Computer-implemented method for role discovery in access control systems

• US 9,405,921 B1
• Filed: 07/31/2007
• Issued: 08/02/2016
• Est. Priority Date: 07/31/2007
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company), Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Schreiber, Robert Samuel, Tarjan, Robert E., Shah, Mehul A., Horne, William G.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US11/888,381
• Time in Patent Office: 3,290 Days
• Field of Search: 726 1- 4
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

One embodiment relates to a computer-implemented method for role discovery in access control systems. User accounts are selected according to a predetermined algorithm. For each selected user account, a new role is created covering a set of permissions including all permissions which the user account needs but is not yet covered by another role that the user account has. The new role is given to the user account so that all permissions needed by the user account are covered. Any additional user accounts which still need the set of permissions covered by the new role are also found, and the new role is given to these additional user accounts, if any. Other features, aspects and embodiments are also disclosed.

Claims

1. A computer-implemented method for role discovery in access control systems, the method comprising:

selecting a user account according to a predetermined algorithm;

creating a new role covering a set of permissions including all permissions which the user account needs but is not yet covered by another role that the user account has;

giving the new role to the user account so that all permissions needed by the user account are covered;

finding any additional user accounts which still need the set of permissions covered by the new role; and

giving the new role to the additional user accounts, if any.

2. The computer-implemented method for role discovery of claim 1, wherein the predetermined algorithm comprises selecting a user account having a fewest uncovered permissions from among user accounts having at least one uncovered permission.

3. The computer-implemented method for role discovery of claim 1, wherein the predetermined algorithm comprises selecting a user account having a most uncovered permissions from among user accounts having at least one uncovered permission.

4. The computer-implemented method for role discovery of claim 1, wherein the predetermined algorithm comprises a random selection of a user account from among user accounts having at least one uncovered permission.

5. The computer-implemented method for role discovery of claim 1, wherein the method is repeated until there are no more users with uncovered permissions.

6. The computer-implemented method for role discovery of claim 5, further comprising receiving an initial partial set of roles.

7. The computer-implemented method of claim 1, further comprising:

a simplifying procedure to reduce a complexity of a discovered set of roles.

8. The computer-implemented method of claim 7, wherein the simplifying procedure comprises:

finding a pair of roles with overlap in coverage;

creating a potential new role which covers said overlap;

considering a change where the potential new role is given to user accounts having either of said pair of roles and modifying said pair of roles to eliminate said overlap;

determining whether said change reduces said complexity; and

implementing said change if said change reduces said complexity.

9. The computer-implemented method of claim 7, wherein the simplifying procedure comprises:

determining a proposed new role which is an over-approximation of existing permissions;

outputting the proposed new role to a supervising user; and

upon receiving approval of the proposed new role, creating the proposed new role and correspondingly canceling unnecessary existing roles.

10. The computer-implemented method of claim 7, wherein the simplifying procedure comprises:

determining a proposed new role assignment which is an over-approximation of existing permissions;

outputting the proposed new role assignment to a supervising user; and

implementing the proposed new role assignment upon receiving approval.

11. The computer-implemented method of claim 1, further comprising:

determining a lower bound for a number of roles given a data set for the access control system; and

outputting a comparison of a number of roles in a discovered role set and the lower bound to provide a quantitative measure of quality of the discovered role set.

12. An automated method for discovery of roles for an access control system, the method comprising:

creating at least two potential roles using at least two independent procedures each potential role covering a set of permissions including all permissions which a user account needs but is not yet covered by another role that the user account has;

generating at least two potential role sets each comprising one of the at least two potential roles;

comparing said role sets to determine a preferred role set;

selecting the preferred role set; and

identifying a new role based at least in part on the selection of the preferred role set.

13. The automated method of claim 12, wherein at least one of the independent procedures comprises:

selecting a user account according to a predetermined algorithm;

giving the new role to the user account so that all permissions needed by the user account are covered;

finding any additional user accounts which still need the set of permissions covered by the new role; and

giving the new role to the additional user accounts, if any.

14. The automated method of claim 12, wherein the independent procedures include a first procedure and a second procedure, each of the first and second procedures comprising:

selecting a user account according to a predetermined algorithm;

giving the new role to the user account so that all permissions needed by the user account are covered;

finding any additional user accounts which still need the set of permissions covered by the new role; and

giving the new role to the additional user accounts, if any.

15. The automated method of claim 14, wherein the predetermined algorithm for the first procedure comprises selecting a user account having a fewest uncovered permissions from among user accounts having at least one uncovered permission, and wherein the predetermined algorithm for the second procedure comprises selecting a user account having a most uncovered permissions from among user accounts having at least one uncovered permission.

16. The automated method of claim 12, further comprising:

a simplifying procedure to reduce a complexity of the preferred role set.

17. The automated method of claim 12, further comprising:

determining a lower bound for a number of roles given a data set for the access control system; and

outputting a comparison of a number of roles in the preferred role set and the lower bound to provide a quantitative measure of quality of the preferred role set.

18. A non-transitory computer-readable medium configured with computer-readable program code to perform automated role discovery for an access control system, the non-transitory computer-readable medium comprising:

computer-readable program code configured to choose a user account according to a predetermined algorithm;

computer-readable program code configured to generate a new role covering a set of permissions including all permissions which the user account needs but is not yet covered by another role that the user account has;

computer-readable program code configured to assign the new role to the user account so that all permissions needed by the user account are covered;

computer-readable program code configured to determine any additional user accounts which still need the set of permissions covered by the new role; and

computer-readable program code configured to assign the new role to the additional user accounts, if any.

19. The non-transitory computer-readable medium of claim 18, further comprising:

computer-readable program code configured to perform a simplifying procedure to reduce a complexity of a discovered role set.

20. The non-transitory computer-readable medium of claim 18, further comprising:

computer-readable program code configured to determine a lower bound for a number of roles given a data set for the access control system; and

computer-readable program code configured to output a comparison of a number of roles in a discovered role set and the lower bound to provide a quantitative measure of quality of the discovered role set.

21. A non-transitory computer-readable medium configured with computer-readable program code to perform automated role discovery for an access control system, the non-transitory computer-readable medium comprising:

computer-readable program code configured to generate a plurality of role sets, each role set comprising a new role covering a set of permissions including all permissions which a user account needs but is not yet covered by another role that the user account has;

computer-readable program code configured to compare said plurality of role sets to determine a preferred role set; and

computer-readable program code configured to select the preferred role set.