Automatic Policy Generation Based on Role Entitlements and Identity Attributes

• US 20080016104A1
• Filed: 07/20/2007
• Published: 01/17/2008
• Est. Priority Date: 12/19/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sampathkumar, Govindaraj, Williams, Vincent, Stube, Brian, Cutcher, Sharon, Shankar, Hari, Gupta, Pratik, Kuehr-McLaren, David, Taank, Sumit
• Granted Patent: US 8,533,168 B2
• Time in Patent Office: Days
• US Class Current: 707/102
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 17/00 Digital computing or data processing equipment or methods, specially adapted for specific functions information retrieval, database structures or file system structures therefor G06F16/00
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Policies defining the entitlements to be assigned to a new identity joining a role are automatically generated. An automatic policy assigns a new identity the entitlements commonly owned by a predetermined number of identities in the role, which may be all of the role identities. A conditional policy recommends that a new identity be assigned the non-commonly-owned entitlements associated with the role identity whose non-entitlement attributes most closely match the non-entitlement attributes of the new identity. This may be automatically determined by iterating through a vector that maps the non-commonly-owned entitlements with the non-entitlement attributes of each role identity, comparing the non-entitlement attributes of the new identity to find the closest match. The non-commonly-owned entitlements of that identity are then recommended to be assigned to the new identity, upon approval.

Claims

1. A method of automatically generating a policy for a role, said role comprising a plurality of identities of individuals, each identity having attributes that include entitlements and non-entitlement attributes, comprising:

automatically obtaining a list of attributes possessed by a predetermined number of the identities in said role;

automatically extracting from said list of attributes a list of entitlements common to all of said predetermined number of the identities in said role; and

automatically forming a policy for said role that said list of entitlements will be given to an identity subsequently added to said role.

2. The method of claim 1 wherein said predetermined number of the identities in said role is the total number of identities in said role.

3. A method of assigning entitlements to a new identity upon joining a role, comprising:

providing a role comprising a plurality of identities of individuals, the identities having attributes that include entitlements and non-entitlement attributes;

automatically generating a policy for said role based on said entitlements; and

when a new identity having attributes is subsequently added to said role, applying said policy to said new identity.

4. The method of claim 3 wherein said policy comprises an automatic policy.

5. The method of claim 4 wherein said automatic policy comprises assigning to said new identity a set of entitlements possessed by a predetermined number of the identities in said role.

6. The method of claim 4 wherein said predetermined number of the identities in said role is the total number of identities in said role.

7. The method of claim 3 wherein said policy comprises a conditional policy.

8. The method of claim 7 wherein said conditional policy comprises recommending that said new identity be assigned the entitlements possessed by the role identity most closely matching said new identity.

9. The method of claim 8 wherein the role identity most closely matching said new identity is the role identity whose non-entitlement attributes most closely match the non-entitlement attributes of said new identity.

10. A computer readable medium including one or more computer programs operative to cause a computer to generate at least one policy for a role comprising a plurality of identities of individuals, the identities having attributes that include entitlements and non-entitlement attributes, the computer programs causing the computer to perform the steps of:

obtaining a list of attributes possessed by a predetermined number of the identities in said role;

extracting from said list of attributes a first list of entitlements common to all of said predetermined number of the identities in said role; and

forming a policy for said role that said first list of entitlements will be given to an identity subsequently added to said role.

11. The computer readable medium of claim 10 wherein said predetermined number of the identities in said role is the total number of identities in said role.