Reputation-Based Authorization Decisions

• US 20080141366A1
• Filed: 12/08/2006
• Published: 06/12/2008
• Est. Priority Date: 12/08/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Cross, David, Kurien, Varugis, Field, Scott
• Granted Patent: US 7,991,902 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

This document describes tools capable of receiving reputation metadata effective to enable better decision making about whether or not to authorize operations. The tools may build a reputation value from this reputation metadata and, based on this value and an authorization rule, better decide whether or not to authorize an operation requested by some program, application, or other actor.

Claims

1. One or more computer-readable media having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising:

receiving, from an actor, a request to perform an operation on an object;

receiving an authorization input, the authorization input including a reputation value indicative of the actor'"'"'s reputation;

comparing the authorization input including the reputation value to an authorization rule; and

in response to the comparing, outputting an authorization decision pertaining to the request to perform the operation.

2. The media of claim 1, wherein the authorization decision comprises one of the following:

allow performance of the requested operation;

deny performance of the requested operation;

or prompt a user to decide whether to allow or deny performance of the requested operation.

3. The media of claim 1, further comprising making the authorization decision based on the reputation value, a type of the operation requested, and a security level of the object.

4. The media of claim 1, wherein the reputation value is based on input received from a group of human users indicating each human user'"'"'s experience with the actor or with the actor'"'"'s requested operation.

5. The media of claim 1, wherein the reputation value is based on input received from a group of computing entities indicating each computing entity'"'"'s review or analysis of the actor.

6. The media of claim 1, wherein the actor comprises code, software, an application, a file, a document, a picture, an applet, or an ActiveX control.

7. The media of claim 1, wherein the reputation value comprises a single reputation value, and further comprising aggregating a plurality of reputation metadata from a plurality of different reputation metadata providers into the single reputation value.

8. One or more computer-readable media having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising:

receiving a reputation value from a reputation service provider, the reputation value indicative of an actor'"'"'s reputation; and

at least in part due to the reputation value, creating an authorization input for use in deciding whether the actor should have permission to perform an operation on an object.

9. The media of claim 8, further comprising receiving at least one of:

a user identity;

an actor type;

or a system type.

10. The media of claim 9, wherein the authorization input is also created at least in part by the received user identity, actor type, or system type.

11. The media of claim 8, wherein the reputation value comprises reputation metadata received from a plurality of human users and indicative of each human user'"'"'s previous experience with a performance of the actor.

12. The media of claim 8, wherein the reputation value comprises a first reputation value from a first reputation service provider, and further comprising:

receiving a second reputation value from a second reputation service provider; and

aggregating the received first and second reputation values into a single aggregate reputation value for use in deciding whether the actor should have permission to perform the operation on the object.

13. The media of claim 8, further comprising outputting the authorization input to an authorization engine to compare the authorization input to an authorization policy.

14. The media of claim 13, wherein the authorization engine is configured to automatically make an authorization decision pertaining to whether the actor should have permission to perform the operation on the object in response to the comparison.

15. One or more computer-readable media having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising:

gathering reputation metadata from one or more reputation metadata providers, the reputation metadata comprising each reputation metadata provider'"'"'s estimation of an actor'"'"'s reputation; and

building an aggregate reputation value from the reputation metadata, the aggregate reputation value indicative of each estimation and for use in an authorization decision.

16. The media of claim 15, wherein the authorization decision determines whether or not to allow the actor to run or perform an operation on the computing device.

17. The media of claim 15, wherein the gathering of the reputation metadata comprises conducting a community vote and at least one of the reputation metadata providers comprises a user in the community.

18. The media of claim 15, wherein the gathering of the reputation metadata comprises gathering product review information pertaining to the actor'"'"'s reputation from one or more computing entities.

19. The media of claim 15, wherein at least a portion of the reputation metadata comprises a history of performance of the actor.

20. The media of claim 15, wherein the authorization decision is based at least in part on the reputation value, a type of operation requested by the actor, and attributes of an object upon which the actor requests to perform the operation.