Dynamic behavior-based access control system and method

• US 6,591,265 B1
• Filed: 04/03/2000
• Issued: 07/08/2003
• Est. Priority Date: 04/03/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Yu, Philip S., Erickson, Thomas D., Kellogg, Wendy A., Malkin, Peter K., Richards, John T.
• Primary Examiner(s): Alam, Hosain T.
• Application Number:
  US09/542,481
• Time in Patent Office: 1,191 Days
• Field of Search: 707/9, 707/102, 707/100, 707/5, 713/200-202
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: Y10S 707/99935 Query augmenting and refining, e.g. inexact access
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

The present invention provides a method for controlling an entity'"'"'s access to a resource based on observed behavior of the entity. The method assigns the entity a default authorization meta-tag. The method monitors the entity'"'"'s behavior and updates the entity'"'"'s meta-tag based upon the observed behavior. Accordingly, dynamic behavior-based access control is achieved.

Claims

1. A method for controlling an entity'"'"'s access to a resource based on observed behavior of the entity comprising the steps of:

assigning the entity a default authorization meta-tag comprising a key-value rating describing behavior of the entity;

evaluating the entity'"'"'s behavior against a plurality of policies; and

updating the key-value rating based upon the evaluation of the entity'"'"'s behavior.

2. The method of claim 1, wherein the authorization meta-tag is multidimensional.

3. The method of claim 1, wherein the meta-tag is a PICS label.

4. The method of claim 1, further including the step of granting access to the resource based on policies having a present level of rating from the entity'"'"'s authorization meta-tag.

5. The method of claim 1, wherein the resource is an executable and data.

6. The method of claim 1, wherein the meta-tag characterizes one of the entity'"'"'s dependability, expertise and interactivity.

7. The method of claim 1, wherein the meta-tag characterizes one of the entity'"'"'s activity, quality of input and hostility.

8. The method of claim 2, wherein the meta-tag includes a confidence level rating for a rating contained in the meta-tag.

9. The method of claim 1, wherein the authorization meta-tag changes in relation to time.

10. A computer useable medium having computer readable program code embodied therein for automatically updating a meta-tag based on observed behavior, the computer readable program code in the computer program product comprising:

computer readable program code for causing a computer to retrieve a policy associated with the meta-tag from a policy database, wherein the meta-tag provides at least one key-value rating describing behavior of an entity;

computer readable program code for causing the computer to compare the policy to an observed behavior of the entity, wherein the observed behavior of the entity satisfies the policy; and

computer readable program code for causing the computer to modify the key-value rating according to the policy, the policy specifying a modification based on the observed behavior of the entity.

11. The computer program of claim 10, wherein the meta-tag comprises at least one pair of indicia describing a user.

12. The computer program of claim 10, wherein the meta-tag is assigned to a new user and stored in the meta-tag database.

13. The computer program of claim 10, wherein the observed behavior comprises one of a defined observable behavior and a Boolean combination of defined observable behaviors.

14. The computer program of claim 13, wherein the Boolean combination is defined as a plurality of behaviors linked by an operation in a policy.

15. The computer program of claim 10, wherein the computer determines an update by comparing the retrieved policy to the observed behavior.

16. The computer program of claim 10, wherein the computer posts an update to the meta-tag database when the retrieved policy matches the observed behavior.

21. The computer program of claim 10, wherein the meta-tag comprises a confidence level rating for a key-value rating contained in the meta-tag, wherein the confidence level rating corresponds to one of an age of the key-value rating contained in the meta-tag, a maximum value of the key-value rating contained in the meta-tag over a given time period, and a minimum value of the key-value rating contained in the meta-tag over the given time period.

17. A program storage device readable by machine, tangible embodying a program of instructions executable by the machine to perform method steps for automatically updating a meta-tag based on observed behavior, the method steeps comprising:

retrieving a policy associated with the meta-tag from a policy database, wherein the meta-tag provides at least one key-value rating describing behavior of an entity;

comparing the policy to an observed behavior of the entity, wherein the observed behavior of the entity satisfies the policy; and

modifying the key-value rating according to the policy, the policy specifying a modification based on the observed behavior of the entity.

18. The method for automatically updating the meta-tag as in claim 17, further comprising the steps of:

assigning a new user a default meta-tag; and

storing the meta-tag in the meta-tag database.

19. The method for automatically updating the meta-tag as in claim 17, further comprising the step of modifying the meta-tag according to the policy, the policy specifying the modification based on observed behavior.

20. The method for automatically updating the meta-tag as in claim 17, wherein determining the update further comprises the step of:

comparing the retrieved policy to the observed behavior;

if the observed behavior is equal to a behavior defined in the policy increment the meta-tag;

if the observed behavior is not equal to a behavior defined in the policy the key-value rating is not updated.