RISK-BASED CREDENTIAL MANAGEMENT

• US 20160226914A1
• Filed: 05/27/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nye, Philip A.J., Doddy, Leigh T., Hockings, Christopher J., Jain, Dinesh T.
• Granted Patent: US 9,672,348 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Risk-based credential management is provided. A request to checkout credentials is received. The credentials are associated with at least one managed resource. A risk value of the request is determined. The determination of the risk value is based, at least in part, on risk information of the requesting device. A determination is made whether to deny the request based, at least in part, on the risk value and a first predetermined threshold of a checkout policy.

Claims

1. A method for credential management, the method comprising:

receiving, by one or more processors, from a requesting device, a request to checkout credentials, wherein the credentials are associated with at least one managed resource;

determining, by one or more processors, a risk value of the request, wherein the determination of the risk value is based, at least in part, on risk information of the requesting device; and

determining, by one or more processors, whether to deny the request based, at least in part, on the risk value and a first predetermined threshold of a checkout policy.

2. The method of claim 1, wherein determining whether to deny the request comprises:

determining, by one or more processors, that the risk value violates the first predetermined threshold and, in response, denying the request.

3. The method of claim 1, wherein determining whether to deny the request comprises:

determining, by one or more processors, that the risk value does not violate the first predetermined threshold and, in response, granting the request.

4. The method of claim 1, wherein the credentials authorize access to the at least one managed resource associated with the credentials.

5. The method of claim 2, wherein determining, by one or more processors, whether to deny the request is further based on a security status of each of the at least one managed resources.

6. The method of claim 5, further comprising:

responsive to determining that the security status indicates that a first managed resource of the at least one managed resource is compromised, denying, by one or more processors, the request.

7. The method of claim 1, wherein the risk value is based, at least in part, on one or more types of risk information that are specified by the checkout policy.

8. The method of claim 7, wherein the one or more types of risk information identify at least one of:

data of the requesting device that matches a malware definition, a version of each of a plurality of programs installed on the requesting device, and a security patch installed on the requesting device.