Least-Privilege Permission Management via Predictive Usage Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of cloud services introduces security vulnerabilities due to broad permissions granted to user accounts, applications, or processes, leading to unintentional and malicious changes and data leaks.
Innovation Solution
A system that predicts the future resource usage of an identity by analyzing its history, the history of similar identities, and peer identities, then determines the bare minimum permissions needed to perform these predicted actions, using a graph-based model with node embeddings and deep learning techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If broad permissions are granted to user accounts, applications, or processes to ensure they can perform all possible tasks, then operational flexibility and productivity are improved, but security vulnerabilities increase leading to unintentional and malicious changes and data leaks
Solution Approach 1:
The patent implements dynamic permission adjustment by continuously monitoring resource usage patterns and automatically updating permission levels. The system transitions from static broad permissions to dynamic least-privilege permissions that adapt based on observed behavior, resolving the contradiction between operational flexibility and security by making permissions flexible only when necessary.
Solution Approach 2:
The system performs preliminary analysis of resource usage patterns before making permission decisions. By studying historical usage data and predicting future needs, the system pre-configures appropriate permission levels, avoiding both excessive broad permissions and overly restrictive limitations, thus balancing security with operational flexibility.
2Device complexity
If permission analysis is based only on past resource usage history, then implementation simplicity is improved, but accuracy of predicting future resource usage needs deteriorates
Solution Approach 1:
The system performs preliminary analysis of resource usage patterns before making permission decisions. By studying historical usage data and predicting future needs, the system pre-configures appropriate permission levels, avoiding both excessive broad permissions and overly restrictive limitations, thus balancing security with operational flexibility.
Solution Approach 2:
The patent implements dynamic permission adjustment by continuously monitoring resource usage patterns and automatically updating permission levels. The system transitions from static broad permissions to dynamic least-privilege permissions that adapt based on observed behavior, resolving the contradiction between operational flexibility and security by making permissions flexible only when necessary.
3Measurement precision
If deep learning models with node embeddings are used to identify similar identities and predict resource usage, then prediction accuracy is improved, but system complexity increases
Solution Approach 1:
The system employs self-service mechanisms where the deep learning model automatically trains on organizational data and continuously improves its predictions without manual intervention. The model serves itself by learning from patterns in the data, reducing the need for complex manual configuration and expertise while maintaining high prediction accuracy.
Solution Approach 2:
The patent replaces manual permission management processes with automated deep learning-based prediction systems. Instead of security administrators manually analyzing usage patterns and making permission decisions, the system uses machine learning models to automatically perform these tasks, substituting mechanical human processes with automated computational ones.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
The least-privilege permission needed for an identity, such as a user account, application, user group, or process, to access a resource of a tenant of a cloud service is determined from a predicted future resource usage. The predicted future resource usage is based on the resource usage history of an identity, the resource usage history of similar identities and the resource usage history of its peers. Similar identities are determined from node embeddings of a graph that represents the assigned permissions of an identity to a resource and the usage activity at a resource. The permissions needed to perform the predicted future resource usage is compared with the current permission assignments to determine the bare minimum permission that an identity needs for its ongoing and future workflow.