CAEP Hub Engine Rules for Dynamic Access Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identity-related breaches, particularly due to standing access and privilege creep, pose significant security and compliance issues for organizations, as users maintain unnecessary access rights to systems, applications, and data, leading to unauthorized access and data theft.
Innovation Solution
A computer-implemented method utilizing a nodal graph to manage and enforce permissions dynamically, including automated access management actions such as revoking sessions or requiring reauthentication based on context, and a platform that integrates with various data sources to ensure real-time, context-aware access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standing access is provided to users for systems and applications, then ease of operation is improved, but security is worsened due to unauthorized access risks
Solution Approach 1:
The patent implements dynamic access control by continuously evaluating user context (device status, location, time, behavior patterns) to determine access permissions in real-time. Access rights are not static but adapt dynamically based on current conditions, allowing convenient access when context is appropriate while blocking unauthorized access when context indicates risk, thus resolving the contradiction between ease of operation and security.
Solution Approach 2:
The system continuously monitors user behavior, device state, and access patterns, feeding this information back to the access control engine. This feedback loop enables the system to adjust access permissions based on observed context, maintaining security while allowing legitimate users convenient access. The feedback mechanism detects anomalies and triggers reauthentication or access denial when necessary.
2Object-affected harmful factors
If continuous access evaluation is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The access control system is segmented into independent modular components: context collection modules, evaluation engine, policy management module, and enforcement module. Each component performs a specific function and can be independently configured and maintained. This segmentation reduces system complexity by making the overall system more manageable while still providing comprehensive continuous access evaluation for enhanced security.
Solution Approach 2:
The access control system is designed as a universal platform that can evaluate multiple context factors (device status, location, time, user behavior) across diverse systems and applications through a single unified engine. This multi-functionality reduces complexity by avoiding the need for separate access control implementations for different scenarios, while still providing comprehensive security evaluation.
3Reliability
If real-time context-aware access control is enforced, then reliability is improved, but use of energy increases due to continuous monitoring
Solution Approach 1:
The system implements periodic access evaluation rather than truly continuous monitoring. Context is evaluated at regular intervals and triggered events (login attempts, policy changes, detected anomalies). This periodic approach maintains reliable access control by checking context at sufficient frequencies while significantly reducing energy consumption compared to constant real-time monitoring of all user activities.
Solution Approach 2:
The system leverages existing device sensors, logs, and data sources that already collect context information for other purposes (device status, location services, activity logs). By reusing this existing data infrastructure, the system achieves reliable context-aware access control without duplicating data collection efforts, thereby minimizing additional energy consumption while maintaining access control accuracy.
Data Source
AI summary
Embodiments disclosed herein provide a computer-implemented method including operations of executing a first query against a nodal graph resulting in retrieval of a state node, wherein the state node includes state information in the nodal graph, wherein the first query is comprised of a first trigger that represents a predetermined condition, determining whether the first trigger forms a portion of a first rule stored in the nodal graph, wherein the first rule is comprised of the first trigger and a list of one or more actions to be taken when the predetermined condition of the first trigger appears in the nodal graph, responsive to determining that the first trigger forms the portion of the first rule, executing a second query against the nodal graph resulting in retrieval of the first rule, and executing the first rule based on context extracted from the state node.