Automatic policy generation based on role entitlements and identity attributes

• US 8,533,168 B2
• Filed: 07/20/2007
• Issued: 09/10/2013
• Est. Priority Date: 12/19/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kuehr-McLaren, David G., Gupta, Pratik, Sampathkumar, Govindaraj, Williams, Vincent C., Cutcher, Sharon L., Taank, Sumit, Stube, Brian A., Shankar, Hari
• Primary Examiner(s): CHANNAVAJJALA, SRIRAMA T
• Application Number:
  US11/780,956
• Publication Number:
  US 20080016104A1
• Time in Patent Office: 2,244 Days
• Field of Search: 706 45- 50, 709/203, 709218-222, 707 1- 2, 707 9- 10, 707/100, 707/102, 707/200, 707/201, 707/205, 707602-603, 707/736, 707/781, 707/783, 707/785, 707694-695, 707/758, 707/786, 726 1- 7, 705 716- 717, 705/7.42
• US Class Current: 707/694
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 17/00 Digital computing or data processing equipment or methods, specially adapted for specific functions information retrieval, database structures or file system structures therefor G06F16/00
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Policies defining the entitlements to be assigned to a new identity joining a role are automatically generated. An automatic policy assigns a new identity the entitlements commonly owned by a predetermined number of identities in the role, which may be all of the role identities. A conditional policy recommends that a new identity be assigned the non-commonly-owned entitlements associated with the role identity whose non-entitlement attributes most closely match the non-entitlement attributes of the new identity. This may be automatically determined by iterating through a vector that maps the non-commonly-owned entitlements with the non-entitlement attributes of each role identity, comparing the non-entitlement attributes of the new identity to find the closest match. The non-commonly-owned entitlements of that identity are then recommended to be assigned to the new identity, upon approval.

Claims

1. A method of automatically generating a policy for a role, said role comprising a plurality of identities of individuals, each identity having attributes that include entitlements and non-entitlement attributes, comprising:

automatically obtaining a list of attributes possessed by a predetermined number of the identities in said role;

automatically extracting from said list of attributes a list of entitlements common to all of said predetermined number of the identities in said role; and

automatically forming a policy for said role that said list of entitlements will be given to an identity subsequently added to said role.

2. The method of claim 1 wherein said predetermined number of the identities in said role is the total number of identities in said role.

3. A method of assigning entitlements to a new identity upon joining a role, comprising:

providing a role comprising a plurality of identities of individuals, the identities having attributes that include entitlements and non-entitlement attributes;

automatically generating a policy for said role based on said entitlements; and

when a new identity having attributes is subsequently added to said role, applying said policy to said new identity.

4. The method of claim 3 wherein said policy comprises an automatic policy.

5. The method of claim 4 wherein said automatic policy comprises assigning to said new identity a set of entitlements possessed by a predetermined number of the identities in said role.

6. The method of claim 4 wherein said predetermined number of the identities in said role is the total number of identities in said role.

7. The method of claim 3 wherein said policy comprises a conditional policy.

8. The method of claim 7 wherein said conditional policy comprises recommending that said new identity be assigned the entitlements possessed by the role identity most closely matching said new identity.

9. The method of claim 8 wherein the role identity most closely matching said new identity is the role identity whose non-entitlement attributes most closely match the non-entitlement attributes of said new identity.