Automatic policy generation based on role entitlements and identity attributes

• US 20050138061A1
• Filed: 12/19/2003
• Published: 06/23/2005
• Est. Priority Date: 12/19/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sampathkumar, Govindaraj, Shankar, Hari, Gupta, Pratik, Kuehr-McLaren, David G., Taank, Sumit, Williams, Vincent C., Cutcher, Sharon L., Stube, Brian A.
• Granted Patent: US 7,284,000 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 17/00 Digital computing or data processing equipment or methods, specially adapted for specific functions information retrieval, database structures or file system structures therefor G06F16/00
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Policies defining the entitlements to be assigned to a new identity joining a role are automatically generated. An automatic policy assigns a new identity the entitlements commonly owned by a predetermined number of identities in the role, which may be all of the role identities. A conditional policy recommends that a new identity be assigned the non-commonly-owned entitlements associated with the role identity whose non-entitlement attributes most closely match the non-entitlement attributes of the new identity. This may be automatically determined by iterating through a vector that maps the non-commonly-owned entitlements with the non-entitlement attributes of each role identity, comparing the non-entitlement attributes of the new identity to find the closest match. The non-commonly-owned entitlements of that identity are then recommended to be assigned to the new identity, upon approval.

Claims

1. A method of automatically generating a policy for a role, said role comprising a plurality of identities having attributes that include entitlements and non-entitlement attributes, comprising:

automatically obtaining a list of attributes possessed by a predetermined number of the identities in said role;

automatically extracting from said list of attributes a first list of entitlements common to all of said predetermined number of the identities in said role; and

automatically forming a policy for said role that said first list of entitlements will be given to an identity subsequently added to said role.

2. The method of claim 1 wherein said predetermined number of the identities in said role is the total number of identities in said role.

3. The method of claim 2 further comprising:

automatically extracting from said list of attributes a second list of entitlements not common to all identities in said role;

automatically creating a vector, considering each identity associated with an entitlement in said second list, mapping the set of non-entitlement attributes possessed by said identity to the non-commonly-owned entitlements possessed by said identity;

when a new identity having attributes is added to said role, automatically iterating through said vector to determine the identity whose non-entitlement attributes most closely match the non-entitlement attributes of said new identity; and

automatically forming an additional policy for said role recommending that said new identity be given the entitlements of said most closely matching identity.

4. The method of claim 3 further comprising:

obtaining approval of said recommendation; and

giving said new identity said entitlements.

5. The method of claim 3 wherein automatically creating said vector comprises automatically applying Association Rule Mining to the non-entitlement attributes and non-commonly-owned entitlements for each identity in said second list.

6. A method of assigning entitlements to a new identity upon joining a role, comprising:

providing a role comprising a plurality of identities having attributes that include entitlements and non-entitlement attributes;

automatically generating a policy for said role based on said entitlements; and

when a new identity having attributes is subsequently added to said role, applying said policy to said new identity.

7. The method of claim 6 wherein said policy comprises an automatic policy.

8. The method of claim 7 wherein said automatic policy comprises assigning to said new identity a set of entitlements possessed by a predetermined number of the identities in said role.

9. The method of claim 7 wherein said predetermined number of the identities in said role is the total number of identities in said role.

10. The method of claim 6 wherein said policy comprises a conditional policy.

11. The method of claim 10 wherein said conditional policy comprises recommending that said new identity be assigned the entitlements possessed by the role identity most closely matching said new identity.

12. The method of claim 11 wherein the role identity most closely matching said new identity is the role identity whose non-entitlement attributes most closely match the non-entitlement attributes of said new identity.

13. The method of claim 12 wherein the role identity most closely matching said new identity is determined by:

automatically obtaining a list of entitlements not common to all identities in said role;

automatically creating a vector, for each identity associated with an entitlement in said list, mapping the set of non-entitlement attributes possessed by said identity to the non-commonly-owned entitlements possessed by said identity;

automatically iterating through said vector, comparing the non-entitlement attributes of each role identity to the non-entitlement attributes of said new identity, to determine the role identity most closely matching said new identity.

14. The method of claim 13 wherein automatically creating said vector comprises automatically applying Association Rule Mining to the non-entitlement attributes and non-commonly-owned entitlements for each said role identity in said list.

15. A computer readable medium including one or more computer programs operative to cause a computer to generate at least one policy for a role comprising a plurality of identities having attributes that include entitlements and non-entitlement attributes, the computer programs causing the computer to perform the steps of:

obtaining a list of attributes possessed by a predetermined number of the identities in said role;

extracting from said list of attributes a first list of entitlements common to all of said predetermined number of the identities in said role; and

forming a policy for said role that said first list of entitlements will be given to an identity subsequently added to said role.

16. The computer readable medium of claim 15 wherein said predetermined number of the identities in said role is the total number of identities in said role.

17. The computer readable medium of claim 16, said computer programs further causing the computer to perform the steps of:

extracting from said list of attributes a second list of entitlements not common to all identities in said role;

creating a vector, for each identity associated with an entitlement in said second list, mapping the set of non-entitlement attributes possessed by said identity to the non-commonly-owned entitlements possessed by said identity;

when a new identity having attributes is added to said role, iterating through said vector to determine the identity whose non-entitlement attributes most closely match the non-entitlement attributes of said new identity; and

forming an additional policy for said role recommending that said new identity be given the entitlements of said most closely matching identity.

18. The computer readable medium of claim 17, said computer programs further causing the computer to perform the steps of:

obtaining approval of said recommendation; and

giving said new identity said entitlements.

19. The computer readable medium of claim 18 wherein creating said vector comprises applying Association Rule Mining to the non-entitlement attributes and non-commonly-owned entitlements for each identity in said second list.