Zero Trust Access Control Using Community Risk Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing risk-based access control systems in zero trust architectures do not consider how entities pose risks to the communities they typically relate to, failing to account for community situation awareness in determining user and device-specific scores.
Innovation Solution
Implement a community-based situation-aware access control system that utilizes a knowledge graph and community detection techniques to segment entities into communities, compute risk and tolerance scores dynamically, and propagate threat information within communities, leveraging a SIEM infrastructure representation database to detect and respond to suspicious behaviors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If risk-based access control determines user-specific and device-specific scores based on static or entry point attributes, then access control decisions can be made efficiently, but the system fails to account for community situation awareness and how entities pose risks to the communities they relate to
Solution Approach 1:
The system segments the network into communities of entities using community detection algorithms on a knowledge graph. This segmentation allows the system to analyze risk at the community level while maintaining efficient individual access control decisions, resolving the contradiction by organizing entities into meaningful groups that capture contextual relationships without overwhelming computational complexity
Solution Approach 2:
The knowledge graph serves as an intermediary structure that connects individual entities to their communities and captures contextual relationships. This intermediary enables the system to efficiently query community-level risk information during access control decisions without requiring direct analysis of all network entities, thus maintaining productivity while reducing information loss
2Reliability
If the system propagates threat information to entire communities when one entity exceeds risk threshold, then situational awareness and threat detection improve, but system complexity and computational overhead increase
Solution Approach 1:
The system applies local quality by propagating threat information selectively within identified communities rather than globally across the entire network. This localized approach improves threat detection reliability within relevant contexts while reducing system complexity by limiting the scope of propagation to only those entities that share community relationships with the detected threat
Solution Approach 2:
The system dynamically adjusts risk and tolerance scores based on community conditions and propagates threats only when entities exceed risk thresholds. This dynamic behavior allows the system to maintain high reliability by responding to actual threats while reducing complexity by avoiding unnecessary propagations during normal operations
Data Source
AI summary
One example method includes identifying, in a knowledge graph that represents a ZT (zero trust) environment, communities that each comprise one or more entities, computing a risk of granting access to one of the entities, when the risk exceeds a threshold, alerting the ZT environment in its entirety about a possible threat involving the entity regarding which the risk was computed, and propagating information about the threat to the entities that are members of the community to which the one entity belongs.