Dynamic access controls using verifiable claims
Policy-based techniques are provided for dynamic access control for resources. One method comprises, upon a user attempt to access a given resource, identifying a policy defined for access to the given resource, wherein the policy comprises a rule and an allowed issuer of a verifiable claim; determining if the rule and the allowed issuer are satisfied based on an evaluation of the verifiable claim; and allowing the user to access the given resource if the rule and the allowed issuer are satisfied. A given rule can specify a threshold for a data item obtained from an allowed issuer. The policy can be stored by one or more policy hubs. A plurality of policy hubs can be organized in a hierarchical structure, such that one given policy is applied to the given resource in a predictable manner.
1. A method, comprising:
in response to a user attempt to access a given resource:
identifying at least one policy defined for access to the given resource, wherein the at least one policy comprises at least one rule and at least one allowed issuer of a verifiable claim, wherein the verifiable claim is issued, prior to the user attempt to access the given resource, by the at least one allowed issuer and comprises a cryptographically signed attestation with respect to at least one characteristic of the user, wherein at least a given one of the at least one characteristic of the user changes over time and wherein the verifiable claim is automatically updated based at least in part on a learned behavior of the user to update the attestation with respect to the given characteristic of the user;
determining, by a verifier entity, if the at least one rule and the at least one allowed issuer are satisfied based on an evaluation of the verifiable claim, wherein the verifier entity is distinct from the at least one allowed issuer; and
automatically allowing the user to access the given resource in response to the at least one rule and the at least one allowed issuer being satisfied;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , further comprising preventing the user from accessing the given resource if one or more of the at least one rule and the at least one allowed issuer are not satisfied.
3. The method of claim 1 , wherein one or more of the at least one rule and the at least one allowed issuer are obtained by scanning a Quick Response code associated with the given resource.
4. The method of claim 1 , wherein the at least one rule specifies a threshold for at least one data item obtained from the at least one allowed issuer.
5. The method of claim 4 , wherein the at least one data item is obtained from the at least one allowed issuer using one or more of a (i) smart wallet that prefetches the at least one data item using learned behavior of the user; and (ii) a publication-subscription model.
6. The method of claim 1 , wherein the given resource comprises one or more of a device, a software application and an account.
7. The method of claim 1 , wherein the at least one policy is stored by at least one policy hub.
8. The method of claim 7 , wherein a plurality of the at least one policy hub is organized in a hierarchical structure, such that a given one of a plurality of the at least one policy is applied to the given resource in a predictable manner.
9. The method of claim 1 , wherein the verifier entity comprises one or more of at least one device associated with the given resource and a hosted claims verification service.
10. The method of claim 1 , wherein the at least one policy is defined by presenting a plurality of approved issuers for selection as part of the at least one policy.
11. The method of claim 1 , wherein a collection of the verifiable claim is delegated to at least one user device.
12. A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
in response to a user attempt to access a given resource:
identifying at least one policy defined for access to the given resource, wherein the at least one policy comprises at least one rule and at least one allowed issuer of a verifiable claim, wherein the verifiable claim is issued, prior to the user attempt to access the given resource, by the at least one allowed issuer and comprises a cryptographically signed attestation with respect to at least one characteristic of the user, wherein at least a given one of the at least one characteristic of the user changes over time and wherein the verifiable claim is automatically updated based at least in part on a learned behavior of the user to update the attestation with respect to the given characteristic of the user;
determining, by a verifier entity, if the at least one rule and the at least one allowed issuer are satisfied based on an evaluation of the verifiable claim, wherein the verifier entity is distinct from the at least one allowed issuer; and
automatically allowing the user to access the given resource in response to the at least one rule and the at least one allowed issuer being satisfied.
13. The computer program product of claim 12 , wherein the at least one rule specifies a threshold for at least one data item obtained from the at least one allowed issuer.
14. The computer program product of claim 12 , wherein the at least one policy is stored by at least one policy hub, wherein a plurality of the at least one policy hub is organized in a hierarchical structure, such that a given one of a plurality of the at least one policy is applied to the given resource in a predictable manner.
15. The computer program product of claim 12 , wherein the at least one policy is defined by presenting a plurality of approved issuers for selection as part of the at least one policy.
16. An apparatus, comprising:
a memory; and
at least one processing device, coupled to the memory, operative to implement the following steps:
in response to a user attempt to access a given resource:
identifying at least one policy defined for access to the given resource, wherein the at least one policy comprises at least one rule and at least one allowed issuer of a verifiable claim, wherein the verifiable claim is issued, prior to the user attempt to access the given resource, by the at least one allowed issuer and comprises a cryptographically signed attestation with respect to at least one characteristic of the user, wherein at least a given one of the at least one characteristic of the user changes over time and wherein the verifiable claim is automatically updated based at least in part on a learned behavior of the user to update the attestation with respect to the given characteristic of the user;
determining, by a verifier entity, if the at least one rule and the at least one allowed issuer are satisfied based on an evaluation of the verifiable claim, wherein the verifier entity is distinct from the at least one allowed issuer; and
automatically allowing the user to access the given resource in response to the at least one rule and the at least one allowed issuer being satisfied.
17. The apparatus of claim 16 , wherein the at least one rule specifies a threshold for at least one data item obtained from the at least one allowed issuer.
18. The apparatus of claim 16 , wherein the at least one policy is stored by at least one policy hub, wherein a plurality of the at least one policy hub is organized in a hierarchical structure, such that a given one of a plurality of the at least one policy is applied to the given resource in a predictable manner.
19. The apparatus of claim 16 , wherein the at least one policy is defined by presenting a plurality of approved issuers for selection as part of the at least one policy.
20. The apparatus of claim 16 , wherein a collection of the verifiable claim is delegated to at least one user device.