In-Memory Entitlements Graph for Real-Time Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional access management systems face challenges in preventing unauthorized access due to the ever-evolving cyber threat landscape, disparate password stores, and inadequate monitoring of account activity, especially for highly-privileged accounts, leading to potential damage from compromised credentials.
Innovation Solution
A data-driven infrastructure access control system utilizing an in-memory entitlements graph that verifies user entitlements in real-time, integrates human resources, entitlement, and policy data, and performs step-up validation to authorize access to assets and actions, enabling continuous alignment of access permissions with organizational changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based access control is used, then implementation is simple, but security is compromised due to evolving cyber threats and inadequate monitoring
Solution Approach 1:
The patent introduces an access gateway as an intermediary component between users and assets. This gateway enforces entitlement checks and monitors account activity, acting as a mediator that enhances security without requiring complex changes to existing password infrastructure. The gateway validates credentials and enforces access policies, resolving the contradiction by adding security functionality through a dedicated intermediary rather than complicating the entire access control system.
Solution Approach 2:
The patent implements continuous monitoring of account activity with real-time alerting and response capabilities. This feedback mechanism detects compromised credentials and unusual access patterns, enabling the system to respond dynamically to security threats. The feedback loop enhances security reliability by providing ongoing verification and alerting, rather than relying solely on static password protection.
2Reliability
If real-time entitlement verification is implemented, then security is enhanced, but system latency increases
Solution Approach 1:
The patent pre-computes and caches entitlement relationships in an in-memory graph structure before access requests occur. By preparing the entitlement data ahead of time and storing it in optimized in-memory format, the system reduces the computational burden during actual access verification. This preliminary action allows real-time entitlement checks to proceed quickly, resolving the contradiction between accurate verification and time loss.
3Measurement precision
If comprehensive account activity monitoring is implemented, then detection of compromised credentials improves, but system complexity and resource consumption increase
Solution Approach 1:
The patent extracts the monitoring function into a separate, dedicated component within the access gateway. Rather than embedding complex monitoring logic throughout the entire access control system, the monitoring capabilities are taken out as a specialized subsystem that focuses specifically on account activity analysis. This extraction reduces overall system complexity while maintaining high detection accuracy for compromised credentials.
Data Source
AI summary
In one embodiment, in access gateway comprising at least one computer processor, a method for real-time data protection may include: (1) receiving a user login comprising a user identifier; (2) retrieving, using an in-memory entitlements graph, a role definition for the user identifier, wherein the role definition comprises allowed actions, entitled assets, and a system account; (3) receiving a selection of a requested asset from the entitled assets and a requested action from the allowed actions; (4) verifying the user's entitlement to access the requested asset and perform the requested action with the system account using the in-memory entitlement graph based on the user identifier, the system account, the requested asset, and the requested action; and (5) authorizing the user's entitlement to access the requested asset and perform the requested action with the system account substantially at a time of requested access.