Trust-based verification system and method for scalable access control and cyber-security qualifications
Provided are a platform and a computer-implemented process of controlling access to a restricted resource by verifying qualifications in compliance with a regulatory security framework. A computing system receives a configuration package including a qualification set, a threshold trust for a qualification, a plurality of different sources that could potentially provide information indicative of the qualification, and a different trust level to be assigned to each of the sources. The computing system also receives the information indicative of the qualification from a first source. A first trust level assigned to the first source is compared to the threshold trust associated with the qualification. Responsive to a determination that the first trust level satisfies the trust threshold, the qualification is flagged as being verified without human intervention to control access to the restricted resource.
1 . A computer-implemented process of controlling access to a restricted resource by verifying qualifications in compliance with a regulatory security framework, the computer-based implemented process comprising:
receiving, with a cloud-based computing system, a configuration package comprising:
(i) a qualification set comprising a qualification requested of a candidate to gain access to the restricted resource,
(ii) a threshold trust for the qualification that is to be established for the qualification to be considered verified,
(iii) a plurality of different sources that could potentially provide information indicative of the qualification, and
(iv) a different trust level to be assigned to each of the plurality of different sources, wherein trust level establishes a degree to which each of the plurality of different sources is considered trustworthy;
wherein the configuration package is obtained from user selections of the quality sets, the threshold trust, the different sources, and the different trust level to be assigned to each of the plurality of different sources from a menu displayed by the cloud-based computing system;
receiving, with the cloud-based computing system via a digital communication channel, the information indicative of the qualification from a first source included in the plurality of different sources;
generating, with the cloud-based computing system, a data structure associated with the candidate comprising the information received from the first source;
comparing, with the cloud-based computing system, a first trust level assigned to the first source to the threshold trust associated with the qualification;
responsive to a determination that the first trust level does not satisfy the threshold trust, requesting, with the cloud-based computing system via a second digital communication channel, additional information from an external digital source over a communication network, the external digital source being a second source located remotely from the cloud-based computing system, and the second source included in the plurality of different sources;
receiving, with the cloud-based computing system via the second digital communication channel, the additional information indicative of the qualification from the second source;
adding, with the cloud-based computing system, a second trust level assigned to the second source to the first trust level assigned to the first source to generate a combined trust level;
comparing, with the cloud-based computing system, the combined trust level to the threshold trust associated with the qualification; and
responsive to a determination that the combined trust level satisfies the trust threshold, modifying the data structure to flag the qualification as being verified without human intervention;
responsive to a determination that the first trust level satisfies the trust threshold, modifying the data structure to flag the qualification as being verified without human intervention; and
controlling, with the cloud-based computing system, access to the restricted resource based, at least in part, on the qualification being flagged in the data structure.
2 . The computer-implemented process of claim 1 further comprising: responsive to a determination that the first trust level fails to satisfy the trust threshold, modifying the data structure to flag the qualification as requiring supplemental verification before the qualification can be verified.
3 . The computer-implemented process of claim 1 , wherein the first source and the second source are different digital sources, and the data structure is modified without human intervention to flag the qualification as being verified based on the combined trust level.
4 . The computer-implemented process of claim 1 , wherein the first source is a digital source and the first trust level is a relatively-high trustworthiness;
the second source is the candidate, and the second trust level is a relatively-low trustworthiness; and
the data structure is modified without human intervention to flag the qualification as being verified based on the combined trust level.