Automatically Discovering Attribute Permissions

• US 20190311140A1
• Filed: 04/09/2018
• Published: 10/10/2019
• Est. Priority Date: 04/09/2018
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Braksator, Mark, Biskar, Daniel, Hassoun, Bassam
• Granted Patent: US 10,831,904 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 9/4451 User profiles; Roaming
• CPC Class Codes: G06Q 10/06311 Scheduling, planning or task assignment for a person or group
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Automatically discovering attribute permissions is provided. A profile indicating a set of attributes that can be converted into permissions for a new target instance is provided. In response to detecting that the new target instance is being added, a convertible set of attributes for the new target instance is searched for based on the profile. Search results for the convertible set of attributes are displayed. Ones of the convertible set of attributes are selected as a set of attribute permissions for the new target instance for access control to the new target instance.

Claims

1. A method for automatically discovering attribute permissions, the method comprising:

providing a profile indicating a set of attributes that can be converted into permissions for a new target instance;

responsive to detecting that the new target instance is being added, searching for a convertible set of attributes for the new target instance based on the profile;

displaying search results for the convertible set of attributes; and

selecting ones of the convertible set of attributes as a set of attribute permissions for the new target instance for access control to the new target instance.

2. The method of claim 1, wherein the searching for the convertible set of attributes for the new target instance further comprises:

calculating one of a union or an intersection of all sets of permissions on targets of a same type as the new target instance; and

applying a result of one of the union or the intersection on all the sets of permissions to generate the convertible set of attributes.

3. The method of claim 1 further comprising:

filtering the convertible set of attributes based on domain expertise of usage patterns to generate a display set of attributes.

4. The method of claim 3, wherein the display set of attributes include attributes that are candidates for at least one or more of provisioning group access, entitlements, access certification and recertification, segregation of duties, and role mining.

5. The method of claim 3, and wherein the display set of attributes include attributes that are candidates for rights values defined on selected non-group-based attribute permissions.

6. The method of claim 1, wherein the profile corresponds to a target of a same type as the new target instance for the searching.

7. The method of claim 1 further comprising:

customizing suggestion logic based on usage patterns including one of an identity of an administrator who defined attribute permissions on existing target instances or how frequently attribute permissions were assigned to users.

8. The method of claim 1 further comprising:

provisioning accounts, which include the set of attribute permissions for the new target instance, to users of the new target instance.

9. The method of claim 8 further comprising:

controlling access to the new target instance based on assigned attribute permissions in respective accounts corresponding to particular users.

10. The method of claim 1 further comprising:

responsive to the computer determining that a new provisioning policy is being added, searching, by the computer, for a set of existing policies of a same target type.

11. A computer system for automatically discovering attribute permissions, the computer system comprising:

a bus system;

a storage device connected to the bus system, wherein the storage device stores program instructions; and

a processor connected to the bus system, wherein the processor executes the program instructions to;

provide a profile indicating a set of attributes that can be converted into permissions for a new target instance;

search for a convertible set of attributes for the new target instance based on the profile in response to detecting that the new target instance is being added;

display search results for the convertible set of attributes; and

select ones of the convertible set of attributes as a set of attribute permissions for the new target instance for access control to the new target instance.

12. The computer system of claim 11, wherein the processor further executes the program instructions to:

calculate one of a union or an intersection of all sets of permissions on targets of a same type as the new target instance; and

apply a result of one of the union or the intersection on all the sets of permissions to generate the convertible set of attributes.

13. The computer system of claim 11, wherein the processor further executes the program instructions to:

filter the convertible set of attributes based on domain expertise of usage patterns to generate a display set of attributes.

14. The computer system of claim 13, wherein the display set of attributes include attributes that are candidates for at least one or more of provisioning group access, entitlements, access certification and recertification, segregation of duties, and role mining.

15. A computer program product for automatically discovering attribute permissions, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

providing a profile indicating a set of attributes that can be converted into permissions for a new target instance;

responsive to the computer detecting that the new target instance is being added, searching for a convertible set of attributes for the new target instance based on the profile;

displaying search results for the convertible set of attributes; and

selecting ones of the convertible set of attributes as a set of attribute permissions for the new target instance for access control to the new target instance.

16. The computer program product of claim 15, wherein the searching for the convertible set of attributes for the new target instance further comprises:

calculating one of a union or an intersection of all sets of permissions on targets of a same type as the new target instance; and

applying a result of one of the union or the intersection on all the sets of permissions to generate the convertible set of attributes.

17. The computer program product of claim 15 further comprising:

filtering the convertible set of attributes based on domain expertise of usage patterns to generate a display set of attributes.

18. The computer program product of claim 17, wherein the display set of attributes include attributes that are candidates for at least one or more of provisioning group access, entitlements, access certification and recertification, segregation of duties, and role mining.

19. The computer program product of claim 17, and wherein the display set of attributes include attributes that are candidates for rights values defined on selected non-group-based attribute permissions.

20. The computer program product of claim 15, wherein the profile corresponds to a target of a same type as the new target instance for the searching.