Computer implementation method, computer system, and computer program for automatically generating and implementing access policies (automatic resource access policy generation and implementation)

Abstract

To solve the problem in which context-based access control may not allow a user authorized with another method to access a particular resource because of a lack of a predefined user access context that matches a current context of the user requesting access to the particular resource.SOLUTION: The invention provides automatic generation and implementation of access policies. An output of a needed user access context to access a resource is obtained from a trained machine learning model based on an extracted attribute of the resource input to the trained machine learning model. The access to the resource by a user is controlled using the output of the needed user access context to access the resource as an access policy for the resource.SELECTED DRAWING: Figure 13

Description

Technical Field

[0001] 1. Field The present disclosure generally relates to access control, and more specifically, to automatically generating and implementing access policies for context-based access control to protected resources.

Background Art

[0002] 2. Description of Related Art Access control is, for example, a selective restriction of access to resources such as protected documents, files, hardware, software, etc. that include confidential materials, information or data. The act of accessing may mean consuming or using. Granting permission to access a resource is called authorization. Authorization is a function that specifies the user's access rights or privileges to a protected resource. Granting a user the right to access a particular resource is to define an access policy.

[0003] For example, with the growing popularity and widespread adoption of new work styles such as remote work and shared office spaces, the increasing diversity of work styles is changing the demand for appropriate access control to protected resources. One access control mechanism, role-based access control, controls access to protected resources according to the role assigned to the user requesting access to the protected resource. For example, a user assigned the role of "administrator" can access a protected document in any way, including reading, updating, and deleting, while a user assigned the role of "regular user" cannot edit a protected document and is only allowed to view it. However, in new work styles, using role-based access control may not provide sufficient resource security. For example, a situation may arise where a user who has been granted permission to access a particular resource is in the same room as a user who does not have permission to access that particular resource. Also, a user who has been granted permission may request access to a protected resource from a location (e.g., a restaurant) where others may not have permission to view the protected resource. In both of the above situations, role-based access control would allow access to the resource without adequate resource security.

[0004] Another access control mechanism is context-based access control. Context-based access control determines whether the context of a user requesting access to a protected resource satisfies one of several predefined access control policies. If so, access is granted; otherwise, access is denied. However, current context-based access control systems have a problem stemming from the enormous number of access control policies that need to be defined for resource access. For example, current use of context-based access control requires pre-defining a set of policies for each protected resource. The number of user access contexts for each protected resource can be very large. Each policy is represented by a combination of these user access contexts. In other words, the number of required access policies is at least the number of resources × M, where M is a power of 2 based on the number of predefined access contexts. Therefore, the number of context types is far too large for users, such as security analysts and system administrators, to manually pre-define. [Overview of the Initiative] [Problems that the invention aims to solve]

[0005] As a result, context-based access control may not grant access to a particular resource to a user who has been otherwise authorized, because there is no predefined user access context that matches the current context of the user requesting access to that resource. [Means for solving the problem]

[0006] According to one exemplary embodiment, a computer implementation method for automatically generating and implementing access policies is provided. The computer obtains the output of the user access context required to access a resource from a trained machine learning model based on extracted attributes of the resource input to the trained machine learning model. The computer uses the output of the user access context required to access the resource as an access policy for the resource to control user access to the resource. According to another exemplary embodiment, a computer system and computer program product for automatically generating and implementing access policies are provided. As a result, the exemplary embodiments provide technical effects and practical applications in the field of resource access control by enhancing resource security by utilizing the user access context required by the user when requesting access to the resource.

[0007] Furthermore, the exemplary embodiment optionally associates the user access context of a resource accessed by a trusted user authorized to access the resource with the attribute of the resource, records the association between the user access context and the resource attribute, and inputs the user access context and the resource attribute as training data into a machine learning model to form a trained machine learning model. As a result, the exemplary embodiment improves the performance of the computer to protect the resource using a machine learning model trained to automatically generate and implement access policies with the required user access context. [Brief explanation of the drawing]

[0008] [Figure 1] This is a diagrammatic representation of a network of a data processing system in which exemplary embodiments may be implemented.

[0009] [Figure 2] This figure shows a data processing system in which exemplary embodiments may be implemented.

[0010] [Figure 3] A diagram showing an example of an access policy generator according to an exemplary embodiment.

[0011] [Figure 4] A diagram showing an example of a user access context for an access control policy according to an exemplary embodiment.

[0012] [Figure 5] A diagram showing an example of a training data collection process according to an exemplary embodiment.

[0013] [Figure 6] A diagram showing an example of a machine learning model training process according to an exemplary embodiment.

[0014] [Figure 7] A diagram showing an example of a process for resource access control when an access policy exists according to an exemplary embodiment.

[0015] [Figure 8] A diagram showing an example of a process for resource access control when no access policy exists according to an exemplary embodiment.

[0016] [Figure 9] A diagram showing an example of a low-dimensional vector generation process according to an exemplary embodiment.

[0017] [Figure 10] A diagram showing an example of a resource attribute low-dimensional vector generation process according to an exemplary embodiment.

[0018] [Figure 11] A diagram showing an example of a process for adding similar access policies according to an exemplary embodiment.

[0019] [Figure 12] A flowchart showing a process for controlling access to a protected resource according to an exemplary embodiment.

[0020] [Figure 13] A flowchart showing a process for automatically generating and implementing an access policy according to an exemplary embodiment.

BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The present invention can be a system, method, or computer program product, or a combination thereof, in any possible technical detail level of integration. The computer program product can include a computer-readable storage medium (or media) having stored thereon computer-readable program instructions for causing a processor to implement aspects of the present invention.

[0022] A computer-readable storage medium can be a tangible device capable of holding and storing instructions for use by an instruction-executing device. A computer-readable storage medium may, but is not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. A non-exclusive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or raised structures in grooves on which instructions are recorded, and any suitable combination thereof. As used herein, a computer-readable storage medium should not be construed as a transient signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., optical pulses through optical fiber cables), or electrical signals transmitted through wires.

[0023] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof, or to an external computer or external storage device. The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives computer-readable program instructions from the network and transfers those computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing device.

[0024] The computer-readable program instructions that perform the operation of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or source code or object code written in any combination of one or more programming languages, the one or more programming languages ​​including object-oriented programming languages ​​such as Smalltalk®, C++, etc., and procedural programming languages ​​such as the C programming language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), and the connection may be made to an external computer (for example, via the Internet using an Internet service provider). In some embodiments, to carry out aspects of the present invention, an electronic circuit including, for example, a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA) may execute a computer-readable program instruction by personalizing the electronic circuit using state information of the computer-readable program instruction.

[0025] This specification describes aspects of the present invention with reference to flowcharts, block diagrams, or both, of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It will be understood that each block in a flowchart, block diagram, or both, and combinations of blocks in a flowchart, block diagram, or both, can be implemented by computer-readable program instructions.

[0026] These computer-readable program instructions may be provided to a computer processor or other programmable data processing device that creates a machine, and as a result, instructions executed via the computer processor or other programmable data processing device create means to implement the functions / operations specified by the blocks or blocks in a flowchart or block diagram or both. These computer-readable program instructions may also be stored in a computer-readable storage medium that can instruct a computer, programmable data processing device, or other device or combination thereof to function in a particular manner. Thus, the computer-readable storage medium on which the instructions are stored includes products that include instructions that implement the modes of functions / operations specified by the blocks or multiple blocks in a flowchart or block diagram or both.

[0027] Computer-readable program instructions can also be loaded into a computer, other programmable device, or other device in order to perform a series of operational steps on the computer, other programmable device, or other device to realize a computer implementation process. This allows the instructions executed on the computer, other programmable device, or other device to implement functions / operations defined by blocks or multiple blocks in a flowchart or block diagram, or both.

[0028] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of instructions containing one or more executable instructions that implement a specified logical function. In some alternative implementations, the functions shown in the blocks may be performed in an order different from the order shown in the figures. For example, two blocks shown consecutively may actually be implemented as a single stage and executed simultaneously, substantially simultaneously, partially or entirely in overlapping time, or these blocks may be executed in reverse order depending on the functions involved. It should also be noted that each block in the block diagram or flowchart diagram or both, and combinations of blocks in the block diagram or flowchart diagram or both, may be implemented by a dedicated hardware-based system that performs a specified function or operation, or a combination of dedicated hardware and computer instructions.

[0029] With reference here to the figures, and in particular to Figures 1 and 2, diagrams of a data processing environment in which exemplary embodiments may be implemented are provided. Figures 1 and 2 are illustrative only and are not intended to assert or imply any limitations on the environment, and it should be understood that different embodiments may be implemented. Numerous modifications may be made to the shown environment.

[0030] Figure 1 shows a pictorial representation of a network of a data processing system in which an exemplary embodiment may be implemented. The network data processing system 100 is a network of computers, data processing systems, and other devices in which an exemplary embodiment may be implemented. The network data processing system 100 includes a network 102, which is a medium used to provide communication links between computers, data processing systems, and other devices connected together within the network data processing system 100. The network 102 may include connections such as wired communication links, wireless communication links, and fiber optic cables.

[0031] In the example shown, servers 104 and 106 are connected to network 102 along with storage 108. Servers 104 and 106 may be, for example, server computers having high-speed connectivity to network 102. Alternatively, servers 104 and 106 may each represent a cluster of servers in one or more data centers. Alternatively, servers 104 and 106 may each represent multiple computing nodes in one or more cloud environments.

[0032] Servers 104 and 106 also control access to resource 110 by client device users. Resource 110 represents a set of protected resources. The set of protected resources may correspond to entities such as enterprises, corporations, businesses, organizations, institutions, and agencies. Protected resources require user authorization before access. Resource 110 may include, for example, protected documents, sets of data, databases, storage devices, secure memory, processors, computers, networks, network devices, and applications. Servers 104 and 106 control access to resource 110 by automatically generating and implementing user access context-based policies using trained machine learning.

[0033] Clients 112, 114, and 116 are also connected to network 102. Clients 112, 114, and 116 are clients of servers 104 and 106. In this example, clients 112, 114, and 116 are shown as desktop or personal computers with wired communication links to network 102. However, it should be noted that clients 112, 114, and 116 are merely examples and may represent other types of data processing systems, such as network computers, laptop computers, handheld computers, smartphones, smart glasses, smart TVs, and smart vehicles. Users of clients 112, 114, and 116 may, for example, use clients 112, 114, and 116 to perform their duties and access resources 110 protected by servers 104 and 106.

[0034] Storage 108 is a network storage device capable of storing any type of data in a structured or unstructured format. Storage 108 may also represent multiple network storage devices. Furthermore, Storage 108 may store identifiers and network addresses for multiple client devices, identifiers for multiple client device users, resource profiles (e.g., identifiers, attributes, etc.), access policies, etc. Additionally, Storage 108 may store other types of data, such as authentication or credential data, which may include usernames, passwords, and biometric data associated with client device users, system administrators, security analysts, etc.

[0035] It should also be noted that the network data processing system 100 may include any number of additional servers, clients, storage devices, and other devices not shown. Program code located in the network data processing system 100 may be stored on a computer-readable storage medium or a set of computer-readable storage media and downloaded to a computer or other data processing device for use. For example, program code may be stored on a computer-readable storage medium in server 104 and downloaded to client 112 via network 102 for use in client 112.

[0036] In the example shown, the network data processing system 100 may be implemented as a number of different types of communication networks, such as the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a telecommunications network, or any combination thereof. Figure 1 is intended as an example only and is not intended as an architectural limitation to different exemplary embodiments.

[0037] As used herein, when used in reference to an item, “a number of” means one or more of the items. For example, “a number of different types of communication networks” means one or more different types of communication networks. Similarly, when used in reference to an item, “a set” means one or more of the items.

[0038] Furthermore, the phrase "at least one of" when used with a list of items means that one or more different combinations of the enumerated items may be used, and only one of each item in the list may be required. In other words, "at least one of" means that any combination of multiple items and many items may be used from the list, but not all items in the list are required. An item may be a specific object, thing, or category.

[0039] For example, "at least one of item A, item B, or item C" may include, but is not limited to, item A, item A and item B, or item B. This example may also include item A, item B and item C, or item B and item C. Naturally, any combination of these items can be presented. In some exemplary examples, "at least one" may be, for example, two item A, one item B and ten item C, four item B and seven item C, or any other suitable combination, but is not limited to these.

[0040] Referring now to Figure 2, a diagram of a data processing system according to an exemplary embodiment is shown. The data processing system 200 is an example of a computer, such as the server 104 in Figure 1, where computer-readable program code or instructions that implement the resource access control process of the exemplary embodiment may be located. In this example, the data processing system 200 includes a processor unit 204, memory 206, persistent storage 208, a communication unit 210, an input / output (I / O) unit 212, and a communication fabric 202 that provides communication between the display 214 and the communication unit 210.

[0041] The processor unit 204 functions to execute instructions and programs for a software application, which can be loaded into memory 206. Depending on the specific implementation, the processor unit 204 may be a set of one or more hardware processor devices or a multi-core processor.

[0042] Memory 206 and persistent storage 208 are examples of storage devices 216. As used herein, a computer-readable storage device or computer-readable storage medium is any part of hardware capable of temporarily or permanently storing information such as, for example, data, computer-readable program code in a functional form, or other suitable information, or a combination thereof. Furthermore, a computer-readable storage device or computer-readable storage medium excludes propagating media such as temporary signals. Furthermore, a computer-readable storage device or computer-readable storage medium may represent a set of computer-readable storage devices or a set of computer-readable storage media. In these examples, memory 206 may be, for example, random access memory (RAM), or any other suitable volatile or non-volatile storage device such as flash memory. Persistent storage 208 may take various forms depending on the particular implementation. For example, persistent storage 208 may include one or more devices. For example, persistent storage 208 may be a disk drive, a solid-state drive, a rewritable optical disk, a rewritable magnetic tape, or a combination thereof. The media used by persistent storage 208 may be removable. For example, a removable hard drive may be used for persistent storage 208.

[0043] In this example, persistent storage 208 stores the resource access controller 218. However, while the resource access controller 218 is shown to reside in persistent storage 208, it should be noted that in alternative exemplary embodiments, the resource access controller 218 may be a separate component of the data processing system 200. For example, the resource access controller 218 may be a hardware component coupled to the communication fabric 202, or a combination of hardware and software components. In another alternative exemplary embodiment, a first set of components of the resource access controller 218 may be located in the data processing system 200, and a second set of components of the resource access controller 218 may be located in a second data processing system, such as server 106 in Figure 1.

[0044] The resource access controller 218 controls access to one or more protected resources, such as resource 110 in Figure 1, using, for example, a user access context-based access control policy. The resource access controller 218 also instructs the access policy generator to automatically generate and implement a user access context-based access control policy for a particular resource if one does not currently exist for that resource. As a result, the data processing system 200 operates as a dedicated computer system, with the resource access controller 218 enabling selective access control to protected resources by client device users for enhanced resource security. In particular, the resource access controller 218 transforms the data processing system 200 into a dedicated computer system compared to a currently available general-purpose computer system without the resource access controller 218.

[0045] In this example, the communication unit 210 provides communication with other computers, data processing systems, and devices via a network such as network 102 in Figure 1. The communication unit 210 can provide communication using both physical communication links and wireless communication links. A physical communication link may be established for the data processing system 200 using, for example, wires, cables, universal serial buses, or any other physical technology. A wireless communication link may be established for the data processing system 200 using, for example, shortwave, radio frequency, ultra-high frequency, microwave, Wireless Fidelity (Wi-Fi®), Bluetooth® technology, Global System for Mobile Communications (GSM®), Code Division Multiple Access (CDMA), 2G, 3G, 4G, 4G Long Term Evolution (LTE), LTE Advanced, 5G, or any other wireless communication technology or standard.

[0046] The input / output unit 212 enables input and output of data to and from other devices that may be connected to the data processing system 200. For example, the input / output unit 212 may provide a connection to user input via a keypad, keyboard, mouse, microphone, or several other suitable input devices, or a combination thereof. The display 214 provides a mechanism for displaying information to the user and may include a touchscreen function that allows the user to make on-screen selections, for example, via a user interface or input data.

[0047] Instructions for an operating system, application, or program, or a combination thereof, may reside in a storage device 216 that communicates with the processor unit 204 via a communication fabric 202. In this exemplary example, the instructions reside in persistent storage 208 in a functional form. These instructions may be loaded into memory 206 for execution by the processor unit 204. Processes of different embodiments may be executed by the processor unit 204 using computer implementation instructions that may reside in memory, such as memory 206. These program instructions are referred to as program code, computer-readable program code, or computer-accessible program code that can be read and executed by the processor in the processor unit 204. In different embodiments, program instructions may be embodied on different physical computer-readable storage devices, such as memory 206 or persistent storage 208.

[0048] The program code 220 is located in a functionally detachable computer-readable medium 222 and may be loaded or transferred to a data processing system 200 for execution by a processor unit 204. The program code 220 and the computer-readable medium 222 form a computer program product 224. In one example, the computer-readable medium 222 may be a computer-readable storage medium 226 or a computer-readable signaling medium 228.

[0049] In these exemplary examples, the computer-readable storage medium 226 is a physical or tangible storage device used to store the program code 220, rather than a medium for propagating or transmitting the program code 220. The computer-readable storage medium 226 may include, for example, an optical or magnetic disk inserted into or placed in a drive or other device that is part of persistent storage 208 for transfer onto a storage device such as a hard drive that is part of persistent storage 208. The computer-readable storage medium 226 may also take the form of persistent storage such as a hard drive, thumb drive, or flash memory connected to the data processing system 200.

[0050] Alternatively, the program code 220 may be transferred to the data processing system 200 using a computer-readable signal medium 228. The computer-readable signal medium 228 may be, for example, a propagating data signal containing the program code 220. For example, the computer-readable signal medium 228 may be an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals may be transmitted over a communication link such as a wireless communication link, an optical fiber cable, a coaxial cable, a wire, or any other suitable type of communication link.

[0051] Furthermore, as used herein, “computer-readable medium 222” can be singular or plural. For example, program code 220 may reside in computer-readable medium 222 in the form of a single storage device or system. In another example, program code 220 may reside in computer-readable medium 222 distributed across multiple data processing systems. In other words, some instructions in program code 220 may reside in a data processing system, while other instructions in program code 220 may reside in one or more other data processing systems. For example, part of program code 220 may reside in computer-readable medium 222 on a server computer, while other parts of program code 220 may reside in computer-readable medium 222 on a set of client computers.

[0052] The different components shown for the data processing system 200 are not intended to impose architectural restrictions on how different embodiments may be implemented. In some exemplary examples, one or more components may be incorporated into another component, or otherwise form part of another component. For example, memory 206, or a portion thereof, may be incorporated into the processor unit 204 in some exemplary examples. Different exemplary embodiments may be implemented in a data processing system that includes components in addition to, or instead of, those shown for the data processing system 200. Other components shown in Figure 2 may be modified from those shown in the exemplary examples. Different embodiments may be implemented using any hardware device or system capable of executing program code 220.

[0053] In another example, the bus system may be used to implement the communication fabric 202 and may include one or more buses, such as a system bus or input / output buses. Naturally, the bus system may be implemented using any suitable type of architecture that provides data transfer between different components or devices attached to the bus system.

[0054] As used herein, a user access context is any situation, condition, or setting that corresponds to a user requesting access to a protected resource. A user access context may include, for example, "the user is at home," "the user is at work," "the user is alone," "the user is not alone," or "the user is the author of the requested document." An access policy defines the user access context required for a user to access a particular protected resource. A concrete example of a user access context-based access control policy might be, "Document A can only be accessed by an authorized user who is alone at home, has administrator privileges."

[0055] An exemplary embodiment automatically generates and implements appropriate access control policies for protected resources. The exemplary embodiment utilizes an access policy generator that leverages machine learning to automatically generate and implement user access context-based access control policies to control access to protected resources. The access policy generator of the exemplary embodiment can automatically generate appropriate user access context-based policies for any protected resource. The access policy generator comprises, for example, a resource attribute extractor that identifies and extracts a set of attributes corresponding to a requested resource; a user access context generator that uses a trained machine learning model to generate the necessary user access context for the requested resource; an access policy validater that determines the validity of the generated access policy candidates; and an access policy selector that selects the most appropriate (e.g., most secure) access policy for a particular requested resource. As a result, the exemplary embodiment can use a trained machine learning model to improve computer performance to protect resources and automatically generate and implement access policies with the necessary user access context.

[0056] The attributes of a protected resource can be any element, feature, characteristic, trait, property, or similar description of a particular protected resource. For example, resource attributes may include the name or identifier of the protected resource, the date the protected resource was created or started to be used, the author of the protected resource, the location where the protected resource was created, or the type of access permitted to the protected resource. The user access context generator is a trained machine learning model that may include a set of binary classifiers based on collected training data. The access policy generator may also utilize a low-dimensional vector generator (e.g., a word-to-vector (word2vec) model) or other possible implementations to extract resource attributes or identify similar access control policies as potential candidates. Exemplary embodiments may utilize a defined maximum policy distance threshold to enable quantitative control over the security and usability of resource access control policy candidates that may be similar to the generated access control policy.

[0057] An exemplary embodiment collects training data for a user access context generator from multiple trusted (e.g., authorized) users. For example, the exemplary embodiment restricts access to protected resources to trusted users when the system is initialized and first executed. The exemplary embodiment allows trusted users to randomly access protected resources using a variety of user access contexts. The exemplary embodiment records the various user access contexts of trusted users when they request access to different protected resources, and also records the attributes corresponding to each of the requested resources. The exemplary embodiment uses the recorded user access contexts and recorded resource attributes as training data for a machine learning model of the user access context generator.

[0058] Therefore, exemplary embodiments can generate and implement flexible resource access control policies by using machine learning to consider user access context in natural language. As a result, exemplary embodiments provide one or more technical solutions that overcome the technical challenges related to automatically generating and implementing policies for resource access control. As a result, these one or more technical solutions provide technical benefits and practical applications in the field of resource access control by enhancing resource security by leveraging the user access context required by users when requesting access to resources.

[0059] Referring now to Figure 3, a diagram is shown illustrating an example of an access policy generator according to an exemplary embodiment. The access policy generator 300 may be implemented in a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2. The access policy generator 300 automatically generates resource access control policies in the necessary user access context for accessing protected resources.

[0060] In this example, the access policy generator 300 includes a resource attribute extractor 302, a user access context generator 304, an access policy validator 306, and an access policy selector 308. The access policy generator 300 uses the resource attribute extractor 302 to extract a set of attributes corresponding to each resource protected by the computer. The resource attribute extractor 302 extracts resource attributes from the resource database 310. The resource database 310 stores a profile corresponding to each resource protected by the computer. The resource profile may include, for example, the resource identifier (e.g., name), the date the resource was created or started using, the location where the protected resource was created or started using, and the types of access permitted to the resource.

[0061] The access policy generator 300 utilizes the user access context generator 304 to automatically generate the necessary user access context or set of necessary user access contexts for the requested resource. The user access context generator 304 has a trained machine learning model that includes a set of binary classifiers 312. The trained machine learning model is based on training data collected from a group of trusted users who access resources using various user access contexts. Each binary classifier in the set of binary classifiers 312 takes the attributes of the requested resource as input and outputs a specific user access context (true or false) required when accessing the resource.

[0062] The access policy generator 300 uses the access policy verifier 306 to determine whether the generated access policy candidate is valid for a specific requested resource. For example, if the access policy verifier 306 determines that a particular access policy candidate conflicts with one or more other access policies for that particular resource, the access policy verifier 306 deletes or removes that particular access policy as a possible candidate for that particular resource. If there are multiple access policy candidates for that particular resource, the access policy generator 300 uses the access policy selector 308 to select the most appropriate access policy candidate for that particular resource. After selecting the most appropriate access policy candidate for that particular resource, the access policy selector 308 stores the selected access policy for that particular resource in the access policy database 314. The access policy database 314 stores all generated access policies for resources protected by the computer.

[0063] Referring now to Figure 4, a diagram is shown illustrating an example of a user access context for an access control policy according to an exemplary embodiment. The user access context 400 for the access control policy may be implemented in a user access context generator, such as the user access context generator 304 in Figure 3.

[0064] In this example, the user access context 400 for the access control policy ranges from the insecure access policy 402 to the more secure access policy 404. The insecure access policy 402 is represented by an empty set of user access contexts (e.g., "{}") for accessing a specific resource, while the more secure access policy 404 is represented by a combination of user access contexts (e.g., "{AtOffice,Alone,IsEditor}"). In other words, an access policy that does not include any user access context is the least secure or most dangerous, while an access policy that includes all user access contexts is the most secure or least dangerous.

[0065] As used herein, the term “context” means a countable atomic context, such as “{AtOffice}”, “{Alone}”, or “{IsEditor}”, provided by a system administrator managing the context-based access control system of an exemplary embodiment. The term “context” also means a combination of contexts, such as “{AtOffice,Alone}, {Alone,IsEditor}, and {AtOffice,IsEditor}”. Therefore, the format of the resulting access policy may be different.

[0066] For example, an exemplary embodiment utilizes the most secure access policy selection, where the context may be, for example, {AtOffice,Alone}. In other words, the exemplary embodiment utilizes the most secure access policy selection, where the user should be in their office and alone at the time of the resource access request in order to satisfy that particular access policy. Alternatively, the exemplary embodiment utilizes disjunctive access policy selection, where the context combination may be, for example, {{AtOffice,Alone}, {Alone,IsEditor}}. In other words, the exemplary embodiment utilizes disjunctive access policy selection, where the user should be either in their office and alone, or alone and an editor, at the time of the resource access request in order to satisfy that particular access policy. Thus, an exemplary embodiment utilizing disjunctive access policy selection allows the user to have disjunction in their user access context when multiple access policy candidates with the same level of security exist, while an exemplary embodiment utilizing the most secure access policy selection simply strictly outputs the most secure access policy each time. For example, in an exemplary embodiment that utilizes the most secure access policy selection, if there are multiple access policy candidates for a particular resource, such as access policy candidates "A" and "B", the exemplary embodiment will select access policy candidate "A" for that particular resource if it determines that access policy candidate "A" is the more secure access policy.

[0067] Referring now to Figure 5, a diagram is shown illustrating an example of a training data acquisition process according to an exemplary embodiment. The training data acquisition process 500 may be implemented on a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2.

[0068] In this example, the training data collection process 500 includes a group of trusted users 502, a resource database 504, a resource attribute extractor 506, attributes 508 for each requested resource, a resource access controller 510, and a resource access log 512. The group of trusted users 502 represents, for example, multiple users who are authorized to access resources protected by the computer, such as resource 110 in Figure 1. For example, the resource database 504 and resource attribute extractor 506 may be resource database 310 and resource attribute extractor 302 in Figure 3. For example, the resource access controller 510 may be resource access controller 218 in Figure 2. The resource access log 512 represents a log, record, or summary of each access to a resource protected by the computer.

[0069] In this example, the resources that the computer should control access to are "{Resource A, Resource B}", the user access context to be handled is "{AtOffice, Alone, IsEditor}", and the resource attribute extractor 506 is assumed to be able to extract the resource name, last modified date, and access type (e.g., write / read) from the profiles corresponding to resource A and resource B. Furthermore, upon initial startup, the computer restricts resource access to trusted user group 502, allowing all trusted users in trusted user group 502 to access computer-protected resources using various user access contexts.

[0070] In step 514, the resource database 504 receives a resource access request from a group of trusted users 502. In step 516, the resource attribute extractor 506 extracts the attributes of the resources (e.g., Resource A and Resource B) requested by the group of trusted users 502. The attribute 508 for each requested resource represents the extracted attributes of the resources requested by the group of trusted users 502. The attribute 508 for each requested resource indicates that the attributes of Resource A include "Name: Sales Information (Confidential).xlsx; Last Updated: 01 / 02 / 2021; Access Type: Read." The attribute 508 for each requested resource also indicates that the attributes of Resource B include "File Name: Test History.log; Last Updated: 01 / 02 / 1999; Access Type: Write."

[0071] In 518, when a trusted group of users 502 accesses a resource, the resource access controller 510 records the user access context of each user resource access request by the trusted group of users 502, and the attributes of each requested resource, in the resource access log 512. In this example, the resource access controller 510 records in the resource access log 512 "Read access to a file named 'Sales Information(Confidential).xlsx' from user access context {AtOffice,Alone} with last modified date: 01 / 02 / 2021", and "Write access to a file named 'Test History.log' from user access context {IsEditor} with last modified date: 01 / 02 / 1999", for resource B.

[0072] Referring now to Figure 6, a diagram is shown illustrating an example of a machine learning model training process according to an exemplary embodiment. The machine learning model training process 600 may be implemented on a computer, for example, the server 104 in Figure 1, or the data processing system 200 in Figure 2.

[0073] In this example, the machine learning model training process 600 includes a resource access log 602, such as resource access log 512 in Figure 5. The computer uses the data recorded in resource access log 602 as training data (e.g., training data 606). In this example, the data recorded in resource access log 602 includes, as in the example shown in Figure 5, "read access to a file named 'Sales Information(Confidential).xlsx' from user access context {AtOffice,Alone} with last modified date: 01 / 02 / 2021" and "write access to a file named 'Test History.log' from user access context {IsEditor} with last modified date: 01 / 02 / 1999". The machine learning model training process 600 uses a data cleanser 604 to perform data cleansing on the recorded data. Data cleansing, or data cleaning, is the process of detecting, correcting, or removing corrupted or inaccurate data from databases, records, files, etc. It involves identifying incomplete, inaccurate, erroneous, or irrelevant parts of the data and replacing, correcting, or deleting corrupted or rough data.

[0074] The machine learning model training process 600 inputs the training data 606 along with the correct answers into the binary classifier 608 of the machine learning model 610. The machine learning model training process 600 inputs "(('Sales Information(Confidential).xlsx',01 / 02 / 2021,Read),True)" and "(('Test Result.log',01 / 02 / 1999,Write),False)" from the training data 606 into the binary classifier for the "AtOffice" user access context. The machine learning model training process 600 also inputs "(('Sales Information(Confidential).xlsx',01 / 02 / 2021,Read),True)" and "(('Test Result.log',01 / 02 / 1999,Write),False)" from the training data 606 into the binary classifier for the "Alone" user access context. Furthermore, the machine learning model training process 600 inputs the training data 606 "(('Test Result.log',01 / 02 / 1999,Write),True)" and "(('Sales Information(Confidential).xlsx',01 / 02 / 2021,Read),False)" into a binary classifier for the "IsEditor" user access context. As a result, the machine learning model training process 600 trains the machine learning model 610 to return to "True" when the required user access context for a particular resource attribute is met, and trains the machine learning model 610 to return to "False" in other cases, such as when the required user access context for a particular resource attribute is not met.

[0075] Referring now to Figure 7, a diagram is shown illustrating an example of a process for resource access control in the presence of an access policy, according to an exemplary embodiment. The process 700 for resource access control in the presence of an access policy may be implemented in a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2.

[0076] In this example, when an access policy exists, the process 700 for resource access control includes a resource access controller 702, such as resource access controller 218 in Figure 2 or resource access controller 510 in Figure 5; an access policy database 704, such as access policy database 314 in Figure 3; and a resource database 706, such as resource database 310 in Figure 3 or resource database 504 in Figure 5. In 708, a typical user 710 sends a resource access request to the resource access controller 702, which has a user access context (for example, user access context for the requested resource "Sales Information(Confidential).xlsx": {AtOffice,Alone}). A typical user 710 represents any type of user requesting access to a resource protected by the computer.

[0077] In step 712, the resource access controller 702 checks the access policy database 704 for the access policy corresponding to the requested resource "Sales Information(Confidential).xlsx". In step 714, the access policy database 704 returns the access policy (for example, {AtOffice,Alone} is the necessary user access context for accessing the requested resource "Sales Information(Confidential).xlsx"). In step 716, the resource access controller 702 determines that when requesting access to the resource "Sales Information(Confidential).xlsx", the user access context {AtOffice,Alone} of the normal user 710 satisfies the access policy for the resource "Sales Information(Confidential).xlsx" which has the necessary user access context for {AtOffice,Alone}. As a result, in step 718, the resource access controller 702 instructs the resource database 706 to send the requested resource "Sales Information(Confidential).xlsx" to the normal user 710.

[0078] Referring now to Figure 8, a diagram is shown illustrating an example of a process for resource access control in the absence of an access policy, according to an exemplary embodiment. The process 800 for resource access control in the absence of an access policy may be implemented in a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2.

[0079] In this example, the process 800 for resource access control when no access policy exists includes a resource access controller 802, an access policy database 804, a resource database 806, and an access policy generator 808. The resource access controller 802, access policy database 804, and resource database 806 may be, for example, the resource access controller 702, access policy database 704, and resource database 706 in Figure 7. For example, the access policy generator 808 may be the access policy generator 300 in Figure 3.

[0080] In step 810, the user 812 typically sends a resource access request to the resource access controller 802 with a user access context (for example, a user access context for the requested resource "Sales Information(Confidential).xlsx": {AtOffice,Alone}). In step 814, the resource access controller 802 checks the access policy database 804 for an access policy corresponding to the resource "Sales Information(Confidential).xlsx". During the search, the resource access controller 802 determines that an access policy corresponding to the requested resource "Sales Information(Confidential).xlsx" does not exist in the access policy database 804. As a result, in step 816, the resource access controller 802 instructs the access policy generator 808 to generate an access policy for the requested resource "Sales Information(Confidential).xlsx".

[0081] The access policy generator 808 uses the resource attribute extractor 818 to extract a set of attributes corresponding to the requested resource "Sales Information(Confidential).xlsx" from the resource database 806. Next, the resource attribute extractor 818 inputs the extracted set of attributes (e.g., [Resource A]; Name: Sales Information(Confidential).xlsx; Last Updated: 01 / 02 / 2021; Access Type: Read) into the user access context generator 820. Note that the user access context generator 820 may include a machine learning model, such as the machine learning model 610 in Figure 6, which has already been trained using training data collected from a group of trusted users.

[0082] In step 822, the user access context generator 820 generates a set of access policy candidates for the requested resource "Sales Information(Confidential).xlsx" based on the extracted set of attributes of the requested resource (for example, access policy candidate A which includes the required user access context {AtHome,AtOffice}, access policy candidate B which includes the required user access context {AtOffice,Alone}, and access policy candidate C which includes the required user access context {Alone}). Next, the user access context generator 820 inputs the set of access policy candidates for the requested resource "Sales Information(Confidential).xlsx" into the access policy validator 824.

[0083] The access policy verifier 824 determines that the user access contexts {AtHome,AtOffice} corresponding to access policy candidate A are mutually inconsistent. As a result, the access policy verifier 824 eliminates access policy candidate A, which contains the required user access context {AtHome,AtOffice}, as an access policy candidate. In 826, the access policy verifier 824 sends the remaining valid access policy candidates (for example, policy candidate B, which contains the required user access context {AtOffice,Alone}, and access policy candidate C, which contains the required user access context {Alone}) to the access policy selector 828.

[0084] The access policy selector 828 selects a more secure access policy for the requested resource "Sales Information(Confidential).xlsx" (for example, policy candidate B, which includes the required user access context {AtOffice,Alone}) based on the most secure access policy selection process. In 830, the access policy selector 828 adds the selected more secure access policy for the requested resource "Sales Information(Confidential).xlsx" (for example, policy candidate B, which includes the required user access context {AtOffice,Alone}) to the access policy database 804.

[0085] Referring now to Figure 9, a diagram is shown illustrating an example of a low-dimensional vector generation process according to an exemplary embodiment. The low-dimensional vector generation process 900 may be implemented in a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2.

[0086] In this example, the low-dimensional vector generation process 900 includes an access policy generator 902. The access policy generator 902 is similar to the access policy generator 300 in Figure 3 and the access policy generator 808 in Figure 8. For example, the access policy generator 902 has a resource attribute extractor 904, a user access context generator 906, an access policy verifier 908, and an access policy selector 910. However, the resource attribute extractor 904 includes a low-dimensional vector generator 912, and the access policy selector 910 includes a similar access policy candidate generator 914.

[0087] The low-dimensional vector generator 912 outputs a low-dimensional vector representation of the attributes corresponding to the requested resource extracted from the resource database 916, using a word-to-vector (word2vec) model instead of a natural language representation (see example in Figure 10). The similar access policy candidate generator 914 generates similar access policy candidates that allow user access contexts within a defined maximum distance threshold, taking into account the natural language distance of the access policies generated by the user access context generator 906 (see example in Figure 11).

[0088] Referring now to Figure 10, a diagram is shown illustrating an example of a resource attribute low-dimensional vector generation process according to an exemplary embodiment. The resource attribute low-dimensional vector generation process 1000 may be implemented in a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2.

[0089] In this example, the resource attribute low-dimensional vector generation process 1000 includes the requested resource 1002 (e.g., [Resource A]). In 1004, the resource attribute low-dimensional vector generation process 1000 uses a resource attribute extractor, for example, the resource attribute extractor 904 in Figure 9, to extract a set of attributes corresponding to the requested resource A (e.g., Name: Sales Information (Confidential).xlsx; Last Updated 01 / 02 / 2021; Access Type: Read) from a resource database, for example, the resource database 916 in Figure 9.

[0090] The resource attribute low-dimensional vector generation process 1000 generates the original high-dimensional vector 1006 for the set of attributes corresponding to the requested resource. Next, the resource attribute low-dimensional vector generation process 1000 generates a predicted low-dimensional vector 1010 for the set of attributes corresponding to the requested resource, using the word2vec model 1008 of a low-dimensional vector generator, such as the low-dimensional vector generator 912 in Figure 9.

[0091] Referring now to Figure 11, a diagram is shown illustrating an example of a process for adding a similar access policy according to an exemplary embodiment. The process 1100 for adding a similar access policy may be implemented in a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2.

[0092] In this example, process 1100, which adds a similar access policy, includes access policy 1102 (e.g., an access policy containing the required user access context {AtShibuyaOffice,Alone,IsEditor}) generated by a user access context generator, such as user access context generator 906 in Figure 9. The required user access contexts AtShibuyaOffice,Alone, and IsEditor are represented by vectors V1, V2, and V3, respectively. Process 1100, which adds a similar access policy, includes similar access policy 1104 (e.g., an access policy containing the required user access context {AtShinjukuOffice,Alone,IsEditor}) generated by a similar access policy candidate generator, such as similar access policy candidate generator 914 in Figure 9. The required user access contexts AtShinjukuOffice,Alone, and IsEditor are represented by V4, V2, and V3, respectively. If the distance between access policy V1, V2, V3 of access policy 1102 and access policy V4, V2, V3 of similar access policy 1104 is less than or equal to a defined maximum distance threshold, process 1100 for adding similar access policies adds similar access policy 1104, which has the required user access context {AtShinjukuOffice, Alone, IsEditor}, as an access policy to an access policy database, such as the access policy database 918 in Figure 9.

[0093] Referring now to Figure 12, a flowchart is shown illustrating a process for controlling access to protected resources according to an exemplary embodiment. The process shown in Figure 12 may be implemented in a computer, for example, server 104 in Figure 1 or data processing system 200 in Figure 2.

[0094] The process begins when the computer allows access to a resource by trusted users with various user access contexts (stage 1202). The resource is protected by the computer. The computer extracts the attributes of the resource accessed by trusted users (stage 1204). The computer records the various user access contexts of trusted users when they accessed the resource, along with the resource attributes, in a resource access log (stage 1206). The computer uses the various user access contexts of trusted users and the resource attributes recorded in the resource access log to train a machine learning model for a user access context generator (stage 1208).

[0095] The computer enables context-based access control to the resource by any type of user requesting access to the resource (step 1210). The computer receives a request from a client device over the network for a user with a user access context to access the resource (step 1212). The computer searches the access policy database for the access policy corresponding to the resource requested by the user (step 1214).

[0096] The computer determines, based on the search, whether an access policy for the resource exists in the access policy database (step 1216). If the computer determines that an access policy for the resource does not exist in the access policy database, and the output of step 1216 is no, the computer then instructs the user access context generator to generate an access policy for the resource that includes the user access context necessary to access the resource using a trained machine learning model (step 1218). The process then proceeds to step 1220. If the computer determines that an access policy for the resource exists in the access policy database, and the output of step 1216 is yes, the computer then determines whether the user's user access context satisfies the required user access context for the access policy for the resource (step 1220). If the computer determines that the user's user access context does not satisfy the required user access context for the access policy for the resource, and the output of step 1220 is no, the computer then denies the user access to the resource (step 1222). The process then returns to step 1212, where the computer waits for another resource access request. The computer determines whether the user's user access context satisfies the required user access context of the access policy for the resource. If the output of step 1220 is yes, the computer then grants the user access to the resource (step 1224). The process then returns to step 1212, where the computer waits for another resource access request.

[0097] Referring now to Figure 13, a flowchart is shown illustrating a process for automatically generating and implementing an access control policy according to an exemplary embodiment. The process shown in Figure 13 may be implemented in a computer, for example, the server 104 in Figure 1 or the data processing system 200 in Figure 2.

[0098] The process begins when the computer associates a user access context with the resource attributes for access to the resource by a trusted user who has been granted permission to access the resource (step 1302). The computer records the association between the user access context and the resource attributes (step 1304). The user access context includes at least one of the following: the user's location when requesting access to the resource, the time the user requested access to the resource, and whether there were any other users at the location where the user requested access to the resource. The computer inputs the user access context and resource attributes as training data into a machine learning model to form a trained machine learning model (step 1306).

[0099] When the computer receives a request from a new user to access a resource, it extracts the resource's attributes to form the extracted attributes of the resource (step 1308). The computer inputs the extracted attributes of the resource into a trained machine learning model (step 1310). The computer obtains the output of the user access context required to access the resource from the trained machine learning model, based on the extracted attributes of the resource input into the trained machine learning model (step 1312). If there are multiple outputs of the required user access context, the computer selects a specific user access context based on one of the most secure access policy selection processes or disjunctive access policy selection processes according to the level or degree of security. The computer controls the new user's access to the resource using the output of the user access context required to access the resource as the access policy for the resource (step 1314). The process then terminates.

[0100] Accordingly, exemplary embodiments of the present invention provide computer implementation methods, computer systems, and computer program products for automatically generating and implementing access policies for context-based access control to protected resources. While various embodiments of the present invention have been illustrated for illustrative purposes, they are not intended to be exhaustive or to limit the disclosed embodiments. Numerous modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best describe the principles, practical applications, or technical improvements to existing technologies, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A computer implementation method for automatically generating and implementing access policies, wherein the computer implementation method is The steps include: obtaining, from the trained machine learning model, the output of the user access context necessary to access the resource, based on the extracted attributes of the resource input by the computer to the trained machine learning model; The computer controls the user's access to the resource by using the output of the necessary user access context for accessing the resource as an access policy for the resource. Equipped with, If multiple outputs exist with different combinations of required user access contexts, the computer selects a specific user access context based on one of the most secure access policy selection processes or disjunctive access policy selection processes according to the security level. A computer implementation method in which the user access context includes the absence of any other users at a given location when the user requests access to the resource.

2. Upon receiving a request from the user to access the resource, the computer performs the following steps: extracting the attributes of the resource in order to form the extracted attributes of the resource; The computer inputs the extracted attributes of the resource into the trained machine learning model. The computer implementation method according to claim 1, further comprising:

3. The steps include: associating the user access context of access to the resource by a trusted user who has been granted permission to access the resource with the attribute of the resource; The computer records the association between the user access context and the attributes of the resource, The computer inputs the user access context and the attributes of the resource as training data into the machine learning model in order to form the trained machine learning model. The computer implementation method according to claim 1 or 2, further comprising:

4. The computer implementation method according to claim 1 or 2, wherein the user access context further includes at least one of the user's location when requesting access to the resource and the time the user requested access to the resource.

5. The computer receives a request from a client device via the network for the user to access the resource, which has a user access context. The computer performs the following steps: The computer implementation method according to claim 1 or 2, further comprising:

6. The computer determines, based on the search, whether or not the access policy for the resource exists in the access policy database. The computer, in response to determining that the access policy for the resource does not exist in the access policy database, instructs the user access context generator to use the trained machine learning model to generate the access policy for the resource that has the necessary user access context for accessing the resource. The computer implementation method according to claim 5, further comprising:

7. In response to the computer determining that the access policy for the resource exists in the access policy database, the computer determines whether the user's user access context satisfies the required user access context of the access policy for the resource. The computer, in response to determining that the user's user access context does not satisfy the required user access context of the access policy for the resource, takes the following steps: The computer implementation method according to claim 6, further comprising:

8. In response to the computer determining that the user's user access context satisfies the required user access context of the access policy for the resource, the computer grants the user access to the resource. The computer implementation method according to claim 7, further comprising:

9. A computer implementation method for automatically generating and implementing an access policy, wherein the computer implementation method is: The steps include: obtaining, from the trained machine learning model, the output of the user access context necessary to access the resource, based on the extracted attributes of the resource input by the computer to the trained machine learning model; The computer controls the user's access to the resource by using the output of the necessary user access context for accessing the resource as an access policy for the resource. Equipped with, The computer allows access to the resource by trusted users having various user access contexts, and the resource is protected by the computer. The computer extracts the attributes of the resources accessed by the trusted user, The computer records in a resource access log the various user access contexts of the trusted user when they accessed the resource, and the attributes of the resource. A computer implementation method that further enhances this feature.

10. The steps include: training a machine learning model using the various user access contexts of the trusted user and the attributes of the resource recorded in the resource access log, performed by the computer; The computer enables context-based access control to the resource by any user requesting access to the resource. The computer implementation method according to claim 9, further comprising:

11. A computer system for automatically generating and implementing access policies, wherein the computer system is bus system and A storage device connected to the bus system, wherein the storage device stores program instructions, A processor connected to the bus system, wherein the processor is Based on the extracted attributes of the resources input to the trained machine learning model, the trained machine learning model outputs the user access context necessary to access the resources. The output of the necessary user access context for accessing the resource is used as an access policy for the resource to control the user's access to the resource. If multiple outputs exist with different combinations of required user access contexts, the computer system selects a specific user access context based on one of the most secure access policy selection processes or disjunctive access policy selection processes according to the security level. The user access context includes the absence of any other users at the time the user requested access to the resource at a certain location. A processor and execute the aforementioned program instructions. A computer system equipped with the following features.

12. The aforementioned processor, Upon receiving a request from the user to access the resource, the attributes of the resource are extracted in order to form the extracted attributes of the resource. The extracted attributes of the resource are input into the trained machine learning model. The computer system according to claim 11, further executing the program instructions as described above.

13. The aforementioned processor, The user access context for accessing the resource by a trusted user who has been granted permission to access the resource is associated with the attribute of the resource. Record the association between the user access context and the attribute of the resource, To form the aforementioned trained machine learning model, the user access context and the attributes of the resource are input to the machine learning model as training data. The computer system according to claim 11 or 12, further executing the program instructions as described above.

14. The computer system according to claim 11 or 12, wherein the user access context further includes at least one of the user's location when requesting access to the resource and the time the user requested access to the resource.

15. A computer system for automatically generating and implementing access policies, wherein the computer system is: bus system and A storage device connected to the bus system, wherein the storage device stores program instructions, A processor connected to the bus system, wherein the processor is Based on the extracted attributes of the resources input to the trained machine learning model, the trained machine learning model outputs the user access context necessary to access the resources. The output of the necessary user access context for accessing the resource is used as an access policy for the resource to control the user's access to the resource. The computer system allows access to the resource by trusted users with various user access contexts when accessing the resource, and the resource is protected by the computer system. The computer system extracts the attributes of the resource accessed by the trusted user, The computer system records in a resource access log the various user access contexts of the trusted user when they accessed the resource, and the attributes of the resource. A processor and execute the aforementioned program instructions. Equipped with, Computer system.

16. A computer program that automatically generates and implements access policies, wherein the computer program is provided to the computer, The procedure involves obtaining, from the trained machine learning model, the output of the user access context necessary to access the resource, based on the extracted attributes of the resource input to the trained machine learning model, provided by the computer; The computer uses the output of the necessary user access context to access the resource as an access policy for the resource, and the procedure controls the user's access to the resource. Make it run, If multiple outputs exist with different combinations of required user access contexts, the computer selects a specific user access context based on one of the most secure access policy selection processes or disjunctive access policy selection processes according to the security level. The user access context is a computer program that includes the absence of any other users at a given location when the user requests access to the resource.

17. To the aforementioned computer, Upon receiving a request from the user to access the resource, the computer performs a procedure to extract the attributes of the resource in order to form the extracted attributes of the resource. The procedure involves the computer inputting the extracted attributes of the resource into the trained machine learning model. The computer program according to claim 16, which further executes the following.

18. To the aforementioned computer, The procedure involves associating the user access context of access to the resource by a trusted user who has been granted permission to access the resource, with the attribute of the resource, The procedure for recording the association between the user access context and the attributes of the resource using the computer, To form the aforementioned trained machine learning model, the computer inputs the user access context and the attributes of the resource as training data into the machine learning model. A computer program according to claim 16 or 17, which further causes the execution of the above.

19. The computer program according to claim 16 or 17, wherein the user access context further includes at least one of the user's location when requesting access to the resource and the time the user requested access to the resource.

20. To the aforementioned computer, The computer receives a request from a client device via a network for the user to access the resource, and The computer performs a procedure to search the access policy database for the access policy corresponding to the resource requested by the user. A computer program according to claim 16 or 17, which further causes the execution of the above.

21. To the aforementioned computer, The procedure by which the computer determines, based on the search, whether or not the access policy for the resource exists in the access policy database, The procedure involves the computer determining, in response to the computer determining that no access policy exists for the resource in the access policy database, instructing the user access context generator to use the trained machine learning model to generate the access policy for the resource having the necessary user access context for accessing the resource. The computer program according to claim 20, which further performs the following.

22. To the aforementioned computer, The procedure involves the computer determining, in response to the computer determining that the access policy for the resource exists in the access policy database, whether the user's user access context satisfies the required user access context of the access policy for the resource; The computer, in response to determining that the user's user access context does not satisfy the required user access context of the access policy for the resource, performs the following steps: The computer program according to claim 21, which further executes the following.

23. To the aforementioned computer, In response to the computer determining that the user's user access context satisfies the required user access context of the access policy for the resource, the computer grants the user access to the resource. The computer program according to claim 22, which further causes the following to be executed.

24. A computer program that automatically generates and implements an access policy, wherein the computer program is provided to a computer, The procedure involves obtaining, from the trained machine learning model, the output of the user access context necessary to access the resource, based on the extracted attributes of the resource input to the trained machine learning model, provided by the computer; The computer uses the output of the necessary user access context to access the resource as an access policy for the resource, and the procedure controls the user's access to the resource. Make it run, To the aforementioned computer, A procedure by which the computer allows access to the resource by trusted users having various user access contexts, wherein the resource is protected by the computer. The procedure for the computer to extract the attributes of the resources accessed by the trusted user, The procedure for recording in a resource access log the various user access contexts of the trusted user when they accessed the resource, and the attributes of the resource, by the computer. A computer program that causes something to be executed further.

25. To the aforementioned computer, A procedure for training a machine learning model using the various user access contexts of the trusted user when accessing the resource recorded in the resource access log, and the attributes of the resource, by the computer; The computer enables a procedure for enabling context-based access control to the resource by any user requesting access to the resource. The computer program according to claim 24, which further performs the following.

Images