Dynamic Access Control with Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control security models inadequately protect computer systems from malicious software by granting excessive permissions to processes, allowing malware to exploit code defects and access unnecessary resources, leading to security vulnerabilities.
Innovation Solution
A software facility with a logic-driven access control layer that includes an authorization module and anomaly detection module, which enforces policies based on the identity of principals and resources, performs auditing, and adjusts access control checks to impose more restrictive policies when anomalies are detected, thereby limiting access to only necessary resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional access control security models grant all programs running in user context permission to access all user resources, then user resource accessibility is improved, but system security deteriorates due to excessive permissions being granted to malware
Solution Approach 1:
The patent segments access control from user credentials to process identity, dividing the authorization decision into two independent factors: who the process claims to be (identity) and what it actually needs (policy). This segmentation allows the system to grant minimal necessary permissions rather than blanket access, resolving the contradiction between accessibility and security.
Solution Approach 2:
The patent implements dynamic access control where permissions are not static but adapt based on runtime conditions. The anomaly detection module continuously monitors process behavior and dynamically adjusts access decisions, allowing the system to maintain security while permitting legitimate access patterns that evolve over time.
2Reliability
If access control checks are performed for every resource access request, then system security is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary access control checks at process startup rather than at every resource access point. By establishing access rules upfront based on process identity and policy, the system avoids repeated authentication overhead while maintaining security boundaries throughout the process lifecycle.
Solution Approach 2:
The patent introduces an intermediary access control layer between the process and resources that caches authorization decisions. This intermediary layer filters out routine access operations that have been pre-approved, allowing only exceptional or unapproved access patterns to trigger full security checks, thereby reducing overall processing overhead.
Data Source
AI summary
A facility for providing access authorization is provided. The facility initially enforces a first, less restrictive policy when making its access control decisions. Subsequent to detecting an anomaly, the facility enforces a second, more restrictive policy when making its access control decisions. The facility returns to enforcing the first, less restrictive policy when the anomaly no longer exists. In another embodiment, the facility enforces a policy after detecting an anomaly and until the anomaly has ended.