System device for security-oriented access enforcement using behavior-based identity assessment

Abstract

System device for security-oriented access enforcement, comprehensive at least one processing unit, an identity capture unit for the technical recording of user- or system-related identity characteristics, a behavioral assessment unit, and an access enforcement unit, wherein the system device is designed to evaluate access requests to a computing resource system-side, characterized by that the behavioral assessment unit generates a dynamic identity assessment based on time-dependent behavioral characteristics at the hardware or firmware level, and the access enforcement unit technically grants, restricts, or prevents access depending on this assessment.

Description

Technical field

[0001] The present invention relates to the technical field of system and access control in distributed computing systems. In particular, the invention relates to a system device that controls access to computing resources system-level by technically evaluating identity features and time-dependent behavioral characteristics and using them for dynamic access enforcement. State of the art

[0002] In familiar computer systems, access control is typically based on static identity information, such as user IDs, login credentials, or authentication characteristics verified only once. Such systems often make access decisions on a case-by-case basis and independently of other system behavior.

[0003] Known access control systems have several disadvantages: • Access decisions do not take into account the temporal behavior of a user or system, • Changes in the system context are not continuously included in the access assessment, • Access rights granted once remain in effect despite changed circumstances, • Safety-relevant changes in condition are only detected with a delay.

[0004] The state of the art therefore does not disclose a system device that combines continuous, behavior-based identity assessment with dynamic and context-dependent access enforcement at the system level. Object of the invention

[0005] The object of the present invention is to provide a system device which: • Identity and behavioral characteristics are technically recorded, • takes time-dependent behavioral changes into account, • Makes access decisions dynamically and context-dependently, • autonomously grants, restricts, or blocks access, and • enables robust and tamper-proof access enforcement. Summary of the invention

[0006] The task is solved by a system device for security-oriented access enforcement using behavior-based identity assessment in accordance with the protection requirements.

[0007] The system device comprises at least one processing unit, one identity capture unit, one behavior evaluation unit, and one access enforcement unit.

[0008] The identity capture unit records user- or system-related identity characteristics. The behavioral assessment unit generates a dynamic identity assessment from time-dependent behavioral characteristics. The access enforcement unit technically controls access to a computing resource based on this assessment. Detailed description of the invention

[0009] The invention relates to a system device for security-oriented access enforcement by means of behavior-based identity assessment. The system device comprises an identity acquisition unit for capturing identity characteristics, a behavior assessment unit for generating a dynamic identity assessment from time-dependent behavioral characteristics, and an access enforcement unit for the technical control of access permissions. Access enforcement is performed autonomously and context-dependently, thereby enabling robust and adaptive access control at the system level.

[0010] The system device according to the invention is designed as a central or logically distributed unit within a computer system.

[0011] The identity capture unit is designed to capture identity attributes associated with an access request. These attributes can be user-related or system-related and are then passed to the behavioral evaluation unit.

[0012] The behavioral assessment unit additionally analyzes time-dependent behavioral characteristics, which are recorded across multiple system states. By correlating these characteristics, a continuously updated identity assessment is generated, reflecting changes in usage or system behavior.

[0013] The access enforcement unit is functionally coupled with the behavioral assessment unit and technically enforces access decisions. Depending on the current identity assessment, access can be granted, restricted, or denied. Additionally, technical context parameters such as system state, resource load, or execution environment can be taken into account.

[0014] The system device operates autonomously and independently of user intervention or application-side software. An optional logging unit is provided, which stores tamper-proof status information about identity assessments and access decisions.