and / or technology.

[0071] Technical effect

[0072] The technical problem addressed by the subject matter disclosed herein is determining the absolute minimum permission required for an identity to access a resource without disrupting its ongoing and future workflows. Technical features related to solving this problem involve predicting the actions an identity will perform on a resource in the future and the permissions required to perform those actions. This predicted future resource usage is based on actions taken by similar identities.

[0073] Resource usage history of similar identities is a good predictor of future activities an identity can perform on a resource. Similar identities are identified using the differences in node embeddings of the graph shown below, which represents permissions assigned to a resource, resource usage activities, and permissions used to access the resource. The node embeddings are generated from a deep learning-based model that considers the contextual and semantic similarity between the identities represented in the graph.

[0074] In addition to the resource usage history of similar identities, the predicted future resource usage also considers the resource usage history of the identity and its peers. The permissions required to execute the predicted future resource usage are compared with the current permission assignments to determine the absolute minimum permissions required by the identity without interrupting its ongoing and future work.

[0075] in conclusion

[0076] A system is disclosed, comprising: one or more processors coupled to memory, and one or more programs. The one or more programs are stored in memory and configured to be executed by the one or more processors. The one or more programs include instructions that: represent the assignment of permissions to multiple identities in a graph to authorize actions to be performed on resources of a tenant of a cloud service, the graph having nodes and edges, nodes representing identities, permissions, or resources, and edges representing the assignment of permissions or usage activities of an identity to a resource; finding one or more similar identities as a first identity through node embedding of each identity in the graph; predicting future resource usage of the first identity based on the usage activities of the one or more similar identities; and deriving an absolute minimum permission for the first identity based on the predicted future usage.

[0077] In one aspect, one or more procedures include further instructions to generate node embeddings using an encoder trained on multiple random walk-generated paths. In another aspect, one or more procedures include further instructions to determine the similarity between the first identity and the second identity based on the difference between the node embeddings of the first identity and the node embeddings of the second identity.

[0078] On the other hand, one or more procedures include the following further instructions: comparing the permissions assigned to a primary identity with the permissions associated with the anticipated future resource usage; and configuring an absolute minimum permission to facilitate the anticipated future resource usage. An identity represents a user account, user group, application, or process.

[0079] In another aspect, one or more procedures include the following further instructions: predicting future resource usage of a first identity based on its resource usage history. Furthermore, one or more procedures include the following further instructions: predicting future resource usage of a first identity based on the resource usage history of its peers.

[0080] A method is disclosed, comprising generating a graph representing permission assignments to resources of a tenant of a cloud service, the graph having nodes and edges, nodes representing identities, permissions, or resources, and edges representing permission assignments or resource usage activities of an identity to a resource; computing a node embedding for each node representing an identity; using the node embeddings to identify one or more similar identities of a first identity; and deriving a minimum permission for the first identity based on the permissions used in the resource usage history of one or more similar identities.

[0081] The method further includes determining a first similar identity based on the inverse of the difference between the node embedding of the first similar identity and the node embedding of the first identity. The least privilege permissions for the first identity are further based on permissions used in the resource usage history of the first identity and permissions used in the resource usage history of the peers of the first identity. In some aspects, the node embeddings are derived using a convolutional neural network. Furthermore, the node embeddings are trained from paths generated by random walks of the graph. In one aspect, the convolutional neural network uses a continuous bag-of-words technique to derive the node embeddings. Identity represents a user account, user group, application, or process.

[0082] A computing device is disclosed, comprising at least one processor and memory. The at least one processor is configured to: represent permissions assigned to identities for resources in a graph having nodes and edges, where nodes represent identities, permissions, or resources, and edges represent the assignment of permissions to perform actions on resources; overlay usage activities for each resource onto the graph; map paths through the graph to node embeddings of each identity node using an encoder; determine similar identities in the graph based on differences between the node embeddings of a first identity and the node embeddings of other identities in the graph; and generate a minimum permission for the first identity based on predicted future resource usage of the first identity, the predicted future resource usage being based on the resource usage history of similar identities.

[0083] In one respect, the encoder is a word2vec encoder, and the identity represents a user account, process, user group, or application. In some respects, the predicted future resource usage is further based on the resource usage history of the first identity. In other respects, the predicted future resource usage is further based on the resource usage history of the peer of the first identity.

[0084] Although this disclosure has been described in language specific to structural features and / or methodological actions, it is to be understood that the subject matter defined by the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features or actions described above are disclosed as examples of implementing the claims.

Claims

1. A system comprising: one or more processors coupled to memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions to: represent, in a graph, assignments of permissions to a plurality of identities to perform actions on resources of a tenant of a cloud service, the graph having nodes and edges, nodes representing identities, permissions, or resources, and edges representing assignments of permissions or usage activities of identities on resources; find, as a first identity, one or more similar identities through node embeddings of each identity in the graph; predict future resource usage of the first identity based on usage activities of the one or more similar identities; and derive an absolute minimum permission for the first identity based on the predicted future usage.

2. The system of claim 1, wherein the one or more programs include further instructions to generate node embeddings with an encoder trained on a plurality of random walk generated paths.

3. The system of claim 1, wherein the one or more programs include further instructions to: determine that the first identity and a second identity are similar based on a difference between a node embedding of the first identity and a node embedding of the second identity.

4. The system of claim 1, wherein the one or more programs include further instructions to compare permissions assigned to the first identity and permissions associated with the predicted future resource usage; and configure the absolute minimum permission to facilitate the predicted future resource usage.

5. The system of claim 1, wherein identities represent user accounts, groups of users, applications, or processes.

6. The system of claim 1, wherein the one or more programs include further instructions to predict the future resource usage of the first identity based on a resource usage history of the first identity.

7. The system of claim 1, wherein the one or more programs include further instructions to predict the future resource usage of the first identity based on a resource usage history of peers of the first identity.

8. A method comprising: generating a graph representing assignments of permissions to resources of a tenant of a cloud service, the graph having nodes and edges, nodes representing identities, permissions, or resources, and edges representing assignments of permissions that identities have on resources or usage activities of resources; computing a node embedding for each node representing an identity; utilizing the node embeddings to identify one or more similar identities to a first identity; and deriving a least-privilege permission for the first identity based on permissions used in resource usage histories of the one or more similar identities.

9. The method of claim 8, further comprising: determining a first similar identity of the first identity based on an inverse of a difference between a node embedding of the first similar identity and a node embedding of the first identity. ​ 10. The method of claim 8, wherein the least-privilege permissions for the first identity are further based on permissions used in a resource usage history of the first identity.

11. The method of claim 8, wherein the least-privilege permissions for the first identity are further based on permissions used in a resource usage history of peers of the first identity.

12. The method of claim 8, wherein the node embeddings are derived using a convolutional neural network.

13. The method of claim 12, wherein the convolutional neural network uses a continuous bag-of-words technique to derive the node embeddings.

14. The method of claim 8, wherein the node embeddings are trained from random walk generated paths of the graph.

15. The method of claim 8, wherein an identity represents a user account, a user group, an application, or a process.

16. A computing device comprising: at least one processor and memory; the at least one processor configured to: represent permissions assigned to identities for resources in a graph, the graph having nodes and edges, nodes representing identities, permissions, or resources, edges representing assignments of permissions to perform actions on resources; overlay usage activity of each resource onto the graph; with an encoder, map paths through the graph into node embeddings for each identity node; determine similar identities in the graph to a first identity by a difference of the first identity’s node embedding and node embeddings of other identities in the graph; and generate least-privilege permissions for the first identity based on a predicted future resource usage of the first identity, the predicted future resource usage based on resource usage histories of the similar identities.

17. The computing device of claim 16, wherein the encoder is a word2vec encoder.

18. The computing device of claim 16, wherein an identity represents a user account, a process, a user group, or an application.

19. The computing device of claim 16, wherein the predicted future resource usage is further based on a resource usage history of the first identity.

20. The computing device of claim 16, wherein the predicted future resource usage is further based on resource usage histories of peers of the first identity.

Images