Generation of attribute based access control policy from existing authorization system

Patent metadata

Field	Value
Publication number	US-9264451-B2
Application number	US-201414474747-A
Country	US
Kind code	B2
Filing date	Sep 2, 2014
Priority date	Sep 17, 2013
Publication date	Feb 16, 2016
Grant date	Feb 16, 2016

Abstract

Attributes relevant to at least one existing authorization system are identified. Noise removal from identified attributes of the at least one existing authorization system is performed. An attribute based access control (ABAC) policy is generated from remaining identified attributes to derive logical rules that grant or deny access.

First claim

What is claimed is:

1. A method, comprising:
identifying attributes relevant to at least one existing authorization system;
performing noise removal from the identified attributes of the at least one existing authorization system; and
generating an attribute based access control (ABAC) policy from remaining identified attributes to derive logical rules that grant or deny access;
wherein one or more of the identifying, performing, and generating steps are performed by at least one computing node comprising a processor operatively coupled to a memory.

2. The method of claim 1 , further comprising outputting the ABAC policy rules for administrative review.

3. The method of claim 1 , wherein identifying attributes further comprises calculating an amount of entropy in a unique user identifier.

4. The method of claim 3 , wherein identifying attributes further comprises selecting a set of attributes without discrimination.

5. The method of claim 4 , wherein identifying attributes further comprises calculating entropy for each attribute of the set of attributes.

6. The method of claim 5 , wherein identifying attributes further comprises grouping attributes that are equivalent.

7. The method of claim 6 , wherein identifying attributes further comprises calculating entropy reduction for each attribute.

8. The method of claim 7 , wherein identifying attributes further comprises removing any attributes with entropy reduction below a given value and any operational attributes.

9. The method of claim 8 , wherein identifying attributes further comprises, using combinations of the remaining attributes, calculating a subset that maximizes the entropy reduction of permission assignments while limiting the number of attributes or total attribute entropy.

10. The method of claim 3 , wherein known unique identifiers are omitted from the set of attributes.

11. The method of claim 3 , further comprising dropping any attribute with entropy above a given value.

12. The method of claim 1 , wherein noise removal comprises using classifiers.

13. The method of claim 1 , wherein noise removal comprises using generalizations.

14. The method of claim 1 , wherein noise removal comprises using matrix factorization.

15. The method of claim 1 , wherein noise removal comprises using tensor decomposition.

16. The method of claim 1 , wherein noise removal comprises removing at least one of noisy assignments and noisy attributes.

17. The method of claim 1 , wherein mining an ABAC policy comprises inputting attributes of users and resources into a decision tree mining algorithm and analyzing the decision tree.

18. A computer program product comprising a computer-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processor associated with a computing node implement steps of:
identifying attributes relevant to at least one existing authorization system;
performing noise removal from the identified attributes of the at least one existing authorization system; and
generating an attribute based access control (ABAC) policy from remaining identified attributes to derive logical rules that grant or deny access.

19. An apparatus, comprising:
a memory; and
at least one processor operatively couple to the memory and configured to:
identify attributes relevant to at least one existing authorization system;
perform noise removal from the identified attributes of the at least one existing authorization system; and
generate an attribute based access control (ABAC) policy from remaining identified attributes to derive logical rules that grant or deny access.

20. The apparatus of claim 19 , wherein the at least one processor is further configured to output the ABAC policy rules for administrative review.

21. The apparatus of claim 19 , wherein identifying attributes further comprises one or more of:
calculating an amount of entropy in a unique user identifier;
selecting a set of attributes without discrimination;
calculating entropy for each attribute of the set of attributes;
grouping attributes that are equivalent;
calculating entropy reduction for each attribute;
removing any attributes with entropy reduction below a given value and any operational attributes; and
using combinations of the remaining attributes, calculating a subset that most closely matches the entropy reduction of attributes while limiting the number of attributes or total attribute entropy.

22. The apparatus of claim 21 , wherein known unique identifiers are omitted from the set of attributes.

23. The apparatus of claim 21 , wherein the at least one processor is further configured to drop any attribute with entropy above a given value.

24. The apparatus of claim 19 , wherein noise removal comprises using at least one of classifiers, generalizations, matrix factorization, and tensor decomposition.

25. The apparatus of claim 19 , wherein mining an ABAC policy comprises inputting attributes of users and resources into a decision tree mining algorithm and analyzing the decision tree.

Assignees

• IBM

Inventors

• Chari Suresh N
• Molloy Ian M

Classifications

• G06N99/005

  Physics · mapped topic

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06N20/00

  Machine learning · CPC title