Purpose-Based Access Provisioning With Time-Limited Identity Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems in Cloud, SaaS applications fail to efficiently provision and de-provision access based on temporal and role-based requirements, leaving compromised identities vulnerable to attackers and causing inefficiencies due to manual management across multiple applications.
Innovation Solution
A multi-agent identity security governance system that enforces access policies, detects anomalies, and ensures compliance, enabling just-in-time, purpose-based access control through intelligent agents that automatically provision and de-provision identities based on defined time windows and purposes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ABAC or RBAC models are implemented to limit access scope, then security against compromised identities is improved, but access cannot be de-provisioned until the identity owner leaves the organization or no longer requires access
Solution Approach 1:
The patent implements dynamic access provisioning where identities are assigned roles and attributes temporarily based on just-in-time requirements. The system automatically de-provisions access after a specified time window or upon task completion, transforming static long-term access into dynamic temporary access that adapts to changing security requirements.
Solution Approach 2:
The system pre-defines time windows and access policies before identities need access. Access is automatically granted within predetermined timeframes and automatically revoked when the time window expires, eliminating the need for manual de-provisioning and ensuring access is limited to necessary durations.
2Reliability
If manual provisioning and de-provisioning is performed across multiple Cloud SaaS applications, then access control is implemented, but the process is cumbersome, error-prone, and time-consuming
Solution Approach 1:
The patent consolidates access management across multiple Cloud SaaS applications into a single centralized system. The unified platform manages identity provisioning and de-provisioning across all connected applications simultaneously, eliminating the need to manually manage each application separately and reducing both time and error risks.
Solution Approach 2:
The system automatically performs provisioning and de-provisioning operations without requiring manual intervention. Identities are automatically granted access when needed and automatically revoked when time windows expire or tasks are completed, freeing administrators from repetitive manual tasks across multiple applications.
3Ease of operation
If access is provisioned in perpetuity for assigned roles, then identities maintain continuous access, but compromised identities remain vulnerable to attackers indefinitely
Solution Approach 1:
The patent implements periodic access where identities receive access rights for specific time windows rather than continuously. Access is automatically renewed only if still needed, otherwise it expires. This periodic approach maintains operational simplicity while fundamentally reducing the window of opportunity for attackers to exploit compromised credentials.
Solution Approach 2:
The system changes the temporal parameter of access from permanent to temporary with defined expiration times. By modifying the duration parameter of access rights, the system maintains ease of operation through automated management while dramatically reducing security vulnerabilities associated with long-term access permissions.
Data Source
AI summary
A system for facilitating just-in-time, purpose-based access control (JITPBAC for identities within Cloud, SaaS applications. Using this method, identities within Cloud, SaaS applications will have no access by default. All access that is required by owners of the identities will be organized under Purposes, which represent a list of identity owners as well as a list of entities accessible within specific applications. When an identity owner is listed under a Purpose, that identity owner is eligible to be assigned the Purpose. To become eligible for a Purpose that an identity owner has no access to, the identity owner must request access to the Purpose and subsequently be approved by a risk manager within the organization. Additional information must be provided as a part of the request including but not limited to how long the identity owner should be assigned to the Purpose, what time of day the identity owner is expected to use the Purpose, and how many extensions can be requested for the assigned Purpose as well as the duration of the extension.