Granted Patent B2

US 12,542,813 · App. 18/483,230 · Granted Feb 3, 2026

Inventors: Shaun Applegate-Swanson (Walnut Creek, CA); Carl Waldspurger (Palo Alto, CA); Balaji Parimi (Sunnyvale, CA); Naveen Jangalapalli (San Jose, CA); Maya Neelakandhan (Sunnyvale, CA); Venkata Adusumilli (Cupertino, CA); Parag Bajaria (Cupertino, CA)

Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC

H04L63/20H04L41/22H04L63/104H04L63/105

Abstract

Claims (73)

1 . A system configured to adjust access privileges of a first identity to resources within an authorization system, the system comprising:

a processor; and

memory comprising executable code that, upon execution by the processor, causes the processor to:

compute a first usage score as a first usage function of:

a first measure of accesses by the first identity to at least one permissioned resource of a set of permissioned resources of the resources to which the first identity has access privileges, and

a number of permissioned resources in the set of permissioned resources;

compute a second usage score for a second identity associated with a same role usage cohort as the first identity;

compute an aggregate score as a function of the first usage score and the second usage score; and

adjust the access privileges of the identity based on the aggregate score.

2 . The system of claim 1 , wherein to compute the first usage score, the executable code, upon execution by the processor, further causes the processor to:

determine a second measure as a ratio based on the number of permissioned resources in the set of permissioned resources and a number of the resources; and

compute the first usage score using the second measure.

3 . The system of claim 1 , wherein the first usage function comprises a ratio of the first measure to the number of permissioned resources in the set of permissioned resources.

4 . The system of claim 1 , wherein the executable code, upon execution by the processor, further causes the processor to:

compute a respective usage score for a plurality of identities comprising the first identity, the second identity, and a third identity; and

compute the aggregate usage score as a function of the respective usage scores.

5 . The system of claim 4 , wherein to compute the aggregate usage score, the executable code, upon execution by the processor, further causes the processor to:

compute the aggregate usage score as a ratio based on a weighted sum of the respective usage scores for each of the plurality of identities and a sum of a maximum possible risk value of each of the plurality of identities.

6 . The system of claim 1 , wherein the executable code, upon execution by the processor, further causes the processor to:

apply a weight to a first resource of the set of permissioned resources;

determine a second measure of the set of permissioned resources with the first resource having the weight applied thereto; and

compute the first usage score using the second measure.

7 . The system of claim 6 , wherein the executable code, upon execution by the processor, further causes the processor to:

compile access information of the accesses by the first identity to the at least one permissioned resource of the set of permissioned resources;

adjust the weight to the first resource; and

compute the first usage score using the adjusted weight.

8 . The system of claim 1 , wherein the executable code, upon execution by the processor, further causes the processor to:

detect attempts by the first identity to access a first resource of the at least one permissioned resources wherein the identity fails to access the first resource;

adjust the number of permissioned resources in the set of permissioned resources based on a measure of the detected failed attempts to access the first resource; and

compute the first usage score using the adjusted number of permissioned resources in the set of permissioned resources.

9 . A computer-implemented method for adjusting access privileges of an identity to resources within an authorization system, comprising:

detecting accesses by the identity to at least one permissioned resource of a set of permissioned resources of the resources to which the identity has access privileges;

determining a second measure as a ratio based on a number of permissioned resources in the set of permissioned resources and a number of the resources;

computing a first usage score as a first usage function of:

a first measure of use by the identity of its access privileges, and

the second measure; and

adjusting the access privileges of the identity based on the first usage score.

10 . The method of claim 9 , wherein the first usage function comprises a ratio of the first measure to the number of permissioned resources in the set of permissioned resources.

11 . The method of claim 9 , wherein the method further comprises:

computing a respective usage score for a plurality of identities comprising the identity; and

computing an aggregate usage score as a function of the respective usage scores.

12 . The method of claim 11 , wherein said computing the aggregate usage score comprises:

computing the aggregate usage score as a ratio based on a weighted sum of the respective usage scores for each of the plurality of identities and a sum of a maximum possible risk value of each of the plurality of identities.

13 . The method of claim 11 , wherein the identity and a second identity of the plurality of identities are associated with the same role usage cohort.

14 . The method of claim 9 , further comprising:

applying a weight to a first resource of the set of permissioned resources;

determining a third measure of the set of permissioned resources with the first resource having the weight applied thereto; and

computing the first usage score using the third measure.

15 . The method of claim 14 , further comprising:

compiling access information of the accesses by the identity to the at least one permissioned resource of the set of permissioned resources;

adjusting the weight to the first resource; and

computing the usage score using the adjusted weight.

16 . The method of claim 9 , further comprising:

detecting attempts by the identity to access a first resource of the at least one permissioned resource wherein the identity fails to access the first resource;

adjusting the number of permissioned resources in the set of permissioned resources based on a measure of the detected failed attempts to access the first resource; and

computing the usage score using the adjusted number of permissioned resources in the set of permissioned resources.

17 . A non-transitory storage configured to store executable code that, upon execution by a processor, performs a method comprising:

computing a first usage score as a usage function of:

a measure of use by a first identity to at least one permissioned resource of a set of permissioned resources of the resources to which the first identity has access privileges, and

a number of permissioned resources in the set of permissioned resources;

computing a second usage score for a second identity;

computing an aggregate usage score as a ratio based on:

a weighted sum of at least the first usage score and the second usage score, and

a sum of a maximum possible risk value of at least the first identity and the second identity; and

adjusting the access privileges of the identity based on the aggregate score.

18 . The non-transitory storage of claim 17 , wherein the method further comprises:

detecting attempts by the identity to access a first resource of the at least one permissioned resource wherein the identity fails to access the first resource;

adjusting the number of permissioned resources in the set of permissioned resources based on a measure of the detected failed attempts to access the first resource; and

computing the usage score using the adjusted number of permissioned resources in the set of permissioned resources.

19 . The non-transitory storage of claim 17 , wherein the method further comprises:

determining a second measure as a ratio based on the number of permissioned resources in the set of permissioned resources and a number of the resources; and

computing the first usage score using the second measure.

20 . The non-transitory storage of claim 17 , wherein the first identity and the second identity are associated with the same role usage cohort.

Assignments (2)

Continuity (3)

References Cited (15)